Delegating WMI security remotely with powershell

A while back, I was working on a script for checking domain controller security event logs which needed to be handed off to a team that was not part of the Domain Admins group.  While they had permissions to access the security event logs through user rights in GPO, trying to read the event log through an MMC remotely is ridiculously slow.  A good solution was to use WMI with a tight filter for event ID's and a brief time window for the specific event.  The problem was, none of this team had WMI access.  So to go about fixing a few hundred domain controllers, I started poking around at WMI permissions.  You can edit this through the MMC->Component Services console.  But doing this via RDP on such a large scale is not an option.  There are some script examples in VB, such as this one.  But, being a powershell guy, I wanted to use some existing code and wrap in the additional lines to update the security.  So, what I did was created the permissions that I wanted on one specific machine (similar to the above article), and use powershell to pull the security descriptor.  The example below is delegating the common root\CimV2 namespace which contains the event log event classes.


#Collect your security descriptor

$sd = gwmi -namespace "root\cimv2" -Class __SystemSecurity -ComputerName $FixedMachine
$sdhelper = new-object system.management.ManagementClass Win32_SecurityDescriptorHelper
$binarySD = @($null)
[void]$sd.PsBase.InvokeMethod("GetSD",$binarySD)

#At this point you can loop through a list of machines and push out the updated permissions.
$sdlocal = gwmi -Namespace "root\cimv2" -Class __SystemSecurity  -computername $remotemachine
$sdhelper2 = new-object system.management.ManagementClass Win32_SecurityDescriptorHelper
[Void]$sdlocal.psbase.invokemethod("SetSD",$binarySD)



For more details on the various types of permissions, you can reference this technet article.  For remote read-only, you can go with "remote enable", and "enable account".

Remote server management with alternate credentials

This post is something of a throwback to the early Windows NT days, and is still applicable for newer OS's (NT and anything Windows 2000 and above). If you are trying to manage a system remotely (not using remote desktop or similar VNC type technology), you will frequently be using RPC based connections. Tools like pstools, MMC's (eventvwr, compmgmt.msc, etc), regedit and many others use this type of connection. If you the machine you are connecting to does not allow access with your credentials, is not a member of your forest, or is not joined to a domain; then there is one easy way to get all of your tools working. If you use the command line tool for drive mapping, you can also create an authenticated RPC session between your machines which will be used in any access attempt you make after this.

Here is an example of connecting to a remote server using the local administrator account on that machine:

net use \\remoteserver\ipc$ /user:remoteserver\administrator *

The * at the end of the command will cause a prompt for password to come up when you run it. If the connection is successful, you have authenticated with alternate credentials. Now you can use your RPC based tools for access with no problems.

To remove these connections: net use \\remoteserver\ipc$ /delete