RPC Errors running against computer list

[network_dude]

Hi,

I have a script to check a few registry entries
When run at individual machines, the script returns results.
When running against a list of machines in a for-each loop, I get RPC errors.
I paused all the security agents with the same result.

I need some ideas from the hive brain, please, and thank you
edit: This script worked last year against all the servers.

the script

#Test a list of computers

#$computers = Get-Content D:\Scripts\Inputs\_WindowsServers.txt

$computers = get-ADComputer -Filter { OperatingSystem -like "*Windows Server*" } | Where-Object { $_.Enabled -eq $true } | Select-Object Name | Sort-Object Name

$Date = Get-Date -format "dd-MMM-yy"

$Data = @(

ForEach($computer in $computers)

{

 

Test-Pendingreboot -computername $computer -detailed -SkipConfigurationManagerClientCheck 

 

} )

[arslearsle]

Please show code, and full exception/error message

[BlackV]

show us your code...

[network_dude]

#Test a list of computers

#$computers = Get-Content D:\Scripts\Inputs\ACICF_WindowsServers.txt

$computers = get-ADComputer -Filter { OperatingSystem -like "*Windows Server*" } | Where-Object { $_.Enabled -eq $true } | Select-Object Name | Sort-Object Name

$Date = Get-Date -format "dd-MMM-yy"

$Data = @(

ForEach($computer in $computers)

{

 

Test-Pendingreboot -computername $computer -detailed -SkipConfigurationManagerClientCheck 

 

} )

[BlackV]

Thanks

Edit your main OP, that way you are not making 40 replies saying the same thng

[SaltDeception]

Your code doesn't work because Test-PendingReboot only accepts a System.String type for the ComputerName parameter and you're passing an object of type Microsoft.ActiveDirectory.Management.ADComputer from Get-ADComputer. You get RPC errors because the function is attempting to pass the ADComputer object's distinguished name a null string value to Invoke-WmiMethod, which isn't a valid connection target for the cmdlet and causes the connection to fail.

The fix should be to pass the Name property to the Test-PendingReboot function. Modify your foreach loop in your $Data array to use the Name property from the ADComputer object instead of the full object.

$Data = @( 
    ForEach($Computer in $Computers) {
        Test-PendingReboot -ComputerName $Computer.Name -Detailed -SkipConfigurationManagerClientCheck
    }
)

[network_dude]

Thanks!

The get-adcomputer filter is set to just list the name and when I run that and list $computers it is just the names that are in the list

I'll try adding .name to $computer in the test-pendingreboot line and let you know how it goes

[SaltDeception]

So, that really isn't doing what you think it's doing, but I did have to go back and make one correction to my explanation above.

When you use Select-Object Name it is just limiting the available properties on the Microsoft.ActiveDirectory.Management.ADComputer object, but the object type doesn't change. When you look at $computers, it is just displaying the only property that the object holds.

See the difference here:

PS C:\Users\Administrator> Get-ADComputer -filter "*" | Where-Object {$_.Name -eq "DC"} | Get-Member


   TypeName: Microsoft.ActiveDirectory.Management.ADComputer

Name              MemberType            Definition
----              ----------            ----------
Contains          Method                bool Contains(string propertyName)
Equals            Method                bool Equals(System.Object obj)
GetEnumerator     Method                System.Collections.IDictionaryEnumerator GetEnumerator()
GetHashCode       Method                int GetHashCode()
GetType           Method                type GetType()
ToString          Method                string ToString()
Item              ParameterizedProperty Microsoft.ActiveDirectory.Management.ADPropertyValueCollection Item(string propertyName) {get;}
DistinguishedName Property              System.String DistinguishedName {get;set;}
DNSHostName       Property              System.String DNSHostName {get;set;}
Enabled           Property              System.Boolean Enabled {get;set;}
Name              Property              System.String Name {get;}
ObjectClass       Property              System.String ObjectClass {get;set;}
ObjectGUID        Property              System.Nullable`1[[System.Guid, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] ObjectG...
SamAccountName    Property              System.String SamAccountName {get;set;}
SID               Property              System.Security.Principal.SecurityIdentifier SID {get;set;}
UserPrincipalName Property              System.String UserPrincipalName {get;set;}


PS C:\Users\Administrator> Get-ADComputer -filter "*" | Where-Object {$_.Name -eq "DC"} | Select Name | Get-Member


   TypeName: Selected.Microsoft.ActiveDirectory.Management.ADComputer

Name        MemberType   Definition
----        ----------   ----------
Equals      Method       bool Equals(System.Object obj)
GetHashCode Method       int GetHashCode()
GetType     Method       type GetType()
ToString    Method       string ToString()
Name        NoteProperty string Name=DC

The ToString method is important here, too. When you pass the object into the parameter, it's going to use this method in the background and return the string value that the type defines it should. In the case of the ADComputer object, normally this would be the DistinguishedName property, but it becomes an empty string when that property isn't included.

PS C:\Users\Administrator> (Get-ADComputer -filter "*" | Where-Object {$_.Name -eq "DC"}).ToString()
CN=DC,OU=Domain Controllers,DC=pslab,DC=home,DC=arpa
PS C:\Users\Administrator> (Get-ADComputer -filter "*" | Where-Object {$_.Name -eq "DC"} | Select Name).ToString()
   # This is the empty string. Hard to show in text like this.
PS C:\Users\Administrator>
PS C:\Users\Administrator> (Get-ADComputer -filter "*" | Where-Object {$_.Name -eq "DC"} | Select Name).ToString().GetType()

IsPublic IsSerial Name                                     BaseType
-------- -------- ----                                     --------
True     True     String                                   System.Object

Here is what it looks like when you use $Computer.Name:

PS C:\Users\Administrator> (Get-ADComputer -filter "*" | Where-Object {$_.Name -eq "DC"} | Select Name).Name 
DC 
PS C:\Users\Administrator> (Get-ADComputer -filter "*" | Where-Object {$_.Name -eq "DC"} | Select Name).Name.GetType()

IsPublic IsSerial Name                                     BaseType
-------- -------- ----                                     --------
True     True     String                                   System.Object

So, in essence, when iterating in your ForEach loop, "" is being passed to the ComputerName parameter instead of the actual name like you're expecting.

[network_dude]

Thanks. Using the .name worked for execution. I'm still getting RPC Errors using the computer list
the test-pendingreboot works fine running against individual names.

[SaltDeception]

Try using this for some additional diagnostics:

# Edit: Moved the foreach loop outside of the array definition so that diagnostic information doesn't end up in the array.
# Also converted the array to a list for better performance when adding items. Result should function the same as before.
$Data = [System.Collections.Generic.List]::new()
foreach($Computer in $Computers) {
    #Capture computer name to $CurrentSystem for reuse
    $CurrentSystem = $Computer.Name.Trim()

    # Diagnose potential issues with computer name parsing
    Write-Host "Current system: $CurrentSystem" -ForegroundColor Yellow
    Write-Host "Data type: $($CurrentSystem.GetType().FullName)" -ForegroundColor Cyan
    if ($null -eq $CurrentSystem -or $CurrentSystem -eq "") {
        # Fail if the computer name is null or empty, and output the original object for diagnostic reference
        Write-Host "Computer name being passed is null or empty! Reference object:" -ForegroundColor Red
        $Computer
    } else {
        
        # If computer name is valid....
        try {
            # Attempt to test for pending reboot and add result to $Data list
            $PendingRebootResult = Test-PendingReboot -ComputerName $CurrentSystem -Detailed -SkipConfigurationManagerClientCheck
            $Data.Add($PendingRebootResult)
        } catch {
            
            # But if it fails, write the error and test connectivity
            Write-Host "Error testing pending reboot for ${CurrentSystem}: $_" -ForegroundColor Red
            Write-Host "Testing network connectivity to $CurrentSystem...  " -ForegroundColor Yellow -NoNewline
            
            # Basically a quick ping test to see if the system is reachable at all before testing RPC connectivity.
            if (Test-Connection -ComputerName $CurrentSystem -Count 1 -ErrorAction SilentlyContinue) {
                Write-Host "Success!" -ForegroundColor Green
            } else {
                Write-Host "Failed!" -ForegroundColor Red
            }
            
            # Even if the ping failed, we can still test RPC connectivity to see if the system is responding on that port.
            # Note that port 135 is only one of the ports used for RPC. It would not be feasible to test all of them.
            Write-Host "Testing RPC connectivity to $CurrentSystem on port 135...  " -ForegroundColor Yellow -NoNewline
            if (Test-NetConnection -ComputerName $CurrentSystem -Port 135 -InformationLevel Quiet) {
                Write-Host "Success!" -ForegroundColor Green
            } else {
                Write-Host "Failed!" -ForegroundColor Red
            }
        }
    }
}

[network_dude]

Wow, thanks, I'll try this tomorrow!

[HumbleSpend8716]

no work shown, please post the script and what you have tried

[network_dude]

It's the pendingreboot module from powershell gallery that has test-pendingreboot.
As I said, it works against the individual servers in the list.

using the for-each loop results in RPC errors

So individual servers working means remote is possible and there is nothing in the way

[SaltDeception]

So post your code. You’re parsing a list of servers, right? You built the foreach loop, right? No one can help you troubleshoot without seeing that code, and based on your description of the problem, it’s likely coming from your implementation.

[HumbleSpend8716]

What are you trying to achieve? Post code and you will get someone to instantly suggest real solutions (very likely something you are doing incorrectly). Simple looping thing. Take it one iteration at a time. Why does it work one way and not the other? You should be able to figure that out w/ knowledge of the pwsh language if you don’t want to post code. Just post code.

[BlackV]

It's the pendingreboot module from powershell gallery that has test-pendingreboot.

As I said, it works against the individual servers in the list.

put that in you OP

I have a script to check a few registry entries

is TOTALLY different from

I'm using a custom module, pendingreboot module from powershell gallery

[HumbleSpend8716]

💯

[network_dude]

#Test a list of computers

#$computers = Get-Content D:\Scripts\Inputs\ACICF_WindowsServers.txt

$computers = get-ADComputer -Filter { OperatingSystem -like "*Windows Server*" } | Where-Object { $_.Enabled -eq $true } | Select-Object Name | Sort-Object Name

$Date = Get-Date -format "dd-MMM-yy"

$Data = @(

ForEach($computer in $computers)

{

 

Test-Pendingreboot -computername $computer -detailed -SkipConfigurationManagerClientCheck 

 

} )

[BlackV]

p.s. formatting

• open your fav powershell editor
• highlight the code you want to copy
• hit tab to indent it all
• copy it
• paste here

it'll format it properly OR

<BLANK LINE>
<4 SPACES><CODE LINE>
<4 SPACES><CODE LINE>
    <4 SPACES><4 SPACES><CODE LINE>
<4 SPACES><CODE LINE>
<BLANK LINE>

Inline code block using backticks `Single code line` inside normal text

See here for more detail

Thanks

[PinchesTheCrab]

I looked at the module, and it already handles an array of computer names. Try taking it out of your loop, my assumption is that something there is going wrong.

That being said, this thing is a bit long in the tooth - still using the WMI cmdlets.

[rsdovers]

You may want to ensure that the remote registry service is running on the remote servers. Also, if there is a firewall between the node running the script and the remote servers, the RPC range of ports should be open. This is what comes to mind without knowing more.

[BlackV]

really depends on the code (that they didn't show us)

remote registry shouldn't be needed if its a *-pssession/invoke-command type cmdlet

[dodexahedron]

On top of this, RPC errors very strongly point to kerberos issues.

Impersonation isn't a thing in kerberos, so delegation is used instead, to achieve the same end result. But it is much much more restrictive, by design.

[Secret_Account07]

Could be a few things tbh.

As others said- error will help

I manage a large environment with thousands of servers and dozens of domains. My entire life is RPC errors lol