Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

From various documentation it appears that to change WMI access you need to use WMI to access the running service and modify specific parts of the tree.

Its kind of annoying changing 150,000 hosts using the UI.
And then having to include such changes in the process of adding new hosts.

Could write a script to do the same, but that needs to either connect to all those machines live, or be distributed for later update say in an startup/install script. And then you have to mess around with copying binary SD data from an example access control.

I've also found you can change the wbem/*.mof file to include an SDDL but I'm really vague on how that all works at the moment.

Am I just missing some point of simple administration?

share|improve this question
1  
Good question, I am also wondering on that. –  Neolisk Oct 22 '12 at 14:51
add comment

1 Answer

Made some research on this and looks like the method below should work:

For Windows 2003 with Group Policy Management Console (GPMC), perform the following steps:

  1. Navigate to Start Menu > Administrative Tools > Group Policy Management.
  2. In the left-hand pane, navigate to Forest: Domain Name -> Domains -> Domain Name, where Domain Name is the name of the domain you wish to modify.
  3. Right-click on Domain Name in the left-hand pane and select Create and Link a GPO Here.
  4. Name the new policy WMI Permissions.

NOTE: Since WMI must establish a DCOM connection to remote host, this is enough to configure access permissions for DCOM.

Configuring Distributed Component Object Model (DCOM) Permissions:

  1. Navigate to the WMI Permissions group policy, either by the Group Policy Management plug-in or by the ADUC plug-in.
  2. Ensure that the WMI Permissions policy is highlighted and click on the Edit button.
  3. Navigate to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options.
  4. In the right-hand UI pane, double-click on DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax.
  5. Put a checkmark in the box beside Define this policy setting.
  6. Click on the Edit Security button.
  7. Click on the Add button; in the resulting pop-up window, specify the domain administrator account that will be used.
  8. Click OK.
  9. In the Group or user names field, select the domain administrator you specified in step #7.
  10. In the Permissions for Administrators field, ensure that there is a checkmark in the Allow column for the Remote Access option.
  11. Click OK.
  12. Click OK.
  13. In the right-hand UI pane, double-click on DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax.
  14. Put a checkmark in the box beside Define this policy setting.
  15. Click on the Edit Security button.
  16. Click on the Add button; in the resulting pop-up window, specify the domain administrator account that will be used.
  17. Click OK.
  18. In the Group or user names field, select the domain administrator you specified in step #16.
  19. In the Permissions for Administrators field, ensure that there is a checkmark under the Allow column for both Remote Launch and Remote Activation.
  20. Click OK.
  21. Click OK.
  22. Close the Group Policy Object Editor window.
  23. Click OK and close the Active Directory Users and Computers window.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.