Scan questions

Access is denied

Q: How do I deal with the errors “Access is denied” or “Unknown user name or bad password”?

A: These errors can occur for several reasons:

  • The username or password is specified incorrectly.
    Check your username and password.
  • The specified user account does not have administrator rights on the remote machine.
    You need administrator access to remote computers to scan them (local administrator or domain administrator rights). If you are logged on as a domain administrator, or if the remote computers use the same username and password for their local administrator account as your current account, you can use the Current user scan option. Otherwise, specify the user name in full format: DOMAIN\Administrator.
  • Computers are not joined to the domain and have the default settings.
    Workstations running Windows and not connected to a domain don’t allow the local administrator account to authenticate remotely by default. Instead, the ForceGuest policy is used, which means that all remote connections are mapped to the Guest account. But again, administrator rights are required for running the scan. Therefore, you need to update the security policy on each computer using one of the following methods:
  • Run secpol.msc, expand Local policies / Security options, locate the Network access: Sharing and security model for local accounts policy and change its value from Guest to Classic.
  • Disable the Use simple file sharing option in File Explorer’s Folder Options.
  • Modify the registry: set the forceguest value, located in the “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa” key, to zero.

On Windows, an additional step may sometimes be required regarding User Account Control (UAC). It restricts administrator rights for remote logons in certain cases. You should either disable UAC or make the following change to the registry: create a DWORD value (name: LocalAccountTokenFilterPolicy; value: 1) in the “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system” key. A reboot may be required.

You can modify both settings easily by running a .reg file with the following contents on the affected computers:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"forceguest"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system]
"LocalAccountTokenFilterPolicy"=dword:00000001

The RPC server is unavailable

Q: How do I deal with the error “RPC server is unavailable”?

A: This error may be caused by one of the following reasons:

  • The connection is blocked by a firewall (Windows Firewall or third-party firewall).
    Try temporarily disabling the firewall on the remote computer. If the target computer runs on Windows, see the question regarding the Firewall setup.
  • The target computer is offline, or the IP address may not be in use (when scanning by IPs and if the Use network discovery option is disabled).
    The Windows Browser service updates the computer list every 12 minutes, so a computer can go offline but remain visible in the Network browser. However, in this case, you are more likely to see the Ping failed status. But if the ICMP protocol (ping, echo) is not allowed in your network, you might want to disable pinging in Options Scanner – Use network discovery. After this, you will be able to scan online hosts that don’t respond to pings, but all offline hosts (and also unoccupied IP addresses) will show the RPC error status, which can slow down the scanning of large IP groups or ranges.
  • Wrong DNS record.
    If you scan the computer by name, it could resolve to an invalid or unused IP address due to problems with DNS or WINS. If you scan the computer by IP address, you are likely to see Ping failed, but if pinging before scanning is disabled, you will receive the RPC error when scanning an offline or unoccupied address (see the previous point).
  • The target host is not a computer, or it runs an operating system other than Windows when scanning using the RPC protocol.
    If the specified name or IP address belongs to a network device that can be pinged but is not a Windows computer (Unix/Linux computer, network printer, router, managed switch, type library, IP phone, firewall, thin client, etc.), it cannot be scanned via the RPC protocol and shows this error. However, the program tries to scan this host via other protocols (SMB, SSH, and SNMP), and the scan result may vary depending on the settings for these protocols and the nature of the network host.

Port numbers

Q: How can I find out which port numbers are used by TNI, so I can configure the firewall?

A: By default, TNI uses the SMB protocol to scan Windows computers. You can allow it by enabling the File and Printer Sharing exception in the Windows Firewall or TCP port 445 in other firewalls.

TNI also uses the RPC protocol to scan Windows computers (a direct WMI connection) if SMB fails. To allow remote RPC connections, you should either disable Windows Firewall or configure it as follows:

  • Use the following netsh firewall command at the command prompt: netsh advfirewall firewall set rule group=”remote admin” new enable=Yes;
  • Use the Group Policy editor: Group Policy editor (gpedit.msc) -> Local Computer Policy -> Computer Configuration -> Administrative Templates -> Network -> Network Connections -> Windows Firewall -> Domain Profile or Standard Profile -> Windows Firewall: Allow remote administration exception -> Action -> Properties -> Enable.

Windows Firewall has a special exception entitled “Windows Management Instrumentation (WMI)”, which can be enabled and thus save you from having to configure the policies manually.

No network provider accepted the given network path

Q: How to fix the error “No network provider accepted the given network path”?

A: Take the following steps:

  1. Make sure that you can ping the remote computer using its network name;
  2. Make sure that the File and Printer Sharing exception is enabled in Windows Firewall (or that NetBIOS is allowed in another firewall), or that the firewall is disabled;
  3. Make sure that both Client for Microsoft Networks and File and Printer Sharing For Microsoft Networks are enabled in the properties of the network connection on the remote computer;
  4. Make sure that the NetBIOS over TCP/IP setting in the properties of the network connection (Internet Protocol Version 4 – Properties – Advanced – WINS) is set to Default or Enabled and that the TCP/IP NetBIOS Helper service is set to Automatic and is running;
  5. Make sure that the Network security: LAN Manager authentication level security policy (secpol.msc–Local Policies – Security Options) is set to Send LM & NTLM responses (option #1) or Send LM & NTLM responses – use NTLMv2 session security if negotiated (option #2);
  6. Run sfc /scannow.

A call was canceled by the message filter

Q: How do I fix the error “Call was canceled by the message filter”?

A: Take the following steps:

  1. Run services.msc on the remote computer and make sure that the Windows Management Instrumentation service is set to Automatic and is running;
  2. Make sure that DCOM is enabled: run dcomcnfg, select Component Services – Computers – My Computer, right-click, choose Properties, open the Default Properties tab, and make sure that Enable Distributed COM on this computer is enabled;
  3. Restart the remote computer;
  4. Run the WMI diagnosis utility from Microsoft;
  5. Follow these tips to repair WMI on the remote computer.

Domain logon scan

Q: How do I set up the program to scan computers when users log on to a domain?

A: This is a brief guide. The full version of this guide is available here.

    1. Copy the standalone scan agent tniwinagent.exe located in the program’s installation directory to a shared folder on your file server accessible to all users with read-only permissions. To do this, open the Options window, then open the Logon script page, press the Export standalone scanner button and specify the folder to export to. This will also populate the Path to agent field. It should be a UNC path (a network path starting with double backslash).
    2. Create and share a folder on your file server with write access for all users. The scan agent will save the scan results to this folder. Note: instead of creating a separate folder (most secure), you can share an empty folder inside the TNI storage (secure) or the storage root folder (least secure) with write access for all users.
    3. In Options Logon script – Save path specify the path to the folder where the agent should save the files (the folder from step 2). This should also be a UNC path. Specify other options if necessary (such as Delay before scan start and Overwrite existing files).
    4. Copy the auto-generated command using the Copy the command button.
    5. If you already have a logon script for your domain, a particular Organizational Unit, or a single user, paste the command copied earlier into this script and save it. Otherwise, refer to the full version of this guide.
    6. In the main TNI window: press Options, open the Auto-import page and specify the path to the folder with the inventory files in the Import data path field. You can import new data right now or configure automatic imports on startup or on a schedule. Whenever you want to update the information manually, open Options – Auto-import and click Import now. You can also delete files after importing or import from subfolders (if each OU has its own logon script which runs the scanner with different parameters to save results in different folders). If you choose to share a folder in the storage or the whole storage folder, you don’t need to set up Auto-import. The scan results will be automatically imported when you run the program and open the storage, or immediately, if the program is already running.

Resources to read:

Logon script scan
Standalone agent’s command-line parameters
Data import
Logon scripts FAQ
Creating logon scripts

Contents