Ex2007 EVS on Windows 2008

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Hi.

I have a C++ application that uses WMI to gather information from other
servers. When connecting to an Exchange 2007 EVS running on a Windows 2008
cluster, I am able to connect to the WMI namespace "root\MSCluster" of a
node, but when I try to enumerate the MSCluster_Cluster instances, I get
ACCESS_DENIED. This appears to be because the authentication level in the
proxy security blanket for the IWbemServices interface is not set to
PKT_PRIVACY.

The "Security Blanket Negotiation" story is that "When a proxy is
created...COM chooses the higher of the authentication levels specified by
the client and the server."
If this is true, then the server is specifying an authentication level of
PKT, but when I call IWbemServices::CreateInstanceEnum to enumerate the
MSCluster_Cluster instances, it somehow expects an authentication level of
PKT_PRIVACY.

Calling CoQueryProxyBlanket immediately after connecting, shows that the
negotiated value for AUTHN level is in fact PKT:
"CoQueryProxyBlanket() returned Authorization Service: GSS_NEGOTIATE,
Authentication Service: NONE, Server Principal Name:
host/<servername>.<domain>.com, Authorization Level: PKT, Impersonation
Level: IMPERSONATE, Capabilities: MUTUAL_AUTH"

So, am I missing something? How do I go about ensuring that I have the
correct AUTHN level if the server doesn't ask for it?

Thanks,

-Nick
.

Relevant Pages

  • Re: The Security System could not establish a secured connection with the server cifs/namedserver.
    ... authentication level" issues along with anonoymous "no access without ... causes a lot of grief in mixed client settings. ... > This is best adjusted on the XP client by changing the policy governing ... Reboot server and try again. ...
    (microsoft.public.windowsxp.security_admin)
  • RE: SQL Server and LAN Manager Authentication Level
    ... > Did you also change the Authentication level at the ... It's a stand alone server ... ... application is using SQL Server authentication .. ... Our internal domain it's a Windows NT ...
    (microsoft.public.sqlserver.security)
  • Re: WBEM/WMI/DCOM errors with ADMINUI and Sitecomm
    ... I did the same steps and rebooted the server and was able to make the remote ... > To do so, click the Default properties tab, and then confirm the following ... The Default Authentication level is set Connect. ... >> refusing my connection. ...
    (microsoft.public.sms.admin)
  • Re: Forms authentication - change password
    ... Contact the server administrator. ... I think your authentication validation method needs to be set to ... the change password feature within ISA ... | | meant not connecting to a Global Catalog. ...
    (microsoft.public.isa)
  • Re: SBS Slow user logons problem
    ... Microsoft MVPs ... Are the workstations and Server all connecting their nics to a router? ...
    (microsoft.public.windows.server.sbs)