Permission Issues and WMI

In order for WMI to work, the Windows Management Instrumentation service must be running.The service cannot be disabled and it must run under the local system account. If this account is changed, WMI will not have the permissions needed to operate properly.

 

If you connect with WMI remotely with a user account that is not a member of the Administrators group on the server computer, then you will probably encounter problems. In this case, you need to examine the DCOM security and Windows Firewall settings. To do this, perform the following steps:

 

❑ On the client computer, enable Windows Management Instrumentation (WMI) for remote administration.
1. Click Start => Run, type gpedit.msc, and then click OK.
2. In the Group Policy Object Editor, expand Computer Configuration, expand Administrative Templates, and then expand Network.
3. Expand Network Connections, expandWindows Firewall, and then click Domain Profile.
4. In Windows XP or Windows Server 2003, right-click Windows Firewall: Allow remote administration exception => Properties. In Windows Vista or Windows Server 2008, rightclick Windows Firewall: Allow inbound remote administration exception.
5. In the dialog, click Enabled =>OK.

❑ On the server and on the client computer, specify that DCOM is available for all Microsoft COM applications.
1. Click Start =>Run, type dcomcnfg, and then click OK.
2. In the Component Services dialog, expand Component Services, expand Computers, and right-click My Computer => Properties.
3. In the My Computer Properties dialog, click the Default Properties tab.
4. On the Default Properties tab, select the Enable Distributed COM on this computer check box, and then click OK.

❑ On the server computer, add the user account you are connecting with to the Distributed COM Users group.
1. Click Start => Run, type lusrmgr.msc, and then click OK.
2. In the Local Users and Groups dialog, click Groups, and then double-click Distributed COM Users.
3. In the Distributed COM Users Properties dialog, click Add.
4. In the Select Users dialog, type the user name under ‘‘Enter the object names to select,’’ and then click OK twice.

If your server computer is a Windows XP machine, you won’t see the Distributed COM Users group. If you still have problems connecting withWMI remotely, perform the following steps.

On the server computer, make sure the user account you are connecting with has the rights to launch and activate COM applications remotely.
1. Click Start => Run, type dcomcnfg, and then click OK.
2. In the Component Services dialog, expand Component Services, expand Computers, and right-click My Computer => Properties.
3. In the My Computer Properties dialog, click the Default Properties tab.

4. On the COM Security tab, click Edit Limits under Launch and Activation Permissions.
5. On the Launch and Activation Permission window, make sure the user account is allowed
for Local Launch, Remote Launch, Local Activation, and Remote Activation, and then click
OK.