2

When I asked this question (both here on SF and IRL) about how to remotely access WMI, the answer I got from multiple sources was "use a fixed port." I've tried doing this, but it doesn't seem to be working, and as the other question is about firewalls, I'm asking this separately:

  1. Why is the WMI service not listening on port 24158? When I use netstat -ano, port 24158 is nowhere to be found, nor is the WMI service process ID.
  2. How will client machines know to use this port in the first place?

Do client machines have to make an RPC call over port 135, get the port number, which will then make the WMI process start listening, and the client will then contact the WMI service over whatever port it was told?

I've confirmed that the WMI service is running as a stand-alone process, and that it is using static port 24158 (by going to Component Services, DCOM Config, WMI properties, Endpoints, TCP/IP properties). The RPC service is also running.

Community
  • 1
nateirvin
  • 151
  • 1
  • 7
  • Is this server in an isolated subnet behind a firewall? If so, is it possible to put a host within the same subnet to attempt a wmi query with? If the attempt fails and they are both in the same security context then you know you have a local wmi problem rather than a network/firewall blocking issue. – Citizen Apr 10 '15 at 03:13
  • I finally got the firewall sorted, and given what I can see now (winmgmt suddenly started listening on 24158 after some traffic came in to port 135), I'm feeling like my proposed explanation from that second to last paragraph is the correct one. – nateirvin Apr 30 '15 at 17:07
  • You should type up an answer to your question as an answer and award yourself the answer. Always nice when we figure things out on our own. :) – Citizen Apr 30 '15 at 18:06
  • @PaulDelasaux, not to start a meta discussion here, but I don't feel it qualifies as an answer so much as ["not completely wrong."](http://meta.stackexchange.com/a/4218/250968) – nateirvin Apr 30 '15 at 21:13

1 Answers1

1

The answer is "Yes," you contact the target on port 135, it opens up port 24158 in response to that and replies to you that it is available on port 24158, and you can continue the conversation there. (Before you made this change, it would pick a port from the range and provide that port in the response.)

Given the comments, it appears you have figured that out, but I'm posting the answer anyway to make it clear to others who may stumble across this.

JefferMC
  • 111
  • 4