WMI Control overview

The WMI (Windows Management Instrumentation) Control is a tool that enables you to configure WMI settings on a remote computer or local computer. Using the WMI Control, you can:

Authorize users or groups and set permission levels

You can authorize a user or a group to access and perform WMI tasks and services. For each user or group you authorize, you set their permission level for specific namespaces. For example, you can enable a group to manage the CIM objects on their local computers.

Configure error logging

You can turn error logging on or off and, if turned on, set it to report errors only (the default) or all actions (verbose). Error logging can help you troubleshoot WMI problems. You can also define a maximum size for log files and their folder location.

Back up the repository

You can configure the WMI control to back up your repository on a regularly scheduled basis, or you can do it manually at any time. The repository is the database of objects that can be accessed through WMI. You can also restore a previous version of the repository.

Change the default namespace for scripting

You can change the default namespace that is targeted in WMI scripts.

Connect as a different user

You can log on under a different user name to change WMI Control settings. For example, if you have defined an administrative user account on several workstations, you can connect to those workstations under that user name.


Connect to a different computer

To connect to a different computer

  1. On the General tab, Click Change.
  2. In the Change managed computer dialog box, click Another computer.
  3. Type the name of the computer to which you want to connect, and then click OK.

Notes

  • You must be an administrator or a member of the Administrators group on the computer you are managing, or have been given appropriate permissions, in order to perform this task.
  • You can connect as a different user when you connect to a remote computer. To access a remote computer, click Change on the Change managed computer dialog box, clear the Log on as current user check box, and then type a name and password.


Connect as a different user

To connect as a different user

  1. On the General tab, click Change.
  2. In the Change managed computer dialog box, click Another computer, then type the name of the computer to which you want to connect.
  3. Click Change.
  4. In the WMI Logon dialog box, clear the Log on as current user check box.
  5. Type the user name and password for the user you want to connect as.

Note

  • You can connect as a different user to remote computers only. You cannot connect to your local computer as a different user using Windows Management services.


Turn WMI error logging on or off

To turn WMI error logging on or off

  1. Click the Logging tab.
  2. Under Logging level, click Disabled to turn logging off. Click either Errors only or Verbose to turn it on.

Notes

  • Errors only reports errors that occur within WMI. Verbose reports all actions and errors.
  • Verbose logging can negatively impact system performance, so select Verbose only when you need more extensive information about the events leading to errors.
  • Log files are maintained for the WMI core and framework, as well as for each WMI-enabled provider.
  • You can set the maximum size for log files under Maximum size. When a log file has reached the maximum size, it is renamed with the extension .Lo_, and a new log file is created with the extension .Log. When that file reaches the defined maximum size, the first file is deleted and the process is repeated.
  • You can set logging levels on a remote computer if you have the appropriate permissions. To access a remote computer, click the General tab, click Change, click Another computer, and then type the name of the computer to which you want to connect.
  • It is recommended that you include log files when reporting issues associated with WMI services.


Specify the interval between repository backups

To specify the interval between repository backups

  1. Click the Backup/Restore tab.
  2. Select the Automatically back up every check box, and then type the period of time you want Windows Management services to wait between performing backups.
  3. Click the arrow to set the time frame (minutes or hours).

Notes

  • The maximum interval between automatic backups is 24 hours. If you use minutes, the maximum is 999 minutes. The minimum interval is 5 minutes. You can use only whole numbers with either hours or minutes.
  • Click the Back Up Now button to back up the repository manually. You can back up to a specified file name, and later restore from that saved file. This can be useful if you want to save a specific configuration of classes.
  • You can specify backup intervals on a remote computer if you have the appropriate permissions. To access a remote computer, click the General tab, click Change, click Another computer, and then type the name of the computer to which you want to connect.
  • If the computer you are managing is running a previous version of WMI, the Time of last backup feature will not be available.


Change the WMI scripting settings

To change the WMI scripting settings

  1. Click the Advanced tab.
  2. Under Default namespace for scripting, click Change.
  3. In the Browser for Namespace dialog box, select a different default namespace as a target for your scripts.

Notes

  • Set the default targeted namespace to one you use most often in your WMI scripts. If no namespace is identified within a script, the default will be used.
  • If the computer you are managing is running Windows NT 4.0, you can define whether WMI scripts can be run from within Active Server Pages (ASP). If you enable the option, your ASP will always connect to Windows Management services using the process level identity of Internet Information Services, which may compromise security.
  • You can change the scripting namespace on a remote computer if you have the appropriate permissions. To access a remote computer, click the General tab, click Change, click Another computer, and then type the name of the computer to which you want to connect.


Managing WMI security

WMI (Windows Management Instrumentation) supports a limited form of security that validates each user before the user is allowed to connect to WMI, on either the local computer or a remote computer. This security is another layer on top of the security that already exists for the operating system. WMI does not override or circumvent any existing security provided by the operating system.

By default, all members of the Administrators group have full control of the WMI services on the computer that is being managed. All others have read/write/execute permissions on their local computer only.

Permissions can be changed, either by adding a user to the Administrators group on the managed computer, or by authorizing users or groups in WMI and setting their permission level. Access is based on WMI namespaces.

On computers running Windows 95 or Windows 98, all users have full control locally. However, permissions can be set for users managing a Windows 95 or Windows 98 computer remotely.

Security is checked only when a user connects to the Windows Management service. Thus, any changes made to a user's permissions while the user is connected will not take effect until the next time the user starts the WMI service. For example, if a user's access is revoked, the changes would not take effect until the user exits from WMI and attempts to connect to the service again.


Authorize WMI users and set permissions

To authorize WMI users and set permissions

  1. Click the Security tab.
  2. Select the namespace for which you want to give a user or group access, and then click Security.
  3. In the Security dialog box, click Add.
  4. Perform one of the following steps:
    • If you are setting permissions on a local computer, in the Select Users, Computers, or Groups dialog box, in Look in, select the domain containing the user or group you want to add. Then, in the Name list, double-click the name of the user or group you want to add, or type the name in the lower box, and click OK.
    • If you are setting permissions on a remote computer, in the Add User dialog box, type the name of the user or group you want to add, and then click OK.
  5. In the Security dialog box, under Permissions, select the permissions to allow or deny the new user or group.
    6. Level | Description
Enable | Allows read access to objects within the namespace.
Execute Methods | Allows object methods exported from the CIM Object Manager to be run.
Full Control | Allows full read/write/delete access to all CIM objects, classes, and instances.
Partial Write | Allows write access to static objects in the repository.
Provider Write | Allows write access to objects that are provided by the provider.
Read Security | Allows read-only access to WMI security information.
Edit Security | Allows read/write access to WMI security information.
Remote Access | Grants a remote computer the same rights that are allowed when connecting from a local computer.

Notes

  • You can set permissions on a remote computer as well as on your local computer. To access a remote computer, click the General tab, click Change, click Another computer, and then type the name of the computer to which you want to connect.
  • On computers running Windows 95 or Windows 98, all users have full control locally. Security settings are only relevant for remote connection to a computer running Windows 95 or Windows 98.
  • Windows 95 and Windows 98 do not recognize groups, so permissions must be set for each individual user.
  • You can delete a user's or group's authorization to access WMI services by selecting that user or group and then clicking Remove.
  • On computers running Windows NT 4.0, you can click Advanced on the Security dialog box to set special permissions.
  • To add users to a group, use Windows 2000 Local Users and Groups.


Modify permissions or delete authorized users

To modify permissions or delete authorized users

  1. Click the Security tab.
  2. Select the namespace for which you want to change a user's or group's permissions or delete a user or group, and then click Security.
  3. In the Security dialog box, under Name, select the user or group you want to remove or whose permissions you want to modify.
  4. Perform one of the following steps:
    • To remove the user or group, click Remove.
    • To change security settings, under Permissions, modify the permissions which are allowed or denied to the user or group by clearing or selecting the appropriate check boxes.

Notes

  • You must be an administrator or a member of the Administrators group on the computer you are managing, or have been given appropriate permissions, in order to perform this task.
  • WMI security is checked only when a user logs on to Windows Management services. Thus, any changes made to a user's permissions while the user is connected will not take effect until the next time the user logs on to WMI. For example, if a user's access is revoked, the changes would not take effect until the user logs off Windows Management services and attempts to log on again.
  • You can modify user or group permissions on a remote computer as well as your local computer. To access a remote computer, click the General tab, click Change, click Another computer, and then type the name of the computer to which you want to connect.