This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

NTCMD discovery running on two out of three probes


I have three probes installed on identaical Windows Server 2019. The probes are in different zones. "NTCMD Host Resources and Applications by shell" is only running on two out of three probes. In adittion I have a test environment where the probe is running in the same zone/subnets as the production probe not running the NTCMD discovery. The probe in the test environment runs just fine and finds information that the production environment prode does not. 

If i look at discovered Windows servers in production I can se that for two of the probes at total of six discoevry jobs have been run, while for those belonging to the filing probe only runs three of the same jobs. 

I am out of ideas of how to trigger "NTCMD Host Resources and Applications by shell" for the last prudcion probe. Do any one have any kind of idea of what might be wrong? Too many subnets? Too many CIs? Discovery running in wrong order? 


  • Hello,

    So the IPs are triggering for Host Connection by Shell on the third probe?

    Do you have results for them?

    If yes then do you have the Shell CIs in the trigger TQL for HRA job?

    Kind regards,


  • Hi!

    Thanks for showing interest in this issue. 

    The IPs are triggering for 2 of 3 probes. Also the IPs are triggering for the single test probe. 

    The test probe works in the same subnet as the production probe that is failing. So I know with certainty that discovery is possible. 

    If I look at a single target I observe the following:

    Connecting with WMI works for test and production.

    Connecting with NTCMD works for test, fails in production

    Account used in all cases to connect and authenticate to the target is the same.

    I cannot find that the CI (ip address) in question is being triggered in the production environment. I do find the windows server and the IP as CIs in both productiond and test.  I have all probes selected,and still there is nothing.


    I have done some more troubleshooting and it seems to me that the source error is in "Network Host Connection by Shell". It does not discover ntcmd and fails with:

    <log start="2022-11-28 04:16:24" severity="debug">Reporting error code 103 to framework.</log>
    <log start="2022-11-28 04:16:24" severity="debug">Error message is: NTCMD: Internal error. Details: Access is denied.

    The Access is denied is strange as long as test works, and as long as 2 of 3 probes in production succeedes using the same credentails as the failing probe. 



  • Suggested Answer


    You should test with the command line from the probe.  Here's an older knowledge doc that has some NTCMD troubleshooting information:

    -- Hope this helps!

    Keith Paschal

    UCMDB Worldwide Support Lead

  • Hi!

    Thank you for your suggestion. 

    I have tried  HPCmd.bat \\<problematic machine name or ip> /USER:<domain>\<username> /PWD:<password> on all four of my probes and they all fail with:

    Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/log4j/Logger
    at com.hp.ucmdb.discovery.library.clients.protocols.command.NTCmdDllWrapper.<clinit>(
    at com.hp.ucmdb.discovery.probe.util.HPCmdTool.main(
    Caused by: java.lang.ClassNotFoundException: org.apache.log4j.Logger
    at java.lang.ClassLoader.loadClass(
    at sun.misc.Launcher$AppClassLoader.loadClass(
    at java.lang.ClassLoader.loadClass(
    ... 2 more

    It fails even on the probe that is executing all 6, and not just 3 of 6, discovery jobs.