How to remediate – WMI Not Available

1. Introduction

The vulnerability “WMI Not Available” means that Windows Management Instrumentation queries cannot connect to the remote host using DCOM. This prevents security tools like Nessus from gathering detailed information about a system, potentially missing installed software and vulnerabilities. Affected systems are typically Windows servers or workstations where WMI is disabled or blocked by firewalls. A successful impact could be reduced visibility of threats on the network.

2. Technical Explanation

WMI Not Available occurs when Distributed Component Object Model (DCOM) communication to access WMI is unavailable. This can happen due to firewall rules, incorrect WMI configuration, or service issues. An attacker cannot directly exploit this as a vulnerability but it hinders security assessments and could mask malicious activity. There is no specific CVE associated with simply being unable to query WMI; it’s an impediment to discovery. For example, if Nessus can’t access WMI, it won’t identify outdated software versions that are known to be vulnerable.

• Root cause: DCOM communication is blocked or the WMI service is not running/responding on the remote host.
• Exploit mechanism: An attacker would first attempt to discover systems using network scanning tools. If WMI queries fail, they may proceed with other methods of enumeration and exploitation, potentially exploiting known vulnerabilities that could have been identified via WMI if it were accessible.
• Scope: Windows operating systems (all versions) are affected when WMI is unavailable over DCOM.

3. Detection and Assessment

Confirming whether a system is vulnerable involves checking WMI accessibility. A quick check can be done via command line; a thorough method requires using a security scanner.

• Quick checks: Use the `wmic` command in Command Prompt to attempt a simple query. If it fails, WMI access may be unavailable.
• Scanning: Nessus reports “WMI Not Available” as an information-level finding. Other scanners like Rapid7 InsightVM or Qualys VMDR will also flag this if they cannot connect via WMI.
• Logs and evidence: Check the Windows Event Logs for errors related to DCOM or WMI, specifically under Application and System logs. Look for event IDs 2683 (DCOM server could not start) or similar WMI-related errors.

wmic os get caption

4. Solution / Remediation Steps

Fixing this issue involves ensuring the WMI service is running and DCOM communication is allowed through firewalls. These steps should be performed carefully to avoid disrupting other services.

4.1 Preparation

• Dependencies: Ensure no critical applications are dependent on WMI functionality. Roll back plan: Restore from backup or system restore point if issues occur.
• Change window needs: A standard change window may be required, depending on the environment and criticality of the systems involved. Approval from a senior IT administrator is recommended.

4.2 Implementation

1. Step 1: Verify the WMI service is running. Open Services (services.msc) and ensure “Windows Management Instrumentation” has a status of “Running”. If not, start the service.
2. Step 2: Check DCOM settings. Run `dcomcnfg` to open Component Services. Expand Computer -> My Computer -> DCOM Config. Locate “Windows Management Instrumentation”. Right-click and select Properties.
3. Step 3: On the Security tab, ensure appropriate permissions are granted for users or groups needing access. Ensure ‘Launch and Activation Permissions’ allows access.
4. Step 4: Verify firewall rules allow inbound DCOM traffic on ports 135 and dynamic RPC ports (typically above 49152). Create new rules if necessary.

4.3 Config or Code Example

Before

(WMI service status: Stopped)

After

(WMI service status: Running)

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability type include least privilege and secure defaults. Least privilege limits the impact if WMI is compromised, while secure defaults ensure WMI is configured safely from the start.

• Practice 1: Implement least privilege principles by granting only necessary permissions to access WMI.
• Practice 2: Regularly review WMI configuration and security settings to maintain a secure baseline.

4.5 Automation (Optional)

A PowerShell script can be used to check the WMI service status and start it if stopped. Use caution when automating changes, especially related to services.

# Check WMI Service Status
$WmiService = Get-Service -Name "Winmgmt"
if ($WmiService.Status -ne "Running") {
  # Start the WMI Service
  Start-Service -Name "Winmgmt" -Force
  Write-Host "WMI service started."
} else {
  Write-Host "WMI service is already running."
}

5. Verification / Validation

Confirming the fix involves re-running the initial WMI query and verifying it succeeds. A smoke test should also be performed to ensure core functionality remains operational.

• Post-fix check: Run `wmic os get caption` in Command Prompt. Expected output: System information will be displayed, confirming successful WMI access.
• Re-test: Re-run the Nessus scan and verify that “WMI Not Available” is no longer reported as an issue.
• Smoke test: Verify basic system functionality such as network connectivity and application launch to ensure WMI changes haven’t caused unintended side effects.

wmic os get caption

6. Preventive Measures and Monitoring

Preventive measures include updating security baselines and incorporating checks into CI/CD pipelines. For example, regularly update a CIS control or GPO setting to ensure WMI is configured securely.

• Baselines: Update your Windows security baseline to enforce secure WMI configuration settings.
• Pipelines: Add automated checks in your CI/CD pipeline to verify the WMI service status and basic connectivity during deployment.
• Asset and patch process: Implement a regular review cycle for system configurations, including WMI settings, to identify and address potential vulnerabilities proactively.

7. Risks, Side Effects, and Roll Back

Potential risks include disruption of applications dependent on WMI or unexpected service behavior. Roll back involves restoring the system from backup.

8. References and Resources

• Vendor advisory or bulletin: https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-