The Systems Management Server 2003 Advanced Client components stop functioning and do not become fully functional until the SMS Agent Host service is restarted on a Windows 2000 Server-based computer

The Systems Management Server 2003 Advanced Client components stop functioning and do not become fully functional again until the SMS Agent Host service (Ccmexec.exe) is restarted. Additionally, the Scheduler.log file may contain entries that resemble the following:Note Code 80041003 indicates that you received an "access denied" error message from Windows Management Instrumentation (WMI).

This problem occurs because of a known problem with WMI and Microsoft Windows 2000 Server.

Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk. To work around this problem, use one of the following methods:

• Upgrade the operating system of Windows 2000-based computers to a newer supported SMS 2003 client operating system, such as Windows Server 2003, Windows XP, or Windows Vista.
• Change permissions on the client computers by granting both full write permissions and partial write permissions to the "root\ccm" namespace in the Everyone group.
• Implement a solution where the Ccmexec.exe utility periodically starts. For example, implement a script that stops and restarts the service one time a day or more frequently as required.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

SMS processes establish a persistent WMI connection to a namespace by using an account that has full write permissions to the namespace. When a user who lacks full write permissions to the namespace connects to WMI, the restricted namespace permissions of the new low rights connection are also applied to the original, persistent SMS connection. Then, the persistent SMS connection loses the full write permissions to the namespace.

Additionally, when the SMS process tries to write a static instance of a class to the WMI repository, you receive the “access denied" error message because the connection no longer has full write permissions to the namespace.

The only way to regain the required permissions is to reconnect to the namespace. Although several factors can cause this problem, the two main causes are as follows:

• The SMS connection to WMI is persistent.
• A script is connecting to WMI by using a non-administrative account.