WMI Configuration Script

This script is used to mass-configure remote WMI access.
# Usage:
# 1. Edit computers.txt referred by $ComputerListFile parameter
# 2. Set $account parameter to the name of user those credentials will be used for monitoring
# 3. Run the script
# 4. Check the log file for results

$account = "administrator@dc1"
$ComputerListFile = "C:\wmi\computers.txt"
$LogFile = "C:\wmi\wmi_setup.log"

#-------------------------------------------------------------------------------------------------------------------------
#--------- Function for print messages to $LogFile and screen ------------------------------------------------------------
#-------------------------------------------------------------------------------------------------------------------------
function print_message($File, [string]$Text)
{
Write-Host $Text
Add-Content $File $Text
}

#-------------------------------------------------------------------------------------------------------------------------
#--------- Function for check open DCOM port (135) -----------------------------------------------------------------------
#-------------------------------------------------------------------------------------------------------------------------
function check_open_port($ip, $port, $con_timeout)
{
$tcpclient = new-object Net.Sockets.TcpClient
$Connection = $tcpclient.BeginConnect($ip, $port, $null, $null)
$TimeOut = $Connection.AsyncWaitHandle.WaitOne($con_timeout,$false)
if(!$TimeOut)   {
$TCPclient.Close()
return 0
} else {
try {
$TCPclient.EndConnect($Connection) | out-Null
$TCPclient.Close()
return 1
} catch {
## Machine actively refused the connection. The port is not open but $TimeOut was still true
return 0
}
}
}

#-------------------------------------------------------------------------------------------------------------------------
#--------- Function for enable privilege to change CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6} permissions --------------
#-------------------------------------------------------------------------------------------------------------------------
function enable-privilege {
 param(
 ## The privilege to adjust. This set is taken from
 ## http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx
 [ValidateSet(
"SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
"SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
"SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
"SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
"SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
"SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
"SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
"SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
"SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
"SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
"SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]
$Privilege,
## The process on which to adjust the privilege. Defaults to the current process.
$ProcessId = $pid,
## Switch to disable the privilege, rather than enable it.
[Switch] $Disable
)

## Taken from P/Invoke.NET with minor adjustments.
$definition = @'
using System;
using System.Runtime.InteropServices;

public class AdjPriv
{
[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);

[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
[DllImport("advapi32.dll", SetLastError = true)]
internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
[StructLayout(LayoutKind.Sequential, Pack = 1)]
internal struct TokPriv1Luid
{
public int Count;
public long Luid;
public int Attr;
}

internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
internal const int TOKEN_QUERY = 0x00000008;
internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
public static bool EnablePrivilege(long processHandle, string privilege, bool disable)
{
bool retVal;
TokPriv1Luid tp;
IntPtr hproc = new IntPtr(processHandle);
IntPtr htok = IntPtr.Zero;
retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
tp.Count = 1;
tp.Luid = 0;
if(disable)
{
tp.Attr = SE_PRIVILEGE_DISABLED;
}
else
{
tp.Attr = SE_PRIVILEGE_ENABLED;
}
retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
return retVal;
}
}
'@

$processHandle = (Get-Process -id $ProcessId).Handle
$type = Add-Type $definition -PassThru
$type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)
}

#-------------------------------------------------------------------------------------------------------------------------
#--------- First stage (get account sid, open file computers.txt, initialization permission constants) -------------------
#-------------------------------------------------------------------------------------------------------------------------
function get-sid
{
Param (
$DSIdentity
)
$ID = new-object System.Security.Principal.NTAccount($DSIdentity)
return $ID.Translate( [System.Security.Principal.SecurityIdentifier] ).toString()
}
$sid = get-sid $account
$SDDL = "A;;CCWP;;;$sid"
$DCOMSDDLDefaultLaunchPermission = "A;;CCDCLCSWRP;;;$sid"
$DCOMSDDLDefaultAccessPermission = "A;;CCDCLC;;;$sid"
$DefaultSDDLAccess = "O:BAG:BAD:(A;;CCDCLC;;;PS)(A;;CCDC;;;SY)(A;;CCDCLC;;;BA)"
$DefaultSDDLLaunch = "O:BAG:BAD:(A;;CCDCLCSWRP;;;BA)(A;;CCDCSW;;;IU)(A;;CCDCSW;;;SY)(A;;CCDCLCSWRP;;;LA)"
$computers = Get-Content $ComputerListFile

$timeNow = get-date
print_message $LogFile $timeNow

#-------------------------------------------------------------------------------------------------------------------------
#--------- Main loop -----------------------------------------------------------------------------------------------------
#-------------------------------------------------------------------------------------------------------------------------
foreach ($strcomputer in $computers)
{
print_message $LogFile $strcomputer

$Port135Open = check_open_port $strcomputer "135" "1000"   
if ($Port135Open) {
try{
$Reg = [WMIClass]"\\$strcomputer\root\default:StdRegProv"
}
catch {
$message = "Error: " + [string]$Error[0]
print_message $LogFile $message
continue
}
} else {
print_message $LogFile "Error! The RPC server is unavailable. No ping."
continue
}

#-------------------------------------------------------------------------------------------------------------------------
#--------- apply group policy --------------------------------------------------------------------------------------------
#-------------------------------------------------------------------------------------------------------------------------
 try{
$Win32_OS = Get-WmiObject Win32_OperatingSystem -computer $strcomputer
}
catch {
$message = "Error: " + [string]$Error[0]
print_message $LogFile $message
continue
}
print_message $LogFile $Win32_OS.caption
$str_version = [regex]::Replace($Win32_OS.version, "(\d.\d).*", '$1'); #6.1.7601 -> 6.1
$version = [decimal]$str_version
print_message $LogFile "Applying group policies..."

If ($version -ge 5.1) {
Invoke-WmiMethod -ComputerName $strcomputer -Path win32_process -Name create -ArgumentList "gpupdate /target:Computer /force /wait:0" | Out-Null
} Else {
Invoke-WmiMethod -ComputerName $strcomputer -Path win32_process -Name create вЂ“ArgumentList "secedit /refreshpolicy machine_policy /enforce" | Out-Null
}
print_message $LogFile "Applying group policies completed"     

#-------------------------------------------------------------------------------------------------------------------------
#--------- If Windows 2008 or 7 set CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6} permissions to BUILTIN\Administrators ---
#-------------------------------------------------------------------------------------------------------------------------
If ($version -ge 6.1) {
print_message $LogFile "Set CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6} permissions..."
$RemoteKey = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::ClassesRoot, $strcomputer)

enable-privilege SeTakeOwnershipPrivilege 
$key = $RemoteKey.OpenSubKey("CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::takeownership)
# You must get a blank acl for the key b/c you do not currently have access
$acl = $key.GetAccessControl([System.Security.AccessControl.AccessControlSections]::None)
$me = [System.Security.Principal.NTAccount]"BUILTIN\Administrators"
$acl.SetOwner($me)
$key.SetAccessControl($acl)
$TrustedInstaller = [System.Security.Principal.NTAccount]"NT Service\TrustedInstaller"
$acl.SetOwner($TrustedInstaller)

# After you have set owner you need to get the acl with the perms so you can modify it.
$acl = $key.GetAccessControl()
$rule = New-Object System.Security.AccessControl.RegistryAccessRule ("BUILTIN\Administrators","FullControl","Allow")
$acl.SetAccessRule($rule)
$key.SetAccessControl($acl)

$key.Close()
#http://social.technet.microsoft.com/Forums/en/winserverpowershell/thread/e718a560-2908-4b91-ad42-d392e7f8f1ad
}

#-------------------------------------------------------------------------------------------------------------------------
#--------- Enable DCOM, Set authentication (to "Connect") and impersonation (to "Identify") levels -----------------------
#-------------------------------------------------------------------------------------------------------------------------
$Result = $Reg.SetStringValue(2147483650,"software\microsoft\ole","EnableDCOM","Y")
if ($Result) {print_message $LogFile "EnableDCOM -> Y"}        
$Result = $Reg.SetDWORDValue(2147483650,"software\microsoft\ole","LegacyAuthenticationLevel","2")
if ($Result) {print_message $LogFile "LegacyAuthenticationLevel -> Connect"}
$Result = $Reg.SetDWORDValue(2147483650,"software\microsoft\ole","LegacyImpersonationLevel","2")
if ($Result) {print_message $LogFile "LegacyImpersonationLevel -> Identify"}

#-------------------------------------------------------------------------------------------------------------------------
#--------- Set wmi namespace root/CIMV2 permissions, set COM security permissions ----------------------------------------
#-------------------------------------------------------------------------------------------------------------------------
$converter = new-object system.management.ManagementClass Win32_SecurityDescriptorHelper

$security = Get-WmiObject -ComputerName $strcomputer -Namespace root/cimv2 -Class __SystemSecurity
$binarySD = @($null)
$result = $security.PsBase.InvokeMethod("GetSD",$binarySD)
$outsddl = $converter.BinarySDToSDDL($binarySD[0])
$newSDDL = $outsddl.SDDL += "(" + $SDDL + ")"
$WMIbinarySD = $converter.SDDLToBinarySD($newSDDL)
$WMIconvertedPermissions = ,$WMIbinarySD.BinarySD
$result = $security.PsBase.InvokeMethod("SetSD",$WMIconvertedPermissions)
print_message $LogFile "ROOT\cimv2 permissions should be granted"

$COMAccess = $Reg.GetBinaryValue(2147483650,"software\microsoft\ole","DefaultAccessPermission").uValue
if ($COMAccess) {
$outCOMAccessSDDL = $converter.BinarySDToSDDL($COMAccess)
$newCOMAccessSDDL = $outCOMAccessSDDL.SDDL += "(" + $DCOMSDDLDefaultAccessPermission + ")"
} else {
$newCOMAccessSDDL = $DefaultSDDLAccess + "(" + $DCOMSDDLDefaultAccessPermission + ")"
}
$COMAccessbinarySD = $converter.SDDLToBinarySD($newCOMAccessSDDL)
$COMAccessconvertedPermissions = ,$COMAccessbinarySD.BinarySD
$result = $Reg.SetBinaryValue(2147483650,"software\microsoft\ole","DefaultAccessPermission", $COMAccessbinarySD.binarySD)
if ($result.Returnvalue -eq 0) {print_message $LogFile "DefaultAccessPermission granted"}

$COMLaunch = $Reg.GetBinaryValue(2147483650,"software\microsoft\ole","DefaultLaunchPermission").uValue
if ($COMLaunch) {
$outCOMLaunchSDDL = $converter.BinarySDToSDDL($COMLaunch)
$newCOMLaunchSDDL = $outCOMLaunchSDDL.SDDL += "(" + $DCOMSDDLDefaultLaunchPermission + ")"        
} else {
$newCOMLaunchSDDL = $DefaultSDDLLaunch + "(" + $DCOMSDDLDefaultLaunchPermission + ")"
}
$COMLaunchbinarySD = $converter.SDDLToBinarySD($newCOMLaunchSDDL)
$COMLaunchconvertedPermissions = ,$COMLaunchbinarySD.BinarySD      
$result = $Reg.SetBinaryValue(2147483650,"software\microsoft\ole","DefaultLaunchPermission", $COMLaunchbinarySD.binarySD)
if ($result.Returnvalue -eq 0) {print_message $LogFile "DefaultLaunchPermission granted"}
}
DPF_EXPORT_V5.8.8 / TIME_1743710552 / 2025-04-03 20:02:32 / STRLEN_13192 / STRLEN_HTML_18764
{VERSION}
Was this page helpful?