WBEM Permission Editor

The WBEM Permission Editor allows you to set the access privileges for authorized WBEM users. Use this application to manage user authentication and access to CIM objects for WBEM.

To open the WBEM Permission Editor

  1. Click Start and then Run.
  2. Type \WINNT\System32\wbem\wbemperm.exe and click OK.

The following topics describe how to use the WBEM Permission Editor:

Managing WBEM Security on Windows 2000

Adding Users

Editing Users

Deleting Users

Adding Groups

Editing Groups

Deleting Groups


Managing WBEM Security on Windows 2000

The WBEM Permission Editor can be used in conjunction with the Windows 2000 User Manager to create user accounts and groups that provide the following security:

  • User authentication for both local and remote logins
  • Permissions for both local and remote access to CIM objects

Windows 2000 systems include two built-in groups that can be used to manage WBEM security:

  • The local Windows 2000 Administrators group

    All users who belong to this group have full local and remote access to the Windows Management (WinMgmt). Full access means read/write/delete access to all CIM objects in all namespaces (including ROOT\SECURITY). Users with access to ROOT\SECURITY can change security information.

  • A local Windows 2000 Users group

    This group is created immediately after installing WBEM, when Windows Management starts. By default, this group provides read-only access to all namespaces except ROOT\SECURITY.

You can manage most access to Windows Management by controlling the membership of these two groups using the Windows 2000 User Manager.

You can use the WBEM Permission Editor to create groups with combinations of permissions different from those provided by the built-in groups. You can also create individual users, if needed.


Adding Users

To add a user

  1. Click the Add User button.

    —or—

    Select Add New User from the User menu. The User Properties dialog box appears:

  2. Type the User Name and the Domain name where the user's account resides. User names must be unique and cannot be shared with group names. If you do not specify a domain name, a "period" is entered which designates the current workstation.
  3. Under Attributes, select all applicable access privileges for the user:

    Enabled

    Accounts are enabled by default. When this option is not selected, the account is disabled. A login is not permitted against a disabled account.

    Execute Methods

    Allows the user to execute object methods exported from the CIM Object Manager.

    Schema Access Level

    Select one of the following access levels:

    Read Only

    Allows read-only access to CIM schema objects. Users with this privilege can execute queries or retrieve instances and classes, but cannot create, delete, or modify CIM objects.

    Write Instance

    Allows full read/write/delete access to instances. Users with this privilege have read-only access to classes.

    Write Class

    Allows full read/write/delete access to all CIM objects, classes, and instances.

  4. Under Security, select Edit Security if you want to give the user read/write access to the ROOT\SECURITY namespace. Users with this privilege can edit security information. Users without this privilege have no access to ROOT\SECURITY.
  5. Click OK. This returns you to the WBEM Permission Editor window. The new user appears in the list of users in the top portion of the window.
  6. Select Save changes from the User menu to save the changes and remain in the WBEM Permission Editor.


Editing Users

To edit a user's properties

  1. Double-click the user you want to edit.

    —or—

    Select the user you want to edit, then choose Edit User Properties from the User menu.

  2. In the User Properties dialog box, make the desired changes. You can edit all properties except the user name and domain.
  3. Click OK to return to the WBEM Permission Editor window.
  4. Select Save changes from the User menu to save the changes and remain in the WBEM Permission Editor.


Deleting Users

To delete a user

  1. Select the user you want to delete.
  2. Click Delete User or select Delete User from the User menu.
  3. Select Save changes from the User menu to save the changes and remain in the WBEM Permission Editor.


Adding Groups

On Windows 2000 systems, WBEM users can be combined into groups. Groups have access privileges that are granted to all users who are members of the group. For example, if a user has read-only permissions, and belongs to a group with read-write permissions, then the user has read-write permissions.

Note

  • Groups can only be created on Windows NT/Windows 2000 systems.

To add a group

  1. Click Add Group or select Add New Group from the User menu. The Group Properties dialog box appears:
  2. In the Group Properties dialog box, type the Group Name. Group names must be unique and cannot be shared with user names.
  3. Under Attributes, select the access privileges for the group. See Adding Users for a description of these privileges.
  4. Under Security, select Edit Security if you want to give the group read/write access to the ROOT\SECURITY namespace. Groups with this privilege can edit security information. Groups without this privilege have no access to ROOT\SECURITY.
  5. Select one of the following group types:

    NTLM Local

    Creates a local NT group (a group that can be used only in its own workstation).

    NTLM Global

    Create a domain global group (a group that can be used in its own domain, member servers and workstations of the domain, and trusting domains). You must also specify the domain name.

  6. Click OK to return to the WBEM Permission Editor window.
  7. Select Save changes from the User menu to save the changes and remain in the WBEM Permission Editor.

You can add members to the newly-created group by using the Windows 2000 User Manager.


Editing Groups

To edit a group's properties

  1. Double-click the group you want to edit.

    —or—

    Select the group you want to edit, then choose Edit Group Properties from the User menu.

  2. In the Group Properties dialog box, make the desired changes. You can edit all properties except the group name and the domain name.
  3. Click OK to return to the WBEM Permission Editor.
  4. Select Save changes from the User menu to save the changes and remain in the WBEM Permission Editor.


Deleting Groups

To delete a group

  1. Select the group you want to delete.
  2. Click the Delete Group button or select Delete Group from the User menu.
  3. Select Save changes from the User menu to save the changes and remain in the WBEM Permission Editor.