Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. SNMP Extension Fails on Windows 8/Server 2012 when attempting network communication

SNMP Extension Fails on Windows 8/Server 2012 when attempting network communication

View products that this article applies to.

Symptoms

Any SNMP Extension agent that attempts to perform any UDP or TCP network communication on Windows Server 2012 or Windows 8 will fail. The socket connect() request will fail with the following NT status code: 

0xC0000022 = STATUS_ACCESS_DENIED
{Access Denied}
A process has requested access to an object, but has not been granted those access rights.

↑ Back to the top

Cause

Windows 8/Server 2012 implements "Windows Service Hardening" (WSH) rules on the SNMP.EXE process that prevent all network communication except: UDP Out over Remote Port 161, or UDP In over Local Port 161. If a partner SNMP Extension DLL tries to perform UDP or TCP communication, even to the loopback address, the communication will be rejected by the WSH rule.

↑ Back to the top

Resolution

The partner must implement their own Windows Service Hardening (WSH) rules to allow their SNMP extension to perform the UDP or TCP communication it requires -- even for loopback communication. For example, if the SNMP extension performs TCP traffic over local port 3333, the following rules must be added:

1. An outbound rule for TCP remote port 3333
2. An inbound rule for TCP local port 3333

This is accomplished by running a program in privileged mode that adds these two rules using the INetFwRule interface (API) by setting the properties using the put_ methods, and then by calling "hr = pFwRules->Add(pFwRule); " .

The loopback address should not be specified in put_localaddresses or put_remoteaddresses -- this is not recommended or supported. Instead, to block incoming TCP connectivity to local port 3333, configure a rule using Windows Firewall with Advanced Security, netsh or the Firewall Control Panel to block incoming connection requests. Unlike WSH, rules created using these tools have no effect on loopback communication.

↑ Back to the top

More Information


The INetFwRule interface documentation can be found in MSDN: http://msdn.microsoft.com/en-us/library/windows/desktop/aa365344(v=vs.85).aspx


↑ Back to the top

Keywords: kb

↑ Back to the top

Article Info
Article ID : 2771908
Revision : 1
Created on : 1/7/2017
Published on : 10/22/2012
Exists online : False
Views : 669