I am doing some wmi testing, have tried powershell and wmic to get some data remotely but I return an error that RPC server unavailable.

On remote host:

• windows firewall is off
• RPC , remote registry and dcom launcher services are running and auto
• I see packets via wireshark on the remote host on port 135 (incoming and outgoing)

the examples I tried:

 $Computer =(DNS name of my remote host)
Get-WmiObject -Namespace "root\cimv2" -Class Win32_Process -Impersonation 3 -Credential (myusername) -ComputerName $Computer
Get-WmiObject : The RPC server is unavailable.
At line:1 char:1
+ Get-WmiObject -Namespace "root\cimv2" -Class Win32_Process -Impersona ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], COMException
    + FullyQualifiedErrorId : GetWMICOMException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

example using wmic:

wmic /node:(dns name of my remote host) /user:myusername /password:mypassword computersystem get username

I am doing some wmi testing, have tried powershell and wmic to get some data remotely but I return an error that RPC server unavailable.

On remote host:

• windows firewall is off
• RPC , remote registry and dcom launcher services are running and auto
• I see packets via wireshark on the remote host on port 135 (incoming and outgoing)

the examples I tried:

 $Computer =(DNS name of my remote host)
Get-WmiObject -Namespace "root\cimv2" -Class Win32_Process -Impersonation 3 -Credential (myusername) -ComputerName $Computer
Get-WmiObject : The RPC server is unavailable.
At line:1 char:1
+ Get-WmiObject -Namespace "root\cimv2" -Class Win32_Process -Impersona ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], COMException
    + FullyQualifiedErrorId : GetWMICOMException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

example using wmic:

wmic /node:(dns name of my remote host) /user:myusername /password:mypassword computersystem get username

• wmi
• rpc

• alternatively you can use remote PowerShell or get-ciminstance – js2010 Commented Feb 6 at 15:28

1 Answer 1

There network firewall in between the client and server was the one blocking the traffic.

It turned out to be traffic is not only on port 135, other dynamic ports are being negotiated, even UDP ports are used in the RPC transaction.