The Connector Service uses WMI in order to connect to your DCs and collect events. If the permissions for these connections are not set, then you may see "Access Denied" errors in your dashboard. To manually test WMI connectivity, you can follow these steps:
This test must be run on the computer running the connector. To run the test:
- Click Start > Run > WBEMTest > OK.
- The following screen should appear:
- Click Connect.
- Pick a DC which is experiencing the issue or which support has instructed you to run the test at. This must be a different machine than the one you are running this test on.
- Type the IP you are trying to connect to in the following format. Do NOT use the hostname.
Note the WBEMTest should be run on the same machine as the connector is installed on and in this step, you are connecting to a remote DC.
- Under credentials, use the OpenDNS_Connector user as well as the password.
Note: To run this test directly on a DC, use "root\cimv2" as the Namespace and blank Username and Password fields.
- Click Connect.
- Access Denied error here? Check WMI and DCOM permissions. Note, DCOM requires a reboot if changed. See our Access Denied article here.
- Click Notification Query.
- Paste the following contents inside the white text box:
SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' and TargetInstance.LogFile = 'Security' AND (TargetInstance.EventCode = 528 OR TargetInstance.EventCode = 540 OR TargetInstance.EventCode = 4624 OR TargetInstance.EventCode = 538 OR TargetInstance.EventCode = 4647 OR TargetInstance.EventCode = 4634 OR TargetInstance.EventCode = 4768 OR TargetInstance.EventCode = 4769)
- Click Apply.
- Access Denied error here? Ensure the Event Log Readers group can access the event logs with our help article here.
- If everything is working properly you should start seeing objects, like in the screenshot below; otherwise, you are either missing WMI permissions or having connection issues to the remote server.