Querying remote system via WMI returns access denied for non-administrator

2
votes

I have a simple WMI query that runs fine locally, but querying a remote system gives an access denied error. When I add the local user to the remote system as member of the administrator group, the query works as expected, but I don't want to have that user as a member of that group.

I already tried the following things, unfortunately not successful so far:

  • I enabled RemoteAdmin for the firewall (netsh firewall set service RemoteAdmin enable)
  • I added the user with all possible access rights to the WMI Security settings (for the root name space, and I also checked that the settings are correctly propagated to the namespace I'm querying, root/cimv2) via wmimgmt.msc
  • I enabled remote access for the user in DCOM COM security

I still get the same error every time I run my query, is there anything else that I may have missed?

1
securitywmiremote-accessdcom
What Windows versions are on the local and remote systems? - Helen
There is a MSDN section dedicated to this: msdn.microsoft.com/en-us/library/aa389290(VS.85).aspx - Uros Calakovic
Both systems use Windows 2008 Server (64 bit). I've read through the linked article, but it looks like I tried everything that's in there. Do I have to reboot the system for the changed DCOM settings to have an effect? - Gorgsenegger
The failure is dependent on what your simple WMI script is trying to do. Please post it. - Lizz

1 Answers

0
votes

WMI rights are much tighter than typical, as the link provided by Uros describes in detail. In short, you will either need to enable the Active Directory right called "Trusted for Delegation", which is extremely powerful and not recommended, or add explicit credentials, as described in the MS link referenced by Uros.