+ All Categories
Home > Documents > 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

Date post: 20-Dec-2015
Category:
View: 284 times
Download: 13 times
Share this document with a friend
Popular Tags:
50
1 WMI WMI 廖廖廖 廖廖廖
Transcript
Page 1: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

11

WMIWMI

廖凡磊廖凡磊

Page 2: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

2

agendaagenda

►NamespaceNamespace►WMI scriptsWMI scripts►WMICWMIC►WMI securityWMI security

Page 3: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

3

NamespaceNamespace

\ROOT

CIMV2CIMV2 DefaultDefault WMIWMI securitysecurity

Page 4: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

4

Namespace (cont.)Namespace (cont.)

►CIM classes are organized into CIM classes are organized into namespacesnamespaces. .

►control the control the scopescope and and visibilityvisibility of of managed resource class definitions. managed resource class definitions.

►contains a logical group of related contains a logical group of related classes representing a specific classes representing a specific technology or area of management. technology or area of management.

►Namespaces are equivalent to Namespaces are equivalent to foldersfolders

Page 5: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

5

Namespace(cont.)Namespace(cont.)► Default namespaceDefault namespace

root/CIMV2root/CIMV2►絕大多數與計算機、操作系統相關聯的命名空間絕大多數與計算機、操作系統相關聯的命名空間

root/Defaultroot/Default►管理註冊表的命名空間管理註冊表的命名空間

root/Securityroot/Security root/WMIroot/WMI

Page 6: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

6

Class categoryClass category

►Core and Common ClassesCore and Common Classes►Extension ClassesExtension Classes

Page 7: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

7

Core and Common ClassesCore and Common Classes

► Define in root\cimv2Define in root\cimv2► classes prefaced with “CIM_” classes prefaced with “CIM_” ► 271 / 275 is abstract classes –271 / 275 is abstract classes –► 4 / 275 is dynamic classes 4 / 275 is dynamic classes

Win32 Provider (cimwin32.dll) Win32 Provider (cimwin32.dll) CIM_DataFileCIM_DataFile CIM_DirectoryContainsFileCIM_DirectoryContainsFile CIM_ProcessExecutableCIM_ProcessExecutable CIM_VideoControllerResolution CIM_VideoControllerResolution

Page 8: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

8

Extension Classes Extension Classes

►Define in the root\cimv2 Define in the root\cimv2 ► identified by the “Win32_” prefixidentified by the “Win32_” prefix►68/463 are abstract classes68/463 are abstract classes►395/463 are dynamic classes 395/463 are dynamic classes ►you can directly use them in your WMI you can directly use them in your WMI

scriptsscripts. .

Page 9: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

9

Property and valueProperty and value

\\DARYL\root\CIMV2:Win32_NTLogEvent.Logfile=“Application”.

RecordNumber=“1”

property

value

class

namespce

computer

Page 10: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

10

Listing Classes in a Listing Classes in a Namespace Namespace

►Example of WMI scriptExample of WMI script►Find specific class which contains Find specific class which contains

stringstringcscript GetClasses.vbs |findstr /I "win32_tssessionsetting"

cscript GetClasses.vbs |findstr /I “__"

cscript GetClasses.vbs |findstr /I “CIM_"

cscript GetClasses.vbs |findstr /I "win32_"

Page 11: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

11

Exploring the CIM RepositoryExploring the CIM Repository

► WMI TesterWMI Tester WbemtestWbemtest .exe .exe

► CIM StudioCIM Studio part of the WMI SDK part of the WMI SDK Web-based interface Web-based interface

► WMI scriptsWMI scripts

Page 12: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

12

Exploring the CIM Repository (conExploring the CIM Repository (cont.)t.)

WbemtestWbemtest► run -> wbemtestrun -> wbemtest► 連線連線 -> root/cimv2-> root/cimv2

Page 13: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

13

Exploring the CIM Repository Exploring the CIM Repository (cont.)(cont.)

CIM StudioCIM Studio► Download WMI toolsDownload WMI tools► http://www.microsoft.com/downloads/http://www.microsoft.com/downloads/

details.aspx?familyiddetails.aspx?familyid=6430F853-1120-48DB-8CC5-F2ABDC3ED3=6430F853-1120-48DB-8CC5-F2ABDC3ED314&displaylang=en14&displaylang=en

Page 14: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

14

Exploring the CIM Repository Exploring the CIM Repository (cont.)(cont.)

WMI scriptWMI scriptstrComputer = "."Set objSWbemServices = GetObject("winmgmts:\\" & strComputer & "\root")Set colNameSpaces = objSwbemServices.InstancesOf("__NAMESPACE")

For Each objNameSpace In colNameSpaces Wscript.Echo objNameSpace.NameNext

Microsoft (R) Windows Script Host Version 5.6Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.SECURITYRSOPCliSecurityCenterWMICIMV2PolicyMicrosoftDEFAULTdirectorysubscriptionMSAPPS11

Page 15: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

15

Creating a WMI ScriptCreating a WMI Script

► Environment: OS support WMIEnvironment: OS support WMI► Scripting language that supports MicrosofScripting language that supports Microsof

t ActiveX script hostingt ActiveX script hosting Visual Basic Scripting Edition Visual Basic Scripting Edition Microsoft JScript Microsoft JScript Perl Perl Windows Script Host Windows Script Host Active Server Pages Active Server Pages Internet Explorer Internet Explorer

Page 16: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

16

The flow of creating WMI The flow of creating WMI scriptsscripts

Connect to default CIM namespaceConnect to specific CIM namespace

Get instance of class

Print

1. To connect to WMI using SWbemLocator2. To connect to WMI and retrieve an object

using a moniker prefix

1. Get instance collection using InstancesOf method

2. Get instance collection using ExecQuery method

3. Get specific instance using Get method 4. Get specific instance using moniker prefix

1. Wscript.echo

Page 17: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

17

BackgroundBackground

► 命名規則命名規則 colcol a collection referencea collection reference objobj a object referencea object reference

► syntaxsyntax ‘‘ commentcomment && connect two stringconnect two string __ uncompletely keyword, put uncompletely keyword, put __ at end of line at end of line No need No need ;;

► WQLWQL WMI Query Language WMI Query Language a subset of the American National Standards Institute Structurea subset of the American National Standards Institute Structure

d Query Language (ANSI SQL)d Query Language (ANSI SQL) tutorialtutorial

Page 18: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

18

connect to connect to DefaultDefault CIM CIM namespace namespace

► The default namespace is defined by the fThe default namespace is defined by the following registry entry: ollowing registry entry:

default namespace:default namespace:root/cimv2root/cimv2► Using SWbemLocator in default namespaceUsing SWbemLocator in default namespace

► Using moniker in default namespaceUsing moniker in default namespace

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting\Default Namespace

Set objLocator = CreateObject("WbemScripting.SWbemLocator")Set objService = objLocator.ConnectServer

strComputer = "." Set objService = GetObject("winmgmts:“)

Page 19: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

19

Connect to Connect to specificspecific CIM CIM NamespaceNamespace

► Using SWbemLocatorUsing SWbemLocator

► Using monikerUsing moniker winmgmts:[{SecuritySettings}!][\\ComputerNwinmgmts:[{SecuritySettings}!][\\ComputerN

ame][\Namespace][:ClassName][.Key] ame][\Namespace][:ClassName][.Key]

Set objLocator = CreateObject("WbemScripting.SWbemLocator")Set objService = objLocator.ConnectServer(".", "root\cimv2")

strComputer = "." Set objService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" _ & strComputer & "\root\cimv2")

Page 20: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

20

Get instance of classGet instance of class

► InstancesOfInstancesOf

► ExecQueryExecQuery

► Get Get SwbemServices.Get([strObjectPath][.KeyPrSwbemServices.Get([strObjectPath][.KeyPr

operty='Value']) operty='Value'])

Set objSWbemObjectSet = objSWbemServices.InstancesOf("Win32_Processor ")

Set objSWbemObjectSet = objSWbemServices.ExecQuery("select ProcessorId from Win32_Processor where DeviceID='cpu0'")

Set objSWbemObject = objSWbemServices.Get("Win32_Processor.DeviceID='cpu0'")

Page 21: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

21

Get instance of class (cont.)Get instance of class (cont.)

► monikermoniker :: winmgmts:[{SecuritySettings}!][\\ComputerNwinmgmts:[{SecuritySettings}!][\\ComputerN

ame][\Namespace][:ClassName][.Key]ame][\Namespace][:ClassName][.Key]Set objSWbemObject = GetObject("winmgmts:Win32_Processor.DeviceID='cpu0'")

Page 22: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

22

PrintPrint

1.Object1.Object

2.collection2.collection

 Wscript.echo  “CPU 的型號為: " & objSWbemObject.name

For Each objSWbemObject In objSWbemObjectSet   Wscript.echo  “CPU 的型號為: " & objSWbemObject.name Next

Page 23: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

23

Example1Example1strComputer = "."Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")Set objSWbemServices = objSWbemLocator.ConnectServer // 預設 root/CIMV2Set objSWbemObjectSet = objSWbemServices.InstancesOf("Win32_Processor")For Each objSWbemObject In objSWbemObjectSet   Wscript.echo  “CPU 的型號為: " & objSWbemObject.name Next

This script enumerates all of the cpu on the local computer system.

strComputer = ".“Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")Set objSWbemServices = objSWbemLocator.ConnectServer // 預設 root/CIMV2Set objSWbemObjectSet = objSWbemServices.ExecQuery("SELECT * From Win32_Processor")For Each objSWbemObject In objSWbemObjectSet

Wscript.echo "CPU 的型號為: " & objSWbemObject.nameNext

Page 24: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

24

Example2Example2

strComputer = "."Set objLocator = CreateObject("WbemScripting.SWbemLocator")Set objServices = objLocator.ConnectServer(".", "root\cimv2")Set objObjectSet = objServices.ExecQuery("SELECT MACAddress,Caption FROM Win32_NetworkAdapter WHERE ((MACAddress Is Not NULL) AND (Manufacturer <> 'Microsoft'))") For Each objObject In objObjectSetWscript.echo objObject.Caption & " " &objObject.MacAddressNext

strComputer = "."Set objLocator = CreateObject("WbemScripting.SWbemLocator")Set objServices = objLocator.ConnectServer(".", "root\cimv2")Set objObjectSet = objServices.InstancesOf("Win32_NetworkAdapter")For Each objObject In objObjectSetWscript.echo objObject.Caption & " " &objObject.MacAddressNext

Page 25: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

25

比較各種 比較各種 WMI WMI 例項擷取方法與查詢例項擷取方法與查詢

Ref:https://www.microsoft.com/taiwan/msdn/library/2003/Feb-2003/scripting01142003.htm

Page 26: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

26

Monitoring Resources by Using Monitoring Resources by Using WMI Event Notifications WMI Event Notifications

► How can we know system stateHow can we know system state Write a WMI script and run it repeatly Write a WMI script and run it repeatly Interval problemInterval problem drawbackdrawback

►Not real timeNot real time► What you can do in WMI Event NotificationWhat you can do in WMI Event Notification

Free disk space notificationFree disk space notification Process notificationProcess notification

Page 27: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

27

ExampleExample

strComputer = "."

Set objSWbemServices = GetObject("winmgmts:" &_ "{impersonationLevel=impersonate}!" &_

"\\" & strComputer & "\root\cimv2")

Set objEventSource = objSWbemServices.ExecNotificationQuery( _ "SELECT * FROM __InstanceCreationEvent " &_

"WITHIN 10 " &_ "WHERE TargetInstance " &_

"ISA 'Win32_Process' " &_

"AND TargetInstance.Name = 'notepad.exe'")

Set objEventObject = objEventSource.NextEvent()

Wscript.Echo "An instance of notepad.exe just started."

1.A connection is made to a WMI namespace on a computer.

2.A notification query is issued.

3.The event is received and some action performed.

Page 28: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

28

ExampleExample

strComputer = "."

Set objSWbemServices = GetObject("winmgmts:" &_ "{impersonationLevel=impersonate}!" &_

"\\" & strComputer & "\root\cimv2")

Set objEventSource = objSWbemServices.ExecNotificationQuery( _ "SELECT * FROM __InstanceModificationEvent " &_

"WITHIN 10 " &_ "WHERE TargetInstance " &_

"ISA 'Win32_Service' " &_

"AND TargetInstance.Name = 'alerter '")

Set objEventObject = objEventSource.NextEvent()

Wscript.Echo "The status of the alerter service just changed ."

Page 29: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

29

使用 使用 WMI WMI 問題排除問題排除

// 使用 WMI 來抓取某台電腦的磁碟資訊 . strComputer = "172.16.9.228"

Set objWMIService = GetObject("winmgmts:" _ &"{impersonationLevel=Impersonate," _

& "authenticationLevel=Pkt}!" _ & strComputer & " root/cimv2")

Set colDisks = objWMIService.ExecQuery _ ("Select * from Win32_LogicalDisk")

For each objDisk in colDisks Wscript.Echo "DeviceID: " & vbTab & _ objDisk.DeviceID & vbNewLine & _

"FreeSpace: " & vbTab & objDisk.FreeSpace Next

Ref:http://www.wretch.cc/blog/redray/1821552

Page 30: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

30

problem on remote WMI problem on remote WMI scriptscript

► C:MyWorkSpacemyVbs est2.vbs(15, 1) SWbemLoC:MyWorkSpacemyVbs est2.vbs(15, 1) SWbemLocator: cator: 存取被拒。 存取被拒。

► 這主要是由於 這主要是由於 Windows XP Windows XP 本身作業系統是使用 本身作業系統是使用 網路存取:本機帳戶的共用和安全性模式 網路存取:本機帳戶的共用和安全性模式 -> -> 預設 預設 (( 僅限來賓:本機使用者以來賓身份驗證。僅限來賓:本機使用者以來賓身份驗證。 ))

► 所有的帳戶都是當成來賓來認證所有的帳戶都是當成來賓來認證 , , 也就無法使用也就無法使用 WWMIMI 這項服務這項服務 , , 我們必須將此選項修改成我們必須將此選項修改成

► 網路存取:本機帳戶的共用和安全性模式 網路存取:本機帳戶的共用和安全性模式 -> -> 傳統:傳統:本機使用者以自已的身份驗證。 本機使用者以自已的身份驗證。

► 這樣才能使用所指定的帳號密碼來存取 這樣才能使用所指定的帳號密碼來存取 WMI WMI 服務服務 ..

Ref:http://www.wretch.cc/blog/redray/1821552

Page 31: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

31

problem on remote WMI script problem on remote WMI script (cont.)(cont.)

► C:wmi_info.vbs(47, 2) SWbemLocator: C:wmi_info.vbs(47, 2) SWbemLocator: 無法取得 無法取得 RPC RPC 伺伺服器服器。 。

► 這個問題大多出現在我們無法連線到欲取得資訊的電腦時這個問題大多出現在我們無法連線到欲取得資訊的電腦時 , , 最可能的原因是防火牆的問題 最可能的原因是防火牆的問題

► 如果是微軟的防火牆 參照如果是微軟的防火牆 參照 MSDNMSDN► 如果是別的防火牆打開 如果是別的防火牆打開 TCP TCP 連接埠 連接埠 ::

135135 445445 1024 ~ 1034 (1024 ~ 1034 ( 一般情況一般情況 ) )

► 如果還是不行如果還是不行 , , 請確定電腦上的 請確定電腦上的 WMI WMI 服務有開啟服務有開啟 , , 請將 請將 [[ 系統管理工具系統管理工具 ] -> [] -> [ 服務服務 ] ] 中的 中的 Windows Management IWindows Management Instrumentation nstrumentation 開啟開啟 ..

Page 32: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

32

WMICWMIC

► Windows Management Instrumentation CWindows Management Instrumentation Command-line ommand-line

► c:\windows\ c:\windows\ ► 執行模式 執行模式

交互模式交互模式►wmic:root\cli>os /? wmic:root\cli>os /?

非交互模式 非交互模式 ►wmic os /?wmic os /?

Page 33: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

33

commandscommands

► CALLCALL Executes a method.Executes a method.

► CREATECREATE Creates a new instance and sets the Creates a new instance and sets the

property values. CREATE cannot be used to property values. CREATE cannot be used to create a new class.create a new class.

► DELETEDELETE Deletes the current instance or set of Deletes the current instance or set of

instances. DELETE can be used to delete a instances. DELETE can be used to delete a class.class.

wmic:root\cli>SERVICE WHERE CAPTION='TELNET' CALL STARTSERVICE

wmic:root\cli>ENVIRONMENT CREATE NAME="TEMP", VARIABLEVALUE="NEW"

wmic:root\cli>PROCESS WHERE NAME="CALC.EXE" DELETE

Page 34: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

34

Commands (cont.)Commands (cont.)

►GET GET Retrieve specific property values. Retrieve specific property values.

►LIST LIST Shows data. LIST is the default verb. Shows data. LIST is the default verb.

wmic:root\cli>PROCESS GET NAME

AdverbAdverb DescriptionDescription

BRIEFBRIEF Core set of the properties.Core set of the properties.

FULLFULL Full set of properties. This is the default adverb for Full set of properties. This is the default adverb for LIST.LIST.

INSTANCEINSTANCE Instance paths only.Instance paths only.

STATUSSTATUS Status of the objects.Status of the objects.

SYSTEMSYSTEM System properties.System properties.

wmic:root\cli>PROCESS LIST BRIEF

Page 35: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

35

Commands (cont.)Commands (cont.)

► CONTEXTCONTEXT view the current value of the conditions set view the current value of the conditions set

wmic:root\cli>context

Page 36: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

36

簡單管理工作範例簡單管理工作範例

wmic:root\cli> bios list full

wmic:root\cli>process list brief

Page 37: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

37

複雜管理工作範例 複雜管理工作範例 ► 查詢事件日誌並產生結果文件 查詢事件日誌並產生結果文件

► 使用使用 WMICWMIC 同時重新啟動多台被管理的伺服同時重新啟動多台被管理的伺服器或工作站 器或工作站

C:\>WMIC /node:"dc2" /user:"mytest" NTEVENTswheres"eventtype<3 and eventtype>0 AND logfile='Application'" GET Logfile, SourceName, Eventtype, Message, TimeGenerated /FORMAT:htable:"sortby=EventType">c:\Application.htm

C:\>WMIC /NODE:@"c:\MyServerList.txt" OSswheres(Primary="TRUE") CALL Win32ShutDown 6

Page 38: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

38

WMI SecurityWMI Security

►WMI is powerfulWMI is powerful►Easy to run a scriptEasy to run a script►WMI scripts run in the security context WMI scripts run in the security context

of the user running the script of the user running the script ►WMI namespace-level security.WMI namespace-level security.►DCOM securityDCOM security►Standard Windows Operating Standard Windows Operating

System SecuritySystem Security

Page 39: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

39

WMI namespace-level WMI namespace-level securitysecurity

Ref:http://www.microsoft.com/technet/scriptcenter/guide/sas_wmi_ocmw.mspx

Page 40: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

40

WMI namespace-level WMI namespace-level securitysecurity

►Setting Namespace Security Setting Namespace Security Descriptors Descriptors WMI control propertiesWMI control properties

Page 41: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

41

Distributed COM (DCOM) Distributed COM (DCOM) security security

► ImpersonationImpersonation enables you to specify whom the WMI ser enables you to specify whom the WMI service should act as when carrying out a task vice should act as when carrying out a task It is possible to allow Computer B to also use your credentials; fIt is possible to allow Computer B to also use your credentials; f

or that matter, you can also allow computers C, D, and E to use yor that matter, you can also allow computers C, D, and E to use your credentials.our credentials.No double delegationNo double delegation

► The The authenticationLevelauthenticationLevel setting enables you to request t setting enables you to request the level of DCOM authentication and privacy to be used the level of DCOM authentication and privacy to be used throughout a connection. hroughout a connection.

► Setting the Default Process Security Level Using VBScripSetting the Default Process Security Level Using VBScript t use a use a monikermoniker in a call to in a call to GetObjectGetObject

Page 42: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

42

Distributed COM (DCOM) securityDistributed COM (DCOM) securityDEMODEMO

A B O

A C O

A B XC

Page 43: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

43

Standard Windows Operating Standard Windows Operating System SecuritySystem Security

►Copy files from a NTFS permissions Copy files from a NTFS permissions folders will cause “ACCESS DENIED”folders will cause “ACCESS DENIED”

Page 44: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

44

reviewreview

►NamespaceNamespace►WMI scriptsWMI scripts►WMICWMIC►WMI securityWMI security

Page 45: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

45

ReferenceReference► 完整的線上手冊在這:完整的線上手冊在這:► http://msdn2.microsoft.com/en-us/library/aa394582.aspxhttp://msdn2.microsoft.com/en-us/library/aa394582.aspx► MSDN Library for Visual Studio 2005 MSDN Library for Visual Studio 2005 也內含。也內含。► 另外到下載中心搜尋 另外到下載中心搜尋 WMI WMI ,勾選英文,會有一些工具及範例可以抓來測:,勾選英文,會有一些工具及範例可以抓來測:► http://www.microsoft.com/downloads/results.aspx?DisplayLang=zh-tw&nr=20&freetext=WMI&Displhttp://www.microsoft.com/downloads/results.aspx?DisplayLang=zh-tw&nr=20&freetext=WMI&Displ

ayEnglishAlso=true&sortCriteria=dateayEnglishAlso=true&sortCriteria=date► 中文資訊主要都是 中文資訊主要都是 TechNet TechNet 那邊翻譯 那邊翻譯 Script Center Script Center 的:的:► http://www.microsoft.com/taiwan/technet/scriptcenter/default.mspxhttp://www.microsoft.com/taiwan/technet/scriptcenter/default.mspx► 這邊也有工具及範例的連結。這邊也有工具及範例的連結。► Happy scriptingHappy scripting► http://www.microsoft.com/taiwan/technet/columns/profwin/tnascript.mspxhttp://www.microsoft.com/taiwan/technet/columns/profwin/tnascript.mspx► WMI - Windows Management Instrumentation WMI - Windows Management Instrumentation 。提供資源讓您透過指令碼管理 。提供資源讓您透過指令碼管理 Windows Windows 作業系統作業系統

的一種技術。請參閱 的一種技術。請參閱 WMI ScriptingWMI Scripting ► WMIWMI 輕鬆入門輕鬆入門 (( 簡簡 ))► http://hi.baidu.com/xuejinglan/blog/item/1f9d632cbffbcaee8a139912.htmlhttp://hi.baidu.com/xuejinglan/blog/item/1f9d632cbffbcaee8a139912.html► WMIC WMIC 全新的超級指令行系統管理工具全新的超級指令行系統管理工具 ► http://forum.slime.com.tw/thread61654.htmhttp://forum.slime.com.tw/thread61654.htm► WMIWMI 使用技巧使用技巧► http://ptt.hit.edu.cn/api/blog.aspx?title=wmi%E4%BD%BF%E7%94%A8%E6%8A%80%E5%B7%A7lhttp://ptt.hit.edu.cn/api/blog.aspx?title=wmi%E4%BD%BF%E7%94%A8%E6%8A%80%E5%B7%A7l► WMI toolsWMI tools► http://www.microsoft.com/downloads/details.aspx?familyid=6430F853-1120-48DB-8CC5-F2ABDC3Ehttp://www.microsoft.com/downloads/details.aspx?familyid=6430F853-1120-48DB-8CC5-F2ABDC3E

D314&displaylang=enD314&displaylang=en► NamespacesNamespaces► http://www.microsoft.com/technet/scriptcenter/guide/sas_wmi_khjg.mspx?mfr=truehttp://www.microsoft.com/technet/scriptcenter/guide/sas_wmi_khjg.mspx?mfr=true

Page 46: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

46

strComputer = "." Set objServices = GetObject("winmgmts:\\" _ & strComputer & "\root\CIMV2") set objProcessSet = objServices.ExecQuery _ ("SELECT Name FROM Win32_Process",,48) For Each Process in objProcessSet

WScript.Echo Process.Name Next

strComputer = "." Set objServices = GetObject( _ "winmgmts:{impersonationLevel=impersonate," _ & "authenticationLevel=pktPrivacy}!root/cimv2") set objProcessSet = objServices.ExecQuery _ ("SELECT Name FROM Win32_Process",,48) For Each Process in objProcessSet

WScript.Echo Process.Name Next

Page 47: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

47

► Impersonation level, expressed as "winmgImpersonation level, expressed as "winmgmts:{impersonationLevel=Value}". mts:{impersonationLevel=Value}".

► Authentication level, expressed as "winmAuthentication level, expressed as "winmgmts:{authenticationLevel=Value}". gmts:{authenticationLevel=Value}".

Page 48: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

48

DCOM Impersonation LevelsDCOM Impersonation Levels AnonymousAnonymous Hides the credentials of tHides the credentials of t

he caller. he caller. identityidentity Enables objects to query Enables objects to query

the credentials of the callthe credentials of the caller. er.

impersonateimpersonate Enables objects to use thEnables objects to use the credentials of the caller.e credentials of the caller.

delegatedelegate Enables objects to permiEnables objects to permit other objects to use the t other objects to use the credentials of the caller. credentials of the caller.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting\Default Impersonation Level

Page 49: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

49

Authentication LevelAuthentication LevelNONENONE Does not use any authenDoes not use any authen

tication.tication.CONNECTCONNECT only when the client trieonly when the client trie

s to connect to the serves to connect to the server r

CALLCALL only at the beginning of only at the beginning of each calleach call

PKTPKT Signed theHeader Signed theHeader PKTINTEGRITYPKTINTEGRITY Signed the all packetSigned the all packet

PKTPRIVACYPKTPRIVACY Signed and encrypts Signed and encrypts all packetall packet

DEFAULTDEFAULT Uses a standard securityUses a standard security

back

Page 50: 1 WMI 廖凡磊. 2 agenda ► Namespace ► WMI scripts ► WMIC ► WMI security.

50

How to use WMI control How to use WMI control propertiesproperties

► 我的電腦 右鍵我的電腦 右鍵 ->-> 管理管理 ->-> 服務及應用程式服務及應用程式 ->->WMIWMI 控制 右鍵控制 右鍵 ->-> 內容內容

► LogLog► Backup/restoreBackup/restore► Security on namespaceSecurity on namespace► Default namespace specifiedDefault namespace specified

back


Recommended