Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a few servers that I keep getting the EventID error 5605

The root\cimv2\TerminalServices namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if the script or application does not have the appropriate authentication level. Change the authentication level to Pkt_Privacy and run the script or application again.

The issue is I have no clue where this script is being run from so I can't update the script to solve the issue like every other post I have found on Event 5605. I checked the GPO for startup scripts, I checked all of my domain's SYSVOL share for a VBScript or Powershell script. I can't find this script anywhere. How can I track down this script and fix it so it stops throwing this error?

share|improve this question

1 Answer 1

As this is WMI it often reflects a remote call. For example Lansweeper scanners trigger this error but for different namespace: root\cimv2\Security\MicrosoftTPM. You might need to monitor the network traffic coming to the affected server so that you identify the source of the WMI query if it's not anything local.

share|improve this answer
    
The question is three years old. Just sayin'. –  Deer Hunter Jul 23 at 13:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.