Console access Issue

symptom

I have three SCCM groups, SCCM Administrators, SCCM Helpdesk and SCCM 2nd Level

Last week we had an issue accessing the console at all - which appeared to be a WMI corruption on the site server. This (I hope) was resolved in that I can now access it no problem

On a remote server the console is installed to allow the helpdesk to access it. AdminUI is showing these errors

[9][04/05/2012 11:52:54 am] :Transport error; failed to connect, message: 'The ConfigMgr Provider reported an error.'\r\nMicrosoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlQueryException\r\nThe ConfigMgr Provider reported an error.\r\n   at Microsoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlConnectionManager.Connect(String configMgrServerPath)
   at Microsoft.ConfigurationManagement.AdminConsole.SmsSiteConnectionNode.GetConnectionManagerInstance(String connectionManagerInstance)\r\nAccess denied
\r\nSystem.Management.ManagementException\r\nAccess denied \r\n   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
   at System.Management.ManagementScope.InitializeGuts(Object o)
   at System.Management.ManagementScope.Initialize()
   at System.Management.ManagementObjectSearcher.Initialize()
   at System.Management.ManagementObjectSearcher.Get()
   at Microsoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlConnectionManager.Connect(String configMgrServerPath)\r\nManagementException details:
[9][04/05/2012 11:52:54 am] :Microsoft.ConfigurationManagement.ManagementProvider.SmsConnectionException\r\nThe ConfigMgr console could not connect to the ConfigMgr site database. Verify that this computer has network connectivity to the SMS Provider computer and that your user account has Remote Activation permissions on both the ConfigMgr site server and SMS Provider computers. For more information, see "How to Configure DCOM Permissions for Configuration Manager Console Connections" in ConfigMgr Help.\r\n   at Microsoft.ConfigurationManagement.AdminConsole.SmsSiteConnectionNode.GetConnectionManagerInstance(String connectionManagerInstance)
   at Microsoft.ConfigurationManagement.AdminConsole.SmsSiteConnectionNode.BuildTreeWorker()\r\nThe ConfigMgr Provider reported an error.
\r\nMicrosoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlQueryException\r\nThe ConfigMgr Provider reported an error.\r\n   at Microsoft.ConfigurationManagement.ManagementProvider.WqlQueryEngine.WqlConnectionManager.Connect(String configMgrServerPath)
   at Microsoft.ConfigurationManagement.AdminConsole.SmsSiteConnectionNode.GetConnectionManagerInstance(String connectionManagerInstance)\r\nAccess denied
\r\nSystem.Management.ManagementException\r\nAccess denied \r\n   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)

This would point to dcom provider problems. Nothing has changed but I have checked the launch and activate permissions etc. and all appear ok

The strange thing is I as SCCM Administrator have no problem access the console, but these other groups i.e. 1st and 2nd level cannot. This to me indicates not a dcom issue but a permissions issue. I have completely removed and readded the rights to the 2nd level group but still getting the same error

solution

Applies To: System Center Configuration Manager 2007, System Center Configuration Manager 2007 R2, System Center Configuration Manager 2007 R3, System Center Configuration Manager 2007 SP1, System Center Configuration Manager 2007 SP2

Access to the SMS Provider is required for viewing and modifying Microsoft System Center Configuration Manager 2007 security objects and data in the Configuration Manager 2007 console. Usually, access to the SMS Provider is granted by adding users to the SMS Admins group. The SMS Admins group is explicitly granted Enable Account and Remote Enable permissions on the Root\SMS namespace. If those default permissions are modified or if a different group is created to grant access to the SMS namespace, you can verify the permissions using the WMI Control MMC snap-in.

If you have problems connecting because of Windows Management Instrumentation (WMI) permissions, you might see the following entry in the SMSAdminUI.log in <ConfigMgrInstallationPath>\AdminUI\:

Error(ConnectServer): Possible UI connection error code is -2147217405 [0x80041003]

To verify WMI permissions

1. On the SMS Provider computer, click Start, click Run, type wmimgmt.msc, and then click OK.

2. Right-click WMI Control, and then click Properties.

3. On the Security tab, expand Root, and then click SMS.

4. Click Security in the results pane to see the permissions.

5. Click Advanced, click SMS Admins, and then click View-edit.

6. If the SMS Admins group does not have Enable Account and Remote Enable permissions, grant the permissions.

7. Repeat this procedure for any groups used in addition to SMS Admins.