You cannot connect to the SMS database or expand nodes in the SMS Administrator console tree when you run SMS in Windows XP SP2

When you run the Microsoft Systems Management Server (SMS) Administrator console on a computer that is running Microsoft Windows XP Service Pack 2 (SP2), you may not be able to connect to the SMS database. Additionally, you may not be able to expand some nodes in the console tree. When you try to troubleshoot this issue by using the Wbemtest.exe utility to connect to the \Root\Sms namespace of the site server, you may receive the following error message:

In Windows XP SP2, this issue occurs because of the configuration of Windows Firewall. Windows Firewall has three settings:

• On
• On with no exceptions
• Off

When the Don't allow exceptions check box is selected, the SMS Administrator console cannot connect to any SMS site database. If Windows Firewall is turned on, and no exceptions are defined, the SMS Administrator console cannot display all the items in the console tree. This is the default setting.

To resolve this issue, follow these steps:

1. Click Start, click Control Panel, and then click Windows Firewall.
2. On the General tab, make sure that Windows Firewall is turned on, and that the Don't allow exceptions setting is not selected.
3. On the Exceptions tab, click Add Program.
4. Click the Browse button, and then open the following file:
   %WINDIR%\System32\Wbem\Unsecapp.exe
   If you have to define the scope, click Change scope, and then click OK.
5. In the Programs and Services list, click to select the Unsecapp.exe check box.
6. Click the Add Port button.
7. Type 135 in the Port number box, make sure that TCP is selected, and then type a name for the exception in the Name box.
   
   If you have to define the scope, click Change scope, and then click OK.
8. In the Programs and Services list, click to select the check box for the exception that you added in step 7.
9. Click OK.
   Note: To view status messages, you must also add a program exception for statview.exe. By default this exe is found here: installdrive\SMSAdmin\bin\i386\statview.exe Without the statview.exe exception, you will see the following error while trying to view status messages:
   SMS Could not provide the data that you requested. Please refer to the SMS documentation for troubleshooting information.

Sometimes, adding these exceptions to Windows Firewall may not resolve the issue. You may also have to set anonymous remote access rights in DCOM for the client computer. Do not make these changes unless adding Unsecapp.exe and TCP port 135 to the exceptions list does not resolve the issue.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

To set anonymous remote access rights in DCOM, follow these steps on the XP SP2 computer installed with the SMS Console:

1. Click Start, click Run, and then type dcomcnfg.exe in the Open box.
2. Locate the Console root node, expand Component Services, expand Computers, and then click My Computer.
3. Right-click My Computer, and then click Properties.
4. In My Computer Properties, click the COM Security tab.
5. In Access Permissions, click Edit Limits.
6. Click ANONYMOUS LOGON.
7. In Permissions for ANONYMOUS LOGON, click to select the Allow setting for Remote Access.
8. Click OK two times.
9. Restart your computer.

This behavior is by design.

For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base: To view a list of frequently asked questions about Microsoft Systems Management Server 2003 clients, visit the following Microsoft Web site: