Get-WMIObject 0x80070005

Question

From a workgroup machine, I run the following command:

$wmi_pass = "<password>"
$wmi_user = "<username>"
$remote_pass = ConvertTo-SecureString -String $wmi_pass -AsPlainText -Force;
$remote_credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $wmi_user, $remote_pass;
Get-WMIObject -Query "Select DisplayName from Win32_Service where StartMode='Auto'" -ComputerName "<IP address>" -Credential $remote_credential

I get the following error: Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)

I've tried it on several servers with the same results. Using the wmimgmt.msc, I selected the Root node and verified that Administrators group has all "Allow" checkboxes selected (except Special Permission).

Any thoughts?

Answer 1

To query WMI remotely a user needs DCOM-permission in addition to access to the WMI-namespaces (which you have already done). DCOM permission can be given using:

• dcomcnfg (see https://msdn.microsoft.com/en-us/library/aa393266(v=vs.85).aspx or https://serverfault.com/questions/28520/which-permissions-rights-does-a-user-need-to-have-wmi-access-on-remote-machines)
• GPO "Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax" (sets the same permission as you would in dcomcnfg, but locks them so you can't edit locally)
• Add the user to the "Performance Log Users" or "Distributed COM Users"-group