WMI Query Permissions

From: Bradley Plett <plettb@xxxxxxxxxxxxxxxx>
Date: Mon, 01 Oct 2007 23:49:00 -0600

I recently posted this to microsoft.public.dotnet.framework.wmi, but
it appears that group is not used much.

I'm fairly new to WMI. I am searching "root\MicrosoftIISv2" with the
following query: "select * from IIsApplicationPoolSetting". This
works like a charm from an administrator account, but I am trying to
run this with an account that does not have full privilege. Can I
adjust the WMI permissions required to run this (and, if so, how)?
Alternatively, if I need to adjust the user's privilege level, what do
I need to add?

What I find a little odd is that users without privilege can run this
without getting an exception - they just get an empty set returned. Of
course, that doesn't really matter to me - I just want to get it
working. :-)

Thanks!
Brad.
.

Follow-Ups:
- RE: WMI Query Permissions
  - From: "Jeffrey Tan[MSFT]"

Prev by Date: WBEM client access using CIM-XML, WS-Management
Next by Date: CPU temperature in C++ using WMI
Previous by thread: WBEM client access using CIM-XML, WS-Management
Next by thread: RE: WMI Query Permissions
Index(es):
- Date
- Thread

Relevant Pages

Re: Getting logged in user from a service?
... the service executes the service call, when WMI needs to "enable" a privilege, it' s up to the caller to ask the service to enable the required privilege, the user doesn't need to know the "privilege" required, WMI know which one as it's stored in it's metabase. ... All WMI's security levels are highly customizable, the namespaces are all protected by DACL's you can adjust, you can prevent certain user to access, read, write, execute etc...it's namespaces, if a user is allowed to execute a method, WMI will simply enable or add the privilege when needed on a per call basis. ... Some classes and methods need an impersonation token from the base client, if the token holds a needed privilege to execute or access a namespace class, WMI enables this privilege, when the token misses the privilege, the call fails. ...
(microsoft.public.dotnet.languages.csharp)
Re: Getting logged in user from a service?
... against the OS services (that is, by directly calling WIN32 Api's) you have to consider a lot of things at "development" time, things like - is the API available on the *target* machine? ... Most of these things are taken care of by the framework and it's underlying services, whatever these are, and in this particular case the underlying service is native WMI in top of Win32. ... I don't see how using .NET Framework exempts you from worrying about security constraints, privileges, etc. ... It might automatically enable a held privilege in your token, ...
(microsoft.public.dotnet.languages.csharp)
Re: Getting logged in user from a service?
... the service executes the service call, when WMI needs to "enable" a ... privilege, it' s up to the caller to ask the ... user doesn't need to know the "privilege" required, WMI know which one as ...
(microsoft.public.dotnet.languages.csharp)
Re: Set previlege with Windows Management
... setting EnablePrivilege to "true" should 'enable' all privileges ... required to execute a specific WMI class methods. ... Note that the principal must have been granted the required privilege (see ... PS.Please post System.Management (WMI) related questions to ...
(microsoft.public.dotnet.general)
Re: Set previlege with Windows Management
... > required to execute a specific WMI class methods. ... > PS.Please post System.Management related questions to ... >> include the RemoteShutdown privilege when connecting to WMI. ... >> control the shutdown behavior. ...
(microsoft.public.dotnet.general)