Common Scan Errors (4.x, 5.x)

Scanned computers do not necessarily have to be members of a domain, however, local administrative rights are needed for scanning everywhere. Parameters such as 'user name', 'user account', 'logon domain', 'logon server' will only be identified, if a user is logged in while scanning.

Following you will find descriptions of the most common scan errors and how they can be resolved.

ERROR 1: No WMI

Verify that the Windows Management Instrumentation service is running by 'services.msc' or search the System Log for DCOM errors. In case of Windows XP-SP2 please read our Whitepaper or disable the firewall for testing purposes.

Use 'dcomcnfg.exe'->'Component Services'->'Computers'->'My Computer'->'Properties'->'Default Properties' to check whether DCOM is enabled and access rights are properly configured (Compare settings to a machine where WMI works).

Compare settings of 'Component Services'->'Computers'->'My Computer'->'DCOM Config'->'Windows Management and Instrumentation'->'Properties'->'Security' to a machine where WMI works.

Repeat the same procedure for 'Microsoft WMI Provider Subsystem Host' if available. Stop the WMI service and delete the %systemroot%\system32\wbem\Repository directory. The folder is recreated on the next access.

Ensure that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\EnableDCOM has the Value = Y and is of type REG_SZ.

On Windows XP or later you can check via command line, whether you have WMI access to a remote PC:

        C:\> WMIC /NODE:RemotePCname /USER:domain\adminaccount /PASSWORD:adminpassword CPU

You will find some more trouble shooting information about WMI here:
http://www.microsoft.com/technet/scriptcenter/resources/wmifaq.mspx

ERROR 5: Access is denied

Invalid user name or password.

Either the scanning account is not a member of the local Administrators group or the Sharing and Security model for local accounts is not set to classic on Windows XP. The Local Security Policy 'Limit local account use of blank passwords to console login only' could be another technical reason.

ERROR 22: The device does not recognize the command

The Remote Registry Service is not running on the target PC (default setting on Vista) or there might be a problem with the access rights of the registry on the client machine.

The latter can be caused, that when scanning with LOGINquiry a local account is specified, and not a domain account (eg MYDOMAIN \ Administrator).

Try to connect the registry of the client over the network using 'Regedit.exe'. Check if you have access to the following registry key: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

If not, please notice the subsequent articles:
http://support.microsoft.com/?scid=kb;en-us;892192
http://support.microsoft.com/?scid=kb;en-us;314837

ERROR 51/53: The network path was not found

File and Printer Sharing for Microsoft Networks is not bound to the network card or the problem relates to the DNS, WINS, LMHOST or NetBIOS configuration.

ERROR 1326: Logon failure: unknown user name or bad password

Will mainly occur if the PC is not a member of a domain but of a workgroup. It is equivalent to ERROR 5 in case of Workgroup. Ensure that the domain prefixes the username: e.g. 'Domain\Administrator'

ERROR 1460: This operation returned because the timeout period expired

The maximum time between client responses or the total time for a scan was reached.

You can adjust timeouts in LOGINfo.ini; default settings are:

!SET TOTALTIMEOUT=1800
!SET INACTIVITYTIMEOUT=300
!SET SNMPCONNECTTIMEOUT=10

Sometimes an active network component detects an 'Outbreak' attack from a LOGINquiry PC by mistake. In this case please significantly reduce the number of concurrent scans in LOGINquiry options (to 1..3); if timeouts are gone please contact your network administrator.

Please also read the article about Scanning Prerequisites.