Home > Trouble Shooting > Errors when Auditing

Errors when Auditing

When auditing computer you may receive an error message.  Some common error messages include...

Message:  Offline or The RPC Server is unavailable
WMI Remote Administration Connection Failed or the Computer is Offline.

Message: (IP Address) The RPC Server is unavailable
WMI Remote Administration Connection Failed but there was a successful ping response from the IP Address.

Message: (IP Address) Access Denied
WMI Remote Administration Connection was successful but the user requesting access was denied.  Verify the credentials used in the audit have administrative privileges to computer(s) you are attempting to audit.

Message: no such host is known
DNS was unable to resolve the computer name.  Check that the computer name is spelled correctly.

Message: IP address does not resolve to a host
DNS was unable to resolve the IP Address to a computer.  This is a normal error when auditing by IP Range if there is not computer at the specified address.


The RPC Server is unavailable Message
For remote auditing of computers to be successful Web Tracks needs to connect to the system using Windows Management Instrumentation (WMI).  The WMI service needs to be running on the computer and Remote Administration and WMI access must be allowed through the firewall.  Additionally DNS errors in resolving host names to IP Addresses and IP Addresses to host names can also cause this error. 

As an alternative to remote auditing you may also use WTAudit.exe.  Running WTAudit.exe locally on a computer bypasses the Remote Administration and firewall checks.  This method creates a xml file of the audit which can be imported into Web Tracks (Admin--Audit Computer--Import Audit Files). 

The remainder of this document describes steps that can be take so you do not receive the RPC error for computer which are online.


Verify that the 'Windows Management Instrumentation' Service is not disabled.

To verify this login to the computer you are trying to audit and choose Start--Control Panel--Administrative Tools--Services.




Windows Firewall Settings Using the Command Prompt (run as administrator)

If you have Windows Firewall enabled by default the Audit will be unable to connect to these computers. To enable remote administration through the Windows Firewall on a computer open a command prompt on the computer and type "netsh Firewall set service RemoteAdmin".



    NOTE: On Windows 7 the command should be:
    netsh firewall set service type=remoteadmin mode=enable

    You may receive a deprecated message but the firewall rule will still be set.

Using the Windows Firewall GUI



In addition to Remote Administration also verify "Windows Management Instrumentation (WMI)" is allowed.


Firewall Settings Using Group Policy
You can enable remote administration through the Firewall for your entire domain by editing the group policy for your domain. Open the group policy editor (Windows Server 2003 steps) and browse to Computer Configuration--Administrative Templates--Network--Network Connections--Windows Firewall--Domain Profile. From here you will see "Windows Firewall: Allow remote administration exception". Configure this option to be enabled.
 
Repeat this for Windows Management Instrumentation (WMI-In) and Windows Management Instrumentation (DCOM-in).

To activate this policy choose start--run then type gpupdate. This policy may take up to 15 minutes to propagate to your domain computers. 

The following image shows an example of what this looks like in Windows 2008 R2.


Verify Reverse DNS lookup is correct.
Open a command prompt and type ping -a <IP ADDRESS>

The first line of the response will be "Pinging <COMPUTER-NAME>"

If the "COMPUTER-NAME" is incorrect for the given "IP ADDRESS" there is a reverse DNS lookup issue that must be resolved.

Verify the client computer is not connected to the wrong DNS server (home ISP or your ISP for example).  Computers on your domain should typically point your DNS server (your DNS server would then have forwarders to your ISP for names it cannot resolve).

Advanced Troubleshooting

Troubleshooting "The RPC Server is unavailable"