Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a few servers that I keep getting the EventID error 5605

The root\cimv2\TerminalServices namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if the script or application does not have the appropriate authentication level. Change the authentication level to Pkt_Privacy and run the script or application again.

The issue is I have no clue where this script is being run from so I can't update the script to solve the issue like every other post I have found on Event 5605. I checked the GPO for startup scripts, I checked all of my domain's SYSVOL share for a VBScript or Powershell script. I can't find this script anywhere. How can I track down this script and fix it so it stops throwing this error?

share|improve this question

As this is WMI it often reflects a remote call. For example Lansweeper scanners trigger this error but for different namespace: root\cimv2\Security\MicrosoftTPM. You might need to monitor the network traffic coming to the affected server so that you identify the source of the WMI query if it's not anything local.

share|improve this answer
The question is three years old. Just sayin'. – Deer Hunter Jul 23 '15 at 13:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.