Vista - Controlling security settings with Get-WMIObject?

How do we set security (privileges, impersonation, authentication level)
with Get-WMIObject?

I'm working on some method invocations that need to acquire non-default
privileges (e.g., Win32_OperatingSystem's Win32_Shutdown when performing any
action but a logoff) and it isn't immediately apparent how to change
privileges.

Alex K. Angelopoulos [MVP] wrote:
> How do we set security (privileges, impersonation, authentication level)
> with Get-WMIObject?
>
> I'm working on some method invocations that need to acquire non-default
> privileges (e.g., Win32_OperatingSystem's Win32_Shutdown when performing any
> action but a logoff) and it isn't immediately apparent how to change
> privileges.
>
>

I can't come up with a native way,

I use the Managementscope :

try :

$ms = new-object management.managementscope | out-Propertygrid

and open the options tree.

Greetings /\/\o\/\/

for out-PropertyGid :

http://mow001.blogspot.com/2006/04/p...-msh-view.html
(yep I misnamed the post)

Ability to set security settings is not avaiable via get-wmiobject. We are
looking into if we can improve this. Please feel free to open a bug and vote
on it. If not V1, at least we will get this in early for V2

--
Abhishek Agrawal [MSFT]
Windows PowerShell Team
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.


"/\/\o\/\/" <no@spam.mow> wrote in message
news:Ogg9BMPgGHA.4464@TK2MSFTNGP04.phx.gbl...
> Alex K. Angelopoulos [MVP] wrote:
>> How do we set security (privileges, impersonation, authentication level)
>> with Get-WMIObject?
>>
>> I'm working on some method invocations that need to acquire non-default
>> privileges (e.g., Win32_OperatingSystem's Win32_Shutdown when performing
>> any action but a logoff) and it isn't immediately apparent how to change
>> privileges.
>
> I can't come up with a native way,
>
> I use the Managementscope :
>
> try :
>
> $ms = new-object management.managementscope | out-Propertygrid
>
> and open the options tree.
>
> Greetings /\/\o\/\/
>
> for out-PropertyGid :
>
> http://mow001.blogspot.com/2006/04/p...-msh-view.html
> (yep I misnamed the post)

Out-PropertyGrid?
"/\/\o\/\/" <no@spam.mow> wrote in message
news:Ogg9BMPgGHA.4464@TK2MSFTNGP04.phx.gbl...
> Alex K. Angelopoulos [MVP] wrote:
>> How do we set security (privileges, impersonation, authentication level)
>> with Get-WMIObject?
>>
>> I'm working on some method invocations that need to acquire non-default
>> privileges (e.g., Win32_OperatingSystem's Win32_Shutdown when performing
>> any action but a logoff) and it isn't immediately apparent how to change
>> privileges.
>
> I can't come up with a native way,
>
> I use the Managementscope :
>
> try :
>
> $ms = new-object management.managementscope | out-Propertygrid
>
> and open the options tree.
>
> Greetings /\/\o\/\/
>
> for out-PropertyGid :
>
> http://mow001.blogspot.com/2006/04/p...-msh-view.html
> (yep I misnamed the post)

Alex K. Angelopoulos [MVP] wrote:
> Out-PropertyGrid?

bit plugging of my own tools :

http://mow001.blogspot.com/2006/04/p...-msh-view.html

of course you can set it like this also :

MowPS>$ms = new-object management.managementscope
MowPS>$ms

IsConnected Options
Path
----------- -------
----
False
System.Management.ConnectionOptions \\.\root\cimv2


MowPS>$ms.options


Locale :
Username :
Password :
Authority :
Impersonation : Impersonate
Authentication : Unchanged
EnablePrivileges : False
Context : {}
Timeout : 10675199.02:48:05.4775807

$ms.options.EnablePrivileges = $true

gr /\/\o\/\/



Alex K. Angelopoulos [MVP] wrote:
> Out-PropertyGrid?
> "/\/\o\/\/" <no@spam.mow> wrote in message
> news:Ogg9BMPgGHA.4464@TK2MSFTNGP04.phx.gbl...
>> Alex K. Angelopoulos [MVP] wrote:
>>> How do we set security (privileges, impersonation, authentication level)
>>> with Get-WMIObject?
>>>
>>> I'm working on some method invocations that need to acquire non-default
>>> privileges (e.g., Win32_OperatingSystem's Win32_Shutdown when performing
>>> any action but a logoff) and it isn't immediately apparent how to change
>>> privileges.
>> I can't come up with a native way,
>>
>> I use the Managementscope :
>>
>> try :
>>
>> $ms = new-object management.managementscope | out-Propertygrid
>>
>> and open the options tree.
>>
>> Greetings /\/\o\/\/
>>
>> for out-PropertyGid :
>>
>> http://mow001.blogspot.com/2006/04/p...-msh-view.html
>> (yep I misnamed the post)
>
>

Using the propertygrid script, I get a form with the process name shown in
the title bar and nothing else when I try something like this:
ov (get-process)[0]
I tried your approach directly, and I can enable privileges, but I still get
failures calling Win32_Shutdown due to lack of privileges. It's possible I
screwed up the privilege inheritance so I need to try it again. You've
successfully used this to make privileges work in PowerShell already, right?


"/\/\o\/\/" <no@spam.mow> wrote in message
news:u7BCDiWgGHA.5092@TK2MSFTNGP04.phx.gbl...
> Alex K. Angelopoulos [MVP] wrote:
> > Out-PropertyGrid?
>
> bit plugging of my own tools :
>
> http://mow001.blogspot.com/2006/04/p...-msh-view.html
>
> of course you can set it like this also :
>
> MowPS>$ms = new-object management.managementscope
> MowPS>$ms
>
> IsConnected Options Path
> ----------- -------
> ----
> False
> System.Management.ConnectionOptions \\.\root\cimv2
>
>
> MowPS>$ms.options
>
>
> Locale :
> Username :
> Password :
> Authority :
> Impersonation : Impersonate
> Authentication : Unchanged
> EnablePrivileges : False
> Context : {}
> Timeout : 10675199.02:48:05.4775807
>
> $ms.options.EnablePrivileges = $true
>
> gr /\/\o\/\/
>
>
>
> Alex K. Angelopoulos [MVP] wrote:
>> Out-PropertyGrid?
>> "/\/\o\/\/" <no@spam.mow> wrote in message
>> news:Ogg9BMPgGHA.4464@TK2MSFTNGP04.phx.gbl...
>>> Alex K. Angelopoulos [MVP] wrote:
>>>> How do we set security (privileges, impersonation, authentication
>>>> level) with Get-WMIObject?
>>>>
>>>> I'm working on some method invocations that need to acquire non-default
>>>> privileges (e.g., Win32_OperatingSystem's Win32_Shutdown when
>>>> performing any action but a logoff) and it isn't immediately apparent
>>>> how to change privileges.
>>> I can't come up with a native way,
>>>
>>> I use the Managementscope :
>>>
>>> try :
>>>
>>> $ms = new-object management.managementscope | out-Propertygrid
>>>
>>> and open the options tree.
>>>
>>> Greetings /\/\o\/\/
>>>
>>> for out-PropertyGid :
>>>
>>> http://mow001.blogspot.com/2006/04/p...-msh-view.html
>>> (yep I misnamed the post)
>>

I did test in former betas,
I will do some more testing
later today.


gr /\/\o\/\/
Alex K. Angelopoulos [MVP] wrote:
> Using the propertygrid script, I get a form with the process name shown in
> the title bar and nothing else when I try something like this:
> ov (get-process)[0]
> I tried your approach directly, and I can enable privileges, but I still get
> failures calling Win32_Shutdown due to lack of privileges. It's possible I
> screwed up the privilege inheritance so I need to try it again. You've
> successfully used this to make privileges work in PowerShell already, right?
>
>
> "/\/\o\/\/" <no@spam.mow> wrote in message
> news:u7BCDiWgGHA.5092@TK2MSFTNGP04.phx.gbl...
>> Alex K. Angelopoulos [MVP] wrote:
>>> Out-PropertyGrid?
>> bit plugging of my own tools :
>>
>> http://mow001.blogspot.com/2006/04/p...-msh-view.html
>>
>> of course you can set it like this also :
>>
>> MowPS>$ms = new-object management.managementscope
>> MowPS>$ms
>>
>> IsConnected Options Path
>> ----------- -------
>> ----
>> False
>> System.Management.ConnectionOptions \\.\root\cimv2
>>
>>
>> MowPS>$ms.options
>>
>>
>> Locale :
>> Username :
>> Password :
>> Authority :
>> Impersonation : Impersonate
>> Authentication : Unchanged
>> EnablePrivileges : False
>> Context : {}
>> Timeout : 10675199.02:48:05.4775807
>>
>> $ms.options.EnablePrivileges = $true
>>
>> gr /\/\o\/\/
>>
>>
>>
>> Alex K. Angelopoulos [MVP] wrote:
>>> Out-PropertyGrid?
>>> "/\/\o\/\/" <no@spam.mow> wrote in message
>>> news:Ogg9BMPgGHA.4464@TK2MSFTNGP04.phx.gbl...
>>>> Alex K. Angelopoulos [MVP] wrote:
>>>>> How do we set security (privileges, impersonation, authentication
>>>>> level) with Get-WMIObject?
>>>>>
>>>>> I'm working on some method invocations that need to acquire non-default
>>>>> privileges (e.g., Win32_OperatingSystem's Win32_Shutdown when
>>>>> performing any action but a logoff) and it isn't immediately apparent
>>>>> how to change privileges.
>>>> I can't come up with a native way,
>>>>
>>>> I use the Managementscope :
>>>>
>>>> try :
>>>>
>>>> $ms = new-object management.managementscope | out-Propertygrid
>>>>
>>>> and open the options tree.
>>>>
>>>> Greetings /\/\o\/\/
>>>>
>>>> for out-PropertyGid :
>>>>
>>>> http://mow001.blogspot.com/2006/04/p...-msh-view.html
>>>> (yep I misnamed the post)
>

Alex,
this is working for me :

$ms = new management.managementscope
$ms.Options.EnablePrivileges = $true

$mp.classname = 'win32_operatingsystem'
$mp.NamespacePath = 'root\cimv2'
$mp.server = 'ServerName'

$ms.path = $mp

$mc = new management.managementclass($ms,$mp,(new
management.Objectgetoptions))

$mc.GetInstances() |% {$_.invokeMethod('shutdown',$null)}

Greetings /\/\o\/\/

"/\\/\\o\\/\\/" wrote:

> I did test in former betas,
> I will do some more testing
> later today.
>
>
> gr /\/\o\/\/
> Alex K. Angelopoulos [MVP] wrote:
> > Using the propertygrid script, I get a form with the process name shown in
> > the title bar and nothing else when I try something like this:
> > ov (get-process)[0]
> > I tried your approach directly, and I can enable privileges, but I still get
> > failures calling Win32_Shutdown due to lack of privileges. It's possible I
> > screwed up the privilege inheritance so I need to try it again. You've
> > successfully used this to make privileges work in PowerShell already, right?
> >
> >
> > "/\/\o\/\/" <no@spam.mow> wrote in message
> > news:u7BCDiWgGHA.5092@TK2MSFTNGP04.phx.gbl...
> >> Alex K. Angelopoulos [MVP] wrote:
> >>> Out-PropertyGrid?
> >> bit plugging of my own tools :
> >>
> >> http://mow001.blogspot.com/2006/04/p...-msh-view.html
> >>
> >> of course you can set it like this also :
> >>
> >> MowPS>$ms = new-object management.managementscope
> >> MowPS>$ms
> >>
> >> IsConnected Options Path
> >> ----------- -------
> >> ----
> >> False
> >> System.Management.ConnectionOptions \\.\root\cimv2
> >>
> >>
> >> MowPS>$ms.options
> >>
> >>
> >> Locale :
> >> Username :
> >> Password :
> >> Authority :
> >> Impersonation : Impersonate
> >> Authentication : Unchanged
> >> EnablePrivileges : False
> >> Context : {}
> >> Timeout : 10675199.02:48:05.4775807
> >>
> >> $ms.options.EnablePrivileges = $true
> >>
> >> gr /\/\o\/\/
> >>
> >>
> >>
> >> Alex K. Angelopoulos [MVP] wrote:
> >>> Out-PropertyGrid?
> >>> "/\/\o\/\/" <no@spam.mow> wrote in message
> >>> news:Ogg9BMPgGHA.4464@TK2MSFTNGP04.phx.gbl...
> >>>> Alex K. Angelopoulos [MVP] wrote:
> >>>>> How do we set security (privileges, impersonation, authentication
> >>>>> level) with Get-WMIObject?
> >>>>>
> >>>>> I'm working on some method invocations that need to acquire non-default
> >>>>> privileges (e.g., Win32_OperatingSystem's Win32_Shutdown when
> >>>>> performing any action but a logoff) and it isn't immediately apparent
> >>>>> how to change privileges.
> >>>> I can't come up with a native way,
> >>>>
> >>>> I use the Managementscope :
> >>>>
> >>>> try :
> >>>>
> >>>> $ms = new-object management.managementscope | out-Propertygrid
> >>>>
> >>>> and open the options tree.
> >>>>
> >>>> Greetings /\/\o\/\/
> >>>>
> >>>> for out-PropertyGid :
> >>>>
> >>>> http://mow001.blogspot.com/2006/04/p...-msh-view.html
> >>>> (yep I misnamed the post)
> >
>

Oops not enough coffee, missed a line

$mp = new management.managementpath

gr /\/\o\/\/

"/\/\o\/\/" wrote:

> Alex,
> this is working for me :
>
> $ms = new management.managementscope
> $ms.Options.EnablePrivileges = $true
>
> $mp.classname = 'win32_operatingsystem'
> $mp.NamespacePath = 'root\cimv2'
> $mp.server = 'ServerName'
>
> $ms.path = $mp
>
> $mc = new management.managementclass($ms,$mp,(new
> management.Objectgetoptions))
>
> $mc.GetInstances() |% {$_.invokeMethod('shutdown',$null)}
>
> Greetings /\/\o\/\/
>
> "/\\/\\o\\/\\/" wrote:
>
> > I did test in former betas,
> > I will do some more testing
> > later today.
> >
> >
> > gr /\/\o\/\/
> > Alex K. Angelopoulos [MVP] wrote:
> > > Using the propertygrid script, I get a form with the process name shown in
> > > the title bar and nothing else when I try something like this:
> > > ov (get-process)[0]
> > > I tried your approach directly, and I can enable privileges, but I still get
> > > failures calling Win32_Shutdown due to lack of privileges. It's possible I
> > > screwed up the privilege inheritance so I need to try it again. You've
> > > successfully used this to make privileges work in PowerShell already, right?
> > >
> > >
> > > "/\/\o\/\/" <no@spam.mow> wrote in message
> > > news:u7BCDiWgGHA.5092@TK2MSFTNGP04.phx.gbl...
> > >> Alex K. Angelopoulos [MVP] wrote:
> > >>> Out-PropertyGrid?
> > >> bit plugging of my own tools :
> > >>
> > >> http://mow001.blogspot.com/2006/04/p...-msh-view.html
> > >>
> > >> of course you can set it like this also :
> > >>
> > >> MowPS>$ms = new-object management.managementscope
> > >> MowPS>$ms
> > >>
> > >> IsConnected Options Path
> > >> ----------- -------
> > >> ----
> > >> False
> > >> System.Management.ConnectionOptions \\.\root\cimv2
> > >>
> > >>
> > >> MowPS>$ms.options
> > >>
> > >>
> > >> Locale :
> > >> Username :
> > >> Password :
> > >> Authority :
> > >> Impersonation : Impersonate
> > >> Authentication : Unchanged
> > >> EnablePrivileges : False
> > >> Context : {}
> > >> Timeout : 10675199.02:48:05.4775807
> > >>
> > >> $ms.options.EnablePrivileges = $true
> > >>
> > >> gr /\/\o\/\/
> > >>
> > >>
> > >>
> > >> Alex K. Angelopoulos [MVP] wrote:
> > >>> Out-PropertyGrid?
> > >>> "/\/\o\/\/" <no@spam.mow> wrote in message
> > >>> news:Ogg9BMPgGHA.4464@TK2MSFTNGP04.phx.gbl...
> > >>>> Alex K. Angelopoulos [MVP] wrote:
> > >>>>> How do we set security (privileges, impersonation, authentication
> > >>>>> level) with Get-WMIObject?
> > >>>>>
> > >>>>> I'm working on some method invocations that need to acquire non-default
> > >>>>> privileges (e.g., Win32_OperatingSystem's Win32_Shutdown when
> > >>>>> performing any action but a logoff) and it isn't immediately apparent
> > >>>>> how to change privileges.
> > >>>> I can't come up with a native way,
> > >>>>
> > >>>> I use the Managementscope :
> > >>>>
> > >>>> try :
> > >>>>
> > >>>> $ms = new-object management.managementscope | out-Propertygrid
> > >>>>
> > >>>> and open the options tree.
> > >>>>
> > >>>> Greetings /\/\o\/\/
> > >>>>
> > >>>> for out-PropertyGid :
> > >>>>
> > >>>> http://mow001.blogspot.com/2006/04/p...-msh-view.html
> > >>>> (yep I misnamed the post)
> > >
> >

That works perfectly. Here's a generic function based on what you did that
works for shutdown/poweroff/reboot/logoff; I've modified the code a bit,
mostly using the full names of cmdlets and recasing .NET class names:

function Stop-Computer
{
Param([string]$Computer = ".",[int]$State = 0)
$mp = New-Object System.Management.ManagementPath
$mp.Classname = 'Win32_OperatingSystem'
$mp.NamespacePath = 'root/cimv2'
$mp.Server = $Computer
$ms = New-Object System.Management.ManagementScope
$ms.Options.EnablePrivileges = $true
$ms.Path = $mp
$mc = New-Object System.Management.ManagementClass `
$ms,$mp,(New-Object System.Management.ObjectGetOptions)
$mc.GetInstances() |
ForEach-Object {$_.InvokeMethod("Win32Shutdown", $State)}
}






"/\/\o\/\/" <o@discussions.microsoft.com> wrote in message
news:B33A3C46-B4EF-4687-9FCD-18EFA176393D@microsoft.com...
> Oops not enough coffee, missed a line
>
> $mp = new management.managementpath
>
> gr /\/\o\/\/
>
> "/\/\o\/\/" wrote:
>
>> Alex,
>> this is working for me :
>>
>> $ms = new management.managementscope
>> $ms.Options.EnablePrivileges = $true
>>
>> $mp.classname = 'win32_operatingsystem'
>> $mp.NamespacePath = 'root\cimv2'
>> $mp.server = 'ServerName'
>>
>> $ms.path = $mp
>>
>> $mc = new management.managementclass($ms,$mp,(new
>> management.Objectgetoptions))
>>
>> $mc.GetInstances() |% {$_.invokeMethod('shutdown',$null)}
>>
>> Greetings /\/\o\/\/
>>
>> "/\\/\\o\\/\\/" wrote:
>>
>> > I did test in former betas,
>> > I will do some more testing
>> > later today.
>> >
>> >
>> > gr /\/\o\/\/
>> > Alex K. Angelopoulos [MVP] wrote:
>> > > Using the propertygrid script, I get a form with the process name
>> > > shown in
>> > > the title bar and nothing else when I try something like this:
>> > > ov (get-process)[0]
>> > > I tried your approach directly, and I can enable privileges, but I
>> > > still get
>> > > failures calling Win32_Shutdown due to lack of privileges. It's
>> > > possible I
>> > > screwed up the privilege inheritance so I need to try it again.
>> > > You've
>> > > successfully used this to make privileges work in PowerShell already,
>> > > right?
>> > >
>> > >
>> > > "/\/\o\/\/" <no@spam.mow> wrote in message
>> > > news:u7BCDiWgGHA.5092@TK2MSFTNGP04.phx.gbl...
>> > >> Alex K. Angelopoulos [MVP] wrote:
>> > >>> Out-PropertyGrid?
>> > >> bit plugging of my own tools :
>> > >>
>> > >> http://mow001.blogspot.com/2006/04/p...-msh-view.html
>> > >>
>> > >> of course you can set it like this also :
>> > >>
>> > >> MowPS>$ms = new-object management.managementscope
>> > >> MowPS>$ms
>> > >>
>> > >> IsConnected Options Path
>> > >> ----------- -------
>> > >> ----
>> > >> False
>> > >> System.Management.ConnectionOptions \\.\root\cimv2
>> > >>
>> > >>
>> > >> MowPS>$ms.options
>> > >>
>> > >>
>> > >> Locale :
>> > >> Username :
>> > >> Password :
>> > >> Authority :
>> > >> Impersonation : Impersonate
>> > >> Authentication : Unchanged
>> > >> EnablePrivileges : False
>> > >> Context : {}
>> > >> Timeout : 10675199.02:48:05.4775807
>> > >>
>> > >> $ms.options.EnablePrivileges = $true
>> > >>
>> > >> gr /\/\o\/\/
>> > >>
>> > >>
>> > >>
>> > >> Alex K. Angelopoulos [MVP] wrote:
>> > >>> Out-PropertyGrid?
>> > >>> "/\/\o\/\/" <no@spam.mow> wrote in message
>> > >>> news:Ogg9BMPgGHA.4464@TK2MSFTNGP04.phx.gbl...
>> > >>>> Alex K. Angelopoulos [MVP] wrote:
>> > >>>>> How do we set security (privileges, impersonation, authentication
>> > >>>>> level) with Get-WMIObject?
>> > >>>>>
>> > >>>>> I'm working on some method invocations that need to acquire
>> > >>>>> non-default
>> > >>>>> privileges (e.g., Win32_OperatingSystem's Win32_Shutdown when
>> > >>>>> performing any action but a logoff) and it isn't immediately
>> > >>>>> apparent
>> > >>>>> how to change privileges.
>> > >>>> I can't come up with a native way,
>> > >>>>
>> > >>>> I use the Managementscope :
>> > >>>>
>> > >>>> try :
>> > >>>>
>> > >>>> $ms = new-object management.managementscope | out-Propertygrid
>> > >>>>
>> > >>>> and open the options tree.
>> > >>>>
>> > >>>> Greetings /\/\o\/\/
>> > >>>>
>> > >>>> for out-PropertyGid :
>> > >>>>
>> > >>>> http://mow001.blogspot.com/2006/04/p...-msh-view.html
>> > >>>> (yep I misnamed the post)
>> > >
>> >