WMIC stopped working on Windows 10 2004

Question

I use WMIC to pull logs from remote machines internally. After we upgraded a few machines to Windows 10 2004 it stopped working for those machines and we now getting the following error:

[wmi/wmic.c:196:main()] ERROR: Login to remote object.

NTSTATUS: NT code 0x80010111 - NT code 0x80010111

This indicates that Windows has changed something either in Samba or RPC to prevents WMIC from work. I know that WMIC is not an official Microsoft Product but wanted to know if Microsoft has published anything work arounds for this issue or if they have made any statements confirming changes to samba, RPC, or have acknowledged that WMIC no longer will work with there products?

Answer 1

We have investigated the problem with the WMIC tool. An issue has been identified with the 2004 release of Windows 10 that impacts DCOM versions 5.1 through 5.6. The issue is being addressed for a future Windows release.

The tool is using DCOM 5.1, which is considerably aged. DCOM 5.4 was used by Windows 95 & 98, DCOM 5.6 was used by Windows 2000, but Windows has used DCOM 5.7 since Windows XP.

Updating the tool to use DCOM 5.7 or a more modern transport such as HTTP would resolve the issue. Otherwise, it should work once the issue above has been fixed.

Best Regards,
Jeff McCashland
Microsoft Open Specifications

Answer 2

Do you see any logon errors in the security eventlog on the target machine?

Did you try re-running "winrm quickconfig" on the target machine?

Did you configure the firewall to log dropped packets for Domain/Private/Public? Any entries in the log?

Open a Powershell prompt on the source machine using an account that has admin access to the target machine. Do both of these commands fail with the same error? Use your machine name.

wmic.exe /node:test10b path Win32_OperatingSystem get Caption,Version,OSArchitecture,CSName /format:table
Get-CimInstance -ComputerName test10b Win32_OperatingSystem | select Caption, Version, OSArchitecture, CSName | Format-table  

I don't quite understand your last comments. Wmic.exe has been part of Windows for a long time and while MS may no longer be enhancing it, I would expect it to still work. If you are using some other WMIC, then you should be more specific about your environment and the commands/functions being executed.

Answer 3

Hi,

Are you using WMI plus plugin? If yes, kindly check below posts and reach the coresponding support.

Windows 2004 breaks WMI plus plugin
https://forum.nemslinux.com/viewtopic.php?t=741
Help Needed: wmic broken as of Windows 10 Version 2004
https://edcint.co.nz/checkwmiplus/help-needed-wmic-broken-as-of-windows-10-version-2004/

---

Hope this helps and please help to accept as Answer if the response is useful.

Thanks,
Jenny

Answer 4

Not exactly sure where we first obtained it, as it looks like I am unable to find any packages online. I know that another big company (not going to name names) pointed us in this direction as well as they use it in there software.

Then your best bet is to get this other big company to fix it if their software depends on it working. From a Microsoft point of view, you're using a 3rd party program of unknown origin and if it doesn't work, that not a MS problem.

If you can recreate the error from Windows to Windows, then you can open a case with Microsoft and get them to fix it. But you will need to be using supported Windows versions on both the client and the server. (If you recreate the error with XP or Server 2003, you're out of luck.)

If this WMIC is open source, then you might be able to fix it yourself. A search of the net indicates that 0x80010111 is an RPC header issue. On the "2004" machine trace the same WMI call from a Windows machine and the Linux machine using WireShark or Network Monitor 3.4. Then compare the traffic and see if you can find where the error occurs. Compare the good vs bad data packets and see if you can find where in the code that packet is built and modify the code to get it to work.

Answer 5

Hi James

Did the patch fix your problem? If not you can add tag openspecs-windows to your original post, one of the Microsoft Open Specifications Support will be glad to assist you.