views:

18

answers:

0

I'm creating a watch dog service that will be monitoring other services on various remote servers (all in the same domain). The user that I'm using to connect to the remote servers is not an admin. When I try to enumerate the services in the Win32_Service class, I get an access denied error.

I've given the user 'Remote Enable' & 'Enable Account' persmissions to the Root\CIMV2 namespace in the WMI Control.

I am able to connect to the server with the following code. The object ServiceListItem is just a simple class that contains the server name and the service name:

SecureString secureString = new SecureString();

foreach ( char c in "password" )
{
    secureString.AppendChar( c );
}

ConnectionOptions connectionOptions = new ConnectionOptions();

connectionOptions.Username = "domain\\user";
connectionOptions.SecurePassword = secureString;

foreach ( ServiceListItem service in _serviceList )
{
     ManagementScope managementScope = new ManagementScope();
     managementScope = new ManagementScope( String.Format( @"\\{0}\root\cimv2", service.ServerName ), connectionOptions );
     managementScope.Connect();

     //RelatedObjectQuery relatedObjectQuery = new RelatedObjectQuery( String.Format( "Win32_Service.Name='{0}'", service.ServiceName ) );
     //ManagementObjectSearcher objectSearcher = new ManagementObjectSearcher( managementScope, relatedObjectQuery );

     ObjectQuery objectQuery = new ObjectQuery( "SELECT * FROM Win32_Service WHERE Name = '" + service.ServiceName + "'" );
     ManagementObjectSearcher objectSearcher = new ManagementObjectSearcher( managementScope, objectQuery );

     ManagementObjectCollection objectCollection = objectSearcher.Get();

     foreach ( ManagementObject managementObject in objectCollection )
     {
          serviceStatus = managementObject.Properties["State"].Value.ToString();
          Debug.Print(service.ServiceName + " - " + serviceStatus);
          //break;
     }
}

The managementScope.Connect() runs fine, which means the wmi security on cimv2 is set up correctly. However, when I try to enumerate the objectCollection, I get the 'Access Denied' exception. This tells me (I think) that the user doesn't have permissions to enumerate the Win32_Service class (SC_MANAGER_ENUMERATE_SERVICE).

I just haven't been able to find any good examples on how to enable that permission for a remote user. I'm not very experienced when it comes to coding with Windows api's, so please be as detailed as possible in your answers :)