Common Scan Errors
The following article describes common scan errors and resolution to those errors.
Most issues are related to SMB or WMI traffic being blocked on the remote PC. If using Windows Defender Firewall with Advanced Security in your environment, the Predefined Inbound Rules to allow are the following:
- File and Printer Sharing
- Windows Management Instrumentation (WMI)
More information for enabling these via Group Policy can be found here: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/enable-predefined-inbound-rules
- HRESULT: 0x800706BE
- Meaning: AIT contacted the device but was unable to establish an RPC connection. This means that the device did not receive/respond to the WMI connection. Typically, this is because the connection has been blocked, usually by a local firewall on the device, or the device is offline.
- Resolution: If there is a firewall between AIT and the device to be inventoried, including a firewall on the Windows device such as the Windows Firewall, the relevant ports need to be opened within the firewall. See reference link for Configuring Windows Firewall for agent less scanning of computers
- HRESULT: 0x800706BF
- Meaning: AIT contacted the device but was unable to establish an RPC connection. This means that the device did not receive/respond to the WMI connection. Typically, this is because the connection has been blocked, usually by a local firewall on the device, or the device is offline.
- Resolution: If there is a firewall between AIT and the device to be inventoried, including a firewall on the Windows device such as the Windows Firewall, the relevant ports need to be opened within the firewall. See reference link for Configuring Windows Firewall for agent less scanning of computers
- HRESULT: 0x80010002
- Meaning: This error generally means that access to WMI was blocked, usually by a network security layer, such as a firewall, or that there was a problem with WMI.
- Resolution: To try and resolve this issue: Reboot the computer, sometimes this is sufficient. If there is a firewall between AIT and the device to be inventoried, including a firewall on the Windows device such as the Windows Firewall, the relevant ports need to be opened within the firewall.
- HRESULT: Not applicable
- Meaning: PC has been successfully queried with WMI, but when trying to use SMB for the file operations, File and Print Sharing is not enabled or is blocked.
- Resolution: If there is a firewall between AIT and the device to be inventoried, including a firewall on the Windows device such as the Windows Firewall, the relevant ports for File and Printer Sharing need to be opened within the firewall.
- HRESULT: Not applicable
- Meaning: The user credentials used to run the scan does not have permission to access 'C:\Windows\Temp' on the machine.
- Resolution: Either grant the user credential access to the device or use an alternative user account that does have permission to access the device. If User Account Control (UAC) is enabled, right-click on the AIT Desktop shortcut and select Run as administrator. If running from a USB memory stick, browse to the USB memory stick, right-click on the AIT_Local.cmd batch script or
- AITViewer.exe and select Run as administrator.
- HRESULT: 0xC0000002
- Meaning: PC has been successfully queried with WMI, but when trying to use SMB for the file operations, File and Print Sharing is not enabled or is blocked.
- Resolution: If there is a firewall between AIT and the device to be inventoried, including a firewall on the Windows device such as the Windows Firewall, the relevant ports for File and Printer Sharing need to be opened within the firewall.
- HRESULT: 0x80070005
- Meaning: The user credentials used to access the device does not have permission on the machine.
- Resolution: Either grant the user credential access to the device or use an alternative user account that does have permission to access the device.
- HRESULT: Not applicable
- Meaning: The device was not available possibly due to DNS name resolution.
- Resolution: Check that DNS name resolution is working for the PC in question.
- HRESULT: Not applicable
- Meaning: This problem can occur if WMI is corrupt on the Windows computer being scanned.
- Resolution: The following may correct the issue. On the computer being scanned that is producing the error, open an elevated command prompt and run:
WINMGMT.EXE /STANDALONEHOST
WINMGMT.EXE /RESETREPOSITORY
This will reset WMI to its initial state from when the operating was first installed.
If this does not correct the issue, from an elevated command prompt, run:
SFC /SCANNOW
This performs an integrity check of the Windows operating system files and attempts to repair any errors.
- HRESULT: 0x800706BA
- Meaning: This problem can occur if WMI is corrupt on the Windows computer being scanned.
- Resolution: The following may correct the issue. On the computer being scanned that is producing the error, open an elevated command prompt and run:
WINMGMT.EXE /STANDALONEHOST
WINMGMT.EXE /RESETREPOSITORY
This will reset WMI to its initial state from when the operating was first installed.
If this does not correct the issue, from an elevated command prompt, run:
SFC /SCANNOW
This performs an integrity check of the Windows operating system files and attempts to repair any errors.
- HRESULT: Not applicable
- Meaning: This problem can occur if WMI is corrupt on the Windows computer being scanned.
- Resolution: The following may correct the issue. On the computer being scanned that is producing the error, open an elevated command prompt and run:
WINMGMT.EXE /STANDALONEHOST
WINMGMT.EXE /RESETREPOSITORY
This will reset WMI to its initial state from when the operating was first installed.
If this does not correct the issue, from an elevated command prompt, run:
SFC /SCANNOW
This performs an integrity check of the Windows operating system files and attempts to repair any errors.