Issue to integrate Domain Controller (Windows Server 2019) with WMI

[Waloo5]

Hello everyone,

I have issue to integrate Domain Controller (Windows Server 2019) with WMI "failed (Login to remote object error)" when I configure the credential and would test I receive this message "failed (Win32_OperatingSystem Result not found via OMI)"

-IN Credentials > Access Method Definition I use OMI 

- All Steps are done correctely as External Systems Configuration Guide

https://docs.fortinet.com/document/fortisiem/7.1.7/external-systems-configuration-guide/421011/micro...

- I removed the Kaspersky from server too

Please can anyone help 

FortiSIEM 

[FSM_FTNT]

It sounds like a connectivity issue or user account permission issue.

You can try via the CLI from the FortiSIEM node that will be discovering the AD server, replacing the user, password and host

omic -s /opt/phoenix/config/smb.conf -U user%password //host "select * from Win32_NTLogEvent where Logfile='security"

[Waloo5]

Hi @FSM_FTNT ,

Yes, I agree but when I try to get info WMI from another windows servers in the same VLAN as FortiSIEM I have response with no issue. 

FortiSIEM have a issue to get response when trying omic command:

Result: MI_RESULT_FAILED

Message = Could not connect

Probleme Cause Description= Could not connect

OMI_ErrorMessage=A general error occured, not covered by a more specific error code.

[Waloo5 · Accepted solution]

Hello everyone,

Good news for me, 

- The result of this command "winrm enumerate winrm/config/listener" I have in line Listener [source="GPO"] and "ListeningOn= null" 

- The result of command: netstat -a     no port 5985 on litening

==> solution: Create GPO in DC to force listening on all interfaces in WinRM Service.