Windows Authentication issue

InsightVM
1

Recently seeing authentication failing on windows hosts. I know we should use scan assistant but not allowed to install any software on golden image (monthly master image) so we are using admin level user account.

I have uploaded here screenshots from scan logs and I did check the server and remote registry service is running as well as the user account is part of admin group still the authentication is failing. Also both the ports (135/445) are reachable from scan engine.

If you look at the screenshots that I have uploaded here, port 445 shows successful authentication (even in test credential page in administration) but after the scan is completed, authentication shows failure and on port 135, it says invalid credentials while testing the creds on administration page. Even changed the value to 1 for the LocalAccountTokenFilterPolicy registry key and still not working.

port 445_3
port 445_2
port 445_1
port 135

Any help would be appreciated on fixing this issue.

2

Hello,
Were you able to resolve these issues ? My test Credentials works only for port 445. It fails for port 135 and 139. I am seeing the same kinda log entries when I try a scan with credentials.

3

Hello,

Yes, I did resolve by making sure that the services such as Microsoft Remote Procedure Call (RPC), Windows Management Instrumentation (WMI ) and remote registry service are running and not getting stopped again.

This issue I had observed was the Remote registry service or WMI service was getting stopped or timed out automatically on the server due to which the authentication was failing for port 135/139, so once you ensure that these two services are running all the time, you wont see the issue on port 135 and 139.

Let me know if that helps you.