dns-zoneinfo.ps1" Get-WmiObject : Generic failure Error on Universal Forwader with DNS and DC TA's

[rbal_splunk]

Issue : On the Domain Controller, customer have the Universal Forwarder with the TA installed for the DNS and DC. The Splinkd.log file has errors like below

02-27-2014 16:59:26.225 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1" Get-WmiObject : Generic failure
02-27-2014 16:59:26.225 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1" At C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\powe
02-27-2014 16:59:26.225 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1" rshell\dns-zoneinfo.ps1:60 char:22
02-27-2014 16:59:26.225 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1" + $RR = Get-WmiObject <<<< -namespace "root\MicrosoftDNS" -class Microsof
02-27-2014 16:59:26.225 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1" tDNS_ResourceRecord -ComputerName $env:ComputerName -Filter "DomainName = '$Zon
02-27-2014 16:59:26.225 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1" eName'"
02-27-2014 16:59:26.225 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1" + CategoryInfo : InvalidOperation: (:) [Get-WmiObject], Managemen
02-27-2014 16:59:26.225 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1" tException
02-27-2014 16:59:26.225 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1" + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.C
02-27-2014 16:59:26.225 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1" ommands.GetWmiObjectCommand
02-27-2014 16:59:26.225 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-DNSServer-NT6\bin\runpowershell.cmd" dns-zoneinfo.ps1

[rbal_splunk]

Resolution: The problem is likely to be permissions, and the issue resolved after we restarted the splunk service as local SYSTEM user. After switching the SplunkForwarder service to run as the local system account, this error went away and DNS data started to flow into the AD and Windows Infrastructure Apps.