CIMSessions 需要哪些权限 [英] What are the permissions required for CIMSessions

问题描述

我需要在我没有权限的服务器上查询一些 WMI 类.这是我运行时遇到的错误.

I need to query some WMI classes on Servers that I do not have permissions. Here is the error I get when I run it.

PS> get-ciminstance -ComputerName test.mydomain.com -ClassName Win32_OperatingSystem
get-ciminstance : Access is denied.
At line:1 char:1
+ get-ciminstance -ComputerName test.mydomain.com -ClassName Win32_Operating ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (root\cimv2:Win32_OperatingSystem:String) [Get-CimInstance], CimException
    + FullyQualifiedErrorId : HRESULT 0x80070005,Microsoft.Management.Infrastructure.CimCmdlets.GetCimInstanceCommand
    + PSComputerName        : test.mydomain.com

现在服务器有 PowerShell 2，所以它使用 DCOM，但我会升级和配置 PowerShell 以允许 WSMAN 连接.

Right now server has PowerShell 2, so it uses DCOM but I will get the PowerShell upgraded and configured to allow WSMAN connections.

但是需要授予帐户的权限是什么?

But what are the permissions that need to be granted to the account?

推荐答案

默认情况下，Administrators(本地)和 Authenticated Users(域)至少具有以下权限:命名空间.您需要确保您可以登录/验证服务器.值得一提的是，Authenticated Users 组默认没有Remote Enable 权限.

By default, Administrators (local) and Authenticated Users (domain) have at least read rights to the namespace. You need to ensure you can login/authenticate to the server. It's worth mentioning that the Authenticated Users group does not have Remote Enable permission by default.

Windows 操作系统将 WinRM 用于 CIM cmdlet，并且用户帐户需要是 管理员.WinRM 创建了一个名为 WinRMRemoteWMIUsers_ 的本地组，并且只允许访问 Administrator 组和 WinRMRemoteWMIUsers_.要将用户添加到该组，请使用以下命令:

The Windows OS uses WinRM for CIM cmdlets and the user account needs to be an administrator. WinRM makes a local group called WinRMRemoteWMIUsers_ and gives access to just the Administrators group and WinRMRemoteWMIUsers_. To add a user to that group use the following command:

net localgroup WinRMRemoteWMIUsers__ /add "domain\user"

抽象的答案很简单，您需要被授予对 Namespace 的 Enable Account 和 Remote Enable 权限才能拥有 WMI 远程读取权限.

The abstract answer is simply that you need to be granted Enable Account and Remote Enable permissions to the Namespace to have WMI read rights remotely.

验证 WMI 权限的过程

登录服务器并启动 mmc.exe.添加 WMI 管理单元，加载后，右键单击 WMI 控件.当属性"窗口打开时，单击安全性，展开 root 并选择 cimv2.单击安全按钮并查看被授予访问权限的人员以及授予的访问权限.

Login to the server and launch mmc.exe. Add the WMI snapin and once it loads, right click on WMI Control. When the Properties window opens, click security, expand root and select cimv2. Click the security button and view who is granted access and what access is granted.

使用 DCOM 进行测试的脚本

如果你想使用DCOM进行测试，或者因为服务器操作系统太旧而需要，使用这个脚本:

If you want to test using DCOM, or need to because the server OS is too old, use this script:

$Computer = thisbox.domain.com
$CimOption = New-CimSessionOption -Protocol Dcom
$CimSession = New-CimSession -ComputerName $Computer -SessionOption $CimOption

Get-CimInstance -ClassName win32_operatingsystem -CimSession $CimSession

这篇关于CIMSessions 需要哪些权限的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！