The error message typically occurs in monitoring environments like FortiSIEM when an Open Management Infrastructure (OMI) client fails to retrieve data from a Windows host's Windows Management Instrumentation (WMI) repository.
Ensure the account used for the OMI query has the necessary rights:
This article dissects the anatomy of this error, explores its root causes across different versions of OMI (including the infamous Microsoft fork used in Azure ARC and System Center), and provides a step-by-step roadmap to diagnose and fix the issue.
The default WMI namespace is root/cimv2 . However, some OMI configurations may point to a different namespace (e.g., root/default or root/omi ). If the specified namespace does not contain Win32_OperatingSystem , OMI returns "not found."
: Users have found that switching from NTLM-auth to Kerberos-auth in the OMI configuration can resolve persistent connection issues.