When we try to install the agent to a system that has firewall installed we get the following error: The MOM Server failed to perform specified operation on computer computer.domain.local. Operation: Agent Install Install account: DOMAIN\Administrator Error Code: 800706BA Error Description: The RPC server is unavailable. Sometimes the error is slightly different: The MOM Server could not execute WMI Query Select * from Win32_OperatingSystem on computer computer.domain.local. Operation: Agent Install Install Account: DOMAIN\Administrator Error Code: 800706BA Error Description: The RPC server is unavailable. Searching google I have found that other people have the same issue, but nobody has posted any solution e.g.: http://cameronfuller.spaces.live.com/Blog/cns!A231E4EB0417CB76!928.entry We have allowed SCE to create a group policy to open the necessary ports on the firewall, and I have also tried adding the port exceptions to the policy that applies to all of our computers. What is interesting is that if I move a computer into a different OU the install does work, which is surprising because the same firewall ports are opened no matter which OU the computer is in! I have verified that the ports are open using rsop.msc and by connecting to said ports using telnet or netcat. It doesnt make sense at all, for example: Computer in: domain.local\IT Department\Virtual Machines , the following group policys are applied: Default Domain, System centre Essentials All Computers Policy , and the agent install works. Computer In: domain.local\Test1\test2, the same group policys are applied (Default Domain, System centre Essentials All Computers Policy), agent install fails. If we stop the firewall service on a computer we can deploy the agent, but Deployment and Inventory fails shows failed status, and we get a alert that a Script or Executable Failed to run: The process started at 12:09:36 AM failed to create System.Discovery.Data, no errors detected in the output. The process exited with 0 Command executed: "C:\WINDOWS\system32\cscript.exe" /nologo "RedirectWSUS.vbs" 0 {26D3CA4A-0EBA-57EB-2A74-589DAAFA8334} {FF99FB9A-E8A8-8162-9AF4-DFB221097EC9} computer.domain.local Working Directory: C:\Program Files\System Center Operations Manager 2007\Health Service State\Monitoring Host Temporary Files 1\493\ One or more workflows were affected by this. Workflow name: Microsoft.SystemCenter.Essentials.WSUSRedirectDiscovery Instance name: computer.domain.local Instance ID: {FF99FB9A-E8A8-8162-9AF4-DFB221097EC9} Management group: VM2K3-SCE I had to get KB 937831 to install SCE as we have disjointed namespace, e.g. DOMAIN1 = domainone.local Thanks Andy

Andy, it sounds like you're experiencing problems situationally with the application group policy to this computer. In the failure scenario described above, have you run a resultant set of policy (RSoP or gpresult CLI utility) to see if the SCE GPOs are being applied? I think if you can work out the issues with application of group policy, the rest will take care of itself.Do make sure the computer also makes it into "SCE Managed Computers" group, as I have seen that fail on occasion.

Hi Andy, According to your description, the agent installation failure is most likely caused by firewall configuration, I would like to share some suggestion as follows: 1. Please make sure the port TCP 5732 on the SCE Server computer and the port TCP 139, TCP 445, UDP 137, UDP 138 on the client computer has been opened. 2. Please ensure the client is a member of "SCE Managed Computers" group in AD users. 3. please make sure two GPO which are created during installation set to enforce. 4. About alert description, please refer to the post (question 6) with RedirectWSUS.vbs. http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=1797488&SiteID=17 If the issue still exists, you can runSCECertPolicyConfigUtil.exe /ManagementGroup <servername>_MG /uninstall command to uninstall product features and then try to re-install to see If the agent can be pushed. More information: If you are using ISA for firewall, please refer to the following steps: On the ISA firewall settings, check that if the RPC filter is enabled. If yes, then disable the same. Also please verify that Enable RSS, Enable TCP and Enable TCP Chimney were set to 0 in registry. Reboot the ISA machine and install the client once again. It will install without this error now. Based on my experience, if you are using other firewall, there should be similar settings. Hope it helps.

I'm trying to deploy the agent as well, without luck. Windows Firewalls are disabled, both client and SCE server. I've tried reinstalling the product feature as stated above, but no luck with that either. Any ideas on what to try next?

Hi Rory, For your issue, please try installing agent manually by following steps to see if it works: 1. Copy the MOMagent.msi file from the SCE server. Usually, the MOMagent.msi file can be found under the "C:\Program Files\System Center Essentials 2007\AgentManagement\x86"; 2. Run the following command line to manually install the agent on your client machine: "MOMAgent.msi /L*V c:\momagent.log"; 3. Follow the installation wizard and input the proper SCE Server, Management Group Name, and the Agent Action Account; 4. If the installation failed, please check if any error in the momagent.log. By the way, as the new report issue you mentioned is different from the one discussed in this current thread.We'd recommend that you start up a new thread for it. We generally focus on one topic in one thread because in this way it will be better for other community members to participate in the discussion, and to search/find specific answers more efficiently in the future. --------------------- Regards, Jie-Feng Ren Microsoft Online Community Support

I am absolutely sure that the correct ports are open on the firewall, I have checked using RSoP and gpresult, and by checking the firewall control panel applet.I've been doing a lot of testing on this in the past week or so, I have found that by disabling the firewall service I can install the agent, I enable it again as soon as the agent install task reports Success, and the agent works ok.

Hallo SCE-Developers, would you mind posting "usefull" instructions what steps to follow to get the agent installed and working on ISA Server 2006 Standard Edition. All I could read untill now is of no help (could not find any of your mentioned settings on my machine!!!). Could it be that noone tested this or cared aboutbefore releasing SCE?

I get the same "RPC Server" error and this is because of not opening ports on the Windows Firewall.When I try to add ports 139, 445, 137 and 138 it tells me that these ports are already being usedThe "File and Print Sharing" is currently using these 4 ports.If I turn off "File and Print Sharing" I am still unable to add these ports. The exact error message is as follows:"The port 'TCP 139 (PORT139)' cannot be added. An entry for the same port 'TCP 139(NetBIOS Session Service)' already exists."any ideas? and thanks in advance!----------Also, if I quote Jie-Feng Ren above, it states that on the server the port 5732 must be enabled.The documentation that I have says nothing about port 5732 but does for port 5723.can anyone confirm this?

Hi Kanaloa, I am sorry for the typo. The port opened on the SCE server is 5723 but not 5732. Also, the ports of TCP 139, TCP 445, UDP 137, UDP 138 do not need to be added if the File and Printers Sharing is checked in the Windows Firewall. Regarding your issue, I want to confirm whether you select Domain Policy or Local policy in the Feature Configuration wizard? If yes, the ports needed will be opened through GPO. If you select local policy, please perform following steps: 1. Open the Control Panel and select Windows Firewall. 2. Select the Exceptions tab. 3. Select the File and Printers Sharing check box and click on Edit. 4. Enable all four ports (TCP 139, TCP 445, UDP 137, UDP 138). 5. Add port TCP 135 in the Firewall port exception. After that, run services.msc command and restart RPC service and Remote Registry service to see if it works. There are threads with similar topic: http://forums.microsoft.com/TechNet/ShowPost.aspx?postid=2005132&siteid=17 http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=1672295&SiteID=17 By the way, if the problem still exists, we'd recommend that you start up a new thread with the detailed information (include error prompt) for it. We generally focus on one topic in one thread because in this way it will be better for other community members to participate in the discussion, and to search/find specific answers more efficiently in the future. Hope It helps. --------------------- Regards, Jie-Feng Ren Microsoft Online Community Support

Check out http://mikepoulson.com/archive/2007/09/26/system-center-agent-fails-to-install.aspx It describes that you need to enable the "Allow inbound remote administration exception" in addition to the "allow inbound file and printer sharing exception" Hope this helps Mike Poulson

Hi, Thanks for your reply and bring your experience to us, which can help the communityfor this forum in the future. --------------------- Regards, Jie-Feng Ren Microsoft Online Community Support

There is one other caveat here. I had the same problem, and it took several escalations and about 6 weeks for MS to sort! If you define your firewall exceptions using group policy (via Computer Configuration | Administrative Templates | Network | Network Connections | Domain Profile, and you have defined a local program exception, then you must also enable allow local program exceptions I'm not sure of the exact mechanics here, but if you don't it appears that the mominstaller agent is blocked while trying to complete the installation. If you remove any local program exceptions and have allow local program exceptions not configured that will also work. This has gone to the SCE development team for further investigation. Cheers Ian

A further option that has also been tested, if you do have a program exception, but wish to still prevent allow local program exceptions, then you can add a further remote program exception to your group policy as follows:- %SystemRoot%\422C3AB1-32E0-4411-BF66-A84FEEFCC8E2\MOMAgentInstaller.exe:SCE server IP address:enabled:MOMAgentInstaller This will also allow the agent to install correctly. I believe there is going to be some documentation update or similar to advise on this. Cheers Ian

I had this same problem and resolved by Turning "On" File and Print Sharing for Microsoft Networks under the Local Area connection properties Window. Once I turned that back on things worked like a charm.

Where did you do this at? On the group policy machine, on the SCE machine? Can you elaborate on your steps?I too am receiving this same error. I have in GPO "Windows Firewall: Protect all network connections" set to disabled under Domain Profile.

Hi, *I have two systems up and running. DCSRV003 (Domain controller) and DCSRV004 (SCE and WSUS) I'm trying to install SCE Agent to DCSRV003 but i get still this error: Firewall settings are oké, also i tried to turn it off.. without results. The Operations Manager Server could not execute WMI Query "(null)" on computer DCSVR003.dcproject.local. Operation: Agent Install Install account: DCPROJECT\Administrator Error Code: 800706BA Error Description: The RPC server is unavailable. | Second problem, the local machine is not sharing his information. Name Alert Status Update Status Agent Status Hard Disks Operating System Description Model dcsvr004.dcproject.local Error Unknown Warning 0 - OK Unknown Unknown Sorry for my bad english, hope you will understand me ;)

Jan, for the error > The Operations Manager Server could not execute WMI Query "(null)" on > computer DCSVR003.dcproject.local. Operation: Agent Install Install > account: DCPROJECT\Administrator Error Code: 800706BA Error > Description: The RPC server is unavailable. | that is usually a firewall issue. please disable the firewall and try to install it again. you can also use this article as a reference http://blogs.technet.com/b/kevinholman/archive/2009/01/27/console-based-agent-deployment-troubleshooting-table.aspx Thanks Jose

Jose, Thanks for your reply. I have tried to disable the firewalls on both servers but i can't install SCE Agent. What can i do now? I use domain administrator account.. he will find the DCSVR003. WMI Services are oké and running. What can i check or change more? Thanks for all your reply's Greatz Jan

Hi, I have the same problem and tried manual installation of agents and still didn't work

I have the same issue, which I have resolved by enable the "Windows Management Instrumentation(WMI)" in the firewall settings.