1

I am trying to write C# code to access a computer (XP sp2) remotely to find out if a process is running. I don't know much about performance counters other than what I've been reading in the past couple of days, but here is my problem:

For troubleshooting, when I use psList (pslist \\target -u user -p pass) to access the target computer, I get this error:

Cannot connect to remote registry on <computer>
Access is denied.
Failed to take process snapshot on <computer>
Make sure that Remote Registy service is running on the remote system, that you have firewall ports allow RPC access, and your account has read access the following key on the remote system: HKLM\Software\Microsoft\Windows NT\CurrentVersion\perflib

When I use psList as administrator I get the same error except it says The network path was not found rather than Access is denied. I get this whether I "Run as administrator" in my normal account or if I actually sign into my administrator account and run the command from there.

Remote registry is running on the target computer.

When I use sc query (sc \\target query) as administrator I get this error:

[SC] OpenSCManager FAILED 5:
 Access is Denied

When this part of my C# code runs, Process[] targetProcess = Process.GetProcessesByName(string process, string ip); (I use an ip address here as my string, not a computer name), I get this wordy error:

System.InvalidOperationException: Couldn't connect to remote machine. ---> System.InvalidOperationException: Couldn't get process information from performance counter. ---> System.ComponentModel.Win32Exception: The network path was not found at System.Diagnostics.PerformanceMonitor.Init() at System.Diagnostics.PerformanceCounterLib.GetPerformanceData(String item) at System.Diagnostics.NtProcessManager.GetProcessInfos(PerformanceCounterLib library) --- End of inner exception stack trace ---

at System.Diagnostics.NtProcessManager.GetProcessInfos(PerformanceCounterLib library) at System.Diagnostics.NtProcessManager.GetProcessInfos(String machineName, Boolean isRemoteMachine) --- End of inner exception stack trace ---

at System.Diagnostics.NtProcessManager.GetProcessInfos(String machineName, Boolean isRemoteMachine) at System.Diagnostics.ProcessManager.GetProcessInfos(String machineName) at System.Diagnostics.Process.GetProcesses(String machineName) at System.Diagnostics.Process.GetProcessesByName(String processName, String machineName) at (methodname) in c:(pathname):line 132

  • File and printer sharing are on
  • Admin$ share is enabled
  • A network monitoring service used by my company (which I can't rely on because of wi-fi issues, thus I'm writing code) is able to access the processes on the target computer and tell me if they are running or not. So I know they are accessible.
  • I've done some reading on FAILED 5 to no result
  • I've gone through this from Microsoft (about troubleshooting registry keys that work with remote access)
  • I've gone through this from Microsoft as well. (similar to above)
  • I read most of this from Microsoft about working with performance counters
  • I've looked at things in Perfmon and they seem to be doing well (there are items in the drop-down list that every troubleshooter directs you to, rather than numbers or a blank)
  • I've looked through a few other questions and ideas that I've lost track of

From my limited knowledge, it seems that the performance counters are working fine, but I am still getting these errors suggesting that they are the problem. Why am I getting these errors?

  • You haven't mentioned if the account that is running these commands is a local administrator on that system? What is the value and type of "ip" in the C# code? It's supposed to be a string; is it? What is the value of that string at that point? It should either be just a (DNS-resolvable) name or IP address; no "\\" at the beginning. For PSList, you haven't mentioned whether you checked what it says: is the Remote Registry service running on the target machine? And in that context, the "\\" is needed before the computer name. And "sc \\computername query" needs that "\\" as well. – DarkMoon Mar 31 '16 at 5:03
  • You're mainly concerned with the C# code, right? How is the C# code running? Part of a web page, or a scheduked task, or is someone running it? Does the account that's running it (IIS worker process, service account, your account) have admin righs on the machine specified by "ip"? Any chance you can put NMap on the source, and run it against the target to see if it can see the appropriate port on the target? – DarkMoon Apr 1 '16 at 11:08
  • Ya, I'm mostly worried about the C# code, but I'm interested in the batch code. It is a Console application running from my desktop. According to the registry keys (right click>Permissions...) I do have admin rights and permissions (see my answer though, apparently there's more to permissions than I understand currently). – Alamb Apr 1 '16 at 20:34
0

Considering how easy this answer ended up being, I feel a bit dumb about it. I've been struggling with this and similar problems to it for weeks. A co-worker found out and happened to already have the answer in both batch and C#.

It turns out it was a permissions problem and not about performance counters. Which answered most of my question. This command solved the sc query problem:

NET USE \\target\IPC$ /u:user pass

I was unaware of the IPC$ share. After plugging that in I could freely use sc query, query process, and other remote commands on the target. Interestingly though I still could not use psList. I didn't need it though so didn't look into it.

The C# code was long - I'll put it on here when I have the code on me. Basically, all it did was create a Process object and plugged in that piece of command line code above. After that I could run the rest of my C# code to get the running processes from the target.

|improve this answer|||||
  • 1
    You could probably do it with just \\target (no \IPC$); I use that net use command all the time for systems admin, and it alwaaye turns up in the list of connections as \\target\IPC$. Glad you got it working. – DarkMoon Apr 1 '16 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.