WMI information 5605 "root\MSCluster namespace is marked with the RequiresEncryption flag."

root\MSCluster namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if the script or application does not have the appropriate authentication level. Change the authentication level to Pkt_Privacy and run the script or application again.

Description

Numerous "Event 5605, WMI" messages are filling up the application log in Windows Event Viewer.

root\MSCluster namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if the script or application does not have the appropriate authentication level. Change the authentication level to Pkt_Privacy and run the script or application again.

WMI warning messages filling application log in event viewer

Resolution 1

Reducing the privilege of the root\mscluster namespace by performing the following steps:

1. Begin at Start -> Run -> wbemtest.exe on the cluster node.
2. Click on Connect and enter "root\mscluster" on the top-most tab and click Connect.
3. Click on "Open Class" button and type: "__SystemSecurity"
4. This will open up an object browser for the "__SystemSecurity" class.
5. In the object browser click on the button "Instances," there should be only a single instance such as "__SystemSecurity=@".
6. Double-click on this instance, this will open up another object browser for the instance, under the "Qualifiers" section.
7. Change "RequiresEncryption" to FALSE. Save the object and exit wbemtest.

Query information from the ClusWMI namespace without packet privacy and making the connection less secure by not requiring an encrypted connection for this namespace.

(http://support.microsoft.com/kb/2590230)

Resolution 2

open C:\Windows\system32\wbem\ClusWMI.mof for editing and set [RequiresEncryption(FALSE)]

recompile the ClusWMI.mof file by running "mofcomp C:\Windows\system32\wbem\ClusWMI.mof"

restart the winmgmt service

Note: A noted on the referenced Microsoft webpage, this workaround has not been tested and confirmed by Microsoft for any security/supportability implications!

Note: This workaround will have to be reapplied if the ClusWMI.mof file is updated via hotfix or service pack.