Via Omi New Fixed - Win32operatingsystem Result Not Found

cd /d %windir%\system32\wbem for /f %s in ('dir /b *.dll') do regsvr32 /s %s

If your original script used omi new , rewrite it to use omi enumerate or, better yet, use the CIM_OperatingSystem class (the cross-platform standard):

If this command returns the OS version, they know the network is fine and the problem lies in the specific credential settings within their monitoring software. FortiSIEM AIO - Collector questions and WMI/OMI issues

OMI requires specific permissions to access the CIM stack. If the user account used in the OMI command lacks "Remote Enable" permissions for the root/cimv2 namespace, Windows will block the request, often resulting in a generic "Not Found" or "Access Denied" error that OMI interprets as a null result. 4. WinRM Listener Configuration

To confirm it’s a setup issue and not a bug, the admin runs a manual query directly from the collector's command line using the /opt/phoenix/bin/omic -U DOMAIN/USER%PASSWORD // 'SELECT * FROM Win32_OperatingSystem' Use code with caution. Copied to clipboard win32operatingsystem result not found via omi new

To force WinRM to listen on all interfaces (useful for troubleshooting), use:

Then re‑compile the MOF files:

Symptoms: Operation times out or returns Access Denied before the result not found error.

The user account running the CIM query lacks adequate permissions. 2. Preliminary Troubleshooting Steps cd /d %windir%\system32\wbem for /f %s in ('dir /b *

If the WMI repository is corrupted, WMI queries—including those from OMI—will fail. Step 3.1: Verify WMI Health

Ensure the following ports are open on the target Windows host for OMI communication: TCP/135 (RPC Endpoint Mapper) UDP/137 (NetBIOS Name Service) TCP/5985 (HTTP) and TCP/5986 (HTTPS) for WinRM

However, if you strictly require Win32_OperatingSystem for compatibility with a legacy tool, you may need to verify that the provider you installed specifically aliases its output to that class name.

Open PowerShell on the affected Windows machine and run: The user account running the CIM query lacks

This creates a listener that binds to all network interfaces.

The error appears only on Arc-managed servers, not on standalone Windows boxes.

FortiSIEM documentation specifically notes that Distributed COM and Performance Monitor Users groups should be added to the COM security configuration.

Before diving into solutions, it is critical to understand the three components involved in this error.

If it returns access denied, proceed to the credentials check. 2. Authentication and DCOM Access Rights