The remote.exe command does not generate a connection to a Windows XP SP2-based client when this command is used together with the /SMS:NoSQL switch in SMS 2003 (920706)
The information in this article applies to:
- Microsoft Systems Management Server 2003
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base: 256986 Description of the Microsoft Windows registry SYMPTOMSYou try to connect to a Microsoft Windows XP Service Pack 2 (SP2)-based client computer by using the following Microsoft Systems Management (SMS) 2003 Remote Tools command: However, you receive the following error message: Remote Tools: Security rights to run Remote Tools on this client have
been denied. Note You can connect if you use this command without the /SMS:NoSQL switch. CAUSEWhen you use the remote.exe command together with the /SMS:NoSQL switch, the system tries to connect to the IPC$ share of the
client computer by using a NULL session. The remote.exe process then tries to connect to the server service
by using a named pipe to issue the NetServerGetInfo API call. The advanced security
features for Windows XP SP2 do not let you connect to the server service named pipe
from a NULL session.
WORKAROUNDTo work around this issue, use one of the following methods. Method 1If you know the site code or the database server name, use
the remote.exe command without the /SMS:NoSQL switch.
You will then be prompted to manually enter the site code or the database server name. Method 2 If you must use the /SMS:NoSQL switch, create an authenticated session to the
client computer before you run the remote.exe command. To create an authenticated session, type net use \\client computer name\IPC$ at a command prompt, and then press ENTER. This generates a connection to
the client computer by using the logged-on user's credentials. Note Alternatively, another set of credentials can be passed in the command
line. The remote.exe process will use the authenticated session to connect to the named
pipe. Note You can also map a drive to a network share before you start the remote.exe process. Or, you can locate a shared
resource on the client computer before you start the remote.exe process. These approaches will have the same outcome as
mapping to the IPC$ share on the client.
Method 3Important These steps may increase your security risk. These steps may also make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. We recommend the process that this article describes to enable programs to operate as they are designed to, or to implement specific program capabilities. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this process in your particular environment. If you choose to implement this process, take any appropriate additional steps to help protect your system. We recommend that you use this process only if you really require this process. Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk. You can enable named pipes to the server service
through null sessions by using one of the following methods. Note You do not have to restart the client computer to apply these changes. However, these changes will be applied as long as the registry change or the local security policy is
applied. - Edit the registry of the client computer. To do this follow these steps:
- On the client computer, open Registry Editor, and then expand the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver - Click parameters, and then double-click NullSessionPipes.
- In the Edit Multi-String dialog box, add SrvSvc to the list by typing SrvSvc on a new line.
- Click OK, and then close Registry Editor.
- Modify the local security policy. To do this, follow these steps:
- On the client computer, click Start, click Run, type secpol.msc in the Open box, and then click OK.
- In the Local Security Settings window, expand Local Policies, and then click Security Options.
- In the results pane, double-click Network Access: Shares that can be
accessed anonymously.
- In the Local Policies Settings dialog box, add SrvSvc to the list by typing SrvSvc on a new line.
- Click OK, and then close the Local Security Settings window.
- Click Start, click Run, type gpupdate.exe in the Open box, and then click OK.
Note When you remove the SrvSvc entry from the policy, this does not remove the registry entry after the registry entry has been added.
. STATUSMicrosoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Modification Type: | Major | Last Reviewed: | 6/30/2006 |
---|
Keywords: | kbtshoot kbfix kbBug kbSMSRemote Tools kbprb KB920706 kbAudITPRO |
---|
|