Reading remote registry with WMI returns no results
I am trying to read the HKEY_USERS hive of a remote machine with this Class
Code:
Imports System.Management
Imports System.Management.Instrumentation
Public Enum RegHive As UInteger
HKEY_CLASSES_ROOT = &H80000000UI
HKEY_CURRENT_USER = &H80000001UI
HKEY_LOCAL_MACHINE = &H80000002UI
HKEY_USERS = &H80000003UI
HKEY_CURRENT_CONFIG = &H80000005UI
End Enum
Public Enum RegType
REG_SZ = 1
REG_EXPAND_SZ = 2
REG_BINARY = 3
REG_DWORD = 4
REG_MULTI_SZ = 7
End Enum
Public Class RemoteRegistry
Implements IDisposable
Friend Shared mc As ManagementClass
Public Sub New(target As String)
Dim options As New ConnectionOptions()
options.Impersonation = ImpersonationLevel.Impersonate
options.EnablePrivileges = True
If My.Settings.WMIUsingAlternateCredentials Then
options.Username = My.Settings.WMIUserID
options.Password = My.Settings.WMIPassword
End If
Dim myScope As New ManagementScope("\\" & target & "\root\default", options)
Dim mypath As New ManagementPath("StdRegProv")
mc = New ManagementClass(myScope, mypath, Nothing)
End Sub
Public Function EnumKeys(hDefKey As RegHive, sSubKeyName As String) As String()
Dim retval As String()
Dim inParams As ManagementBaseObject = mc.GetMethodParameters("EnumKey")
Dim outParams As ManagementBaseObject
inParams("hDefKey") = hDefKey
inParams("sSubKeyName") = sSubKeyName
outParams = mc.InvokeMethod("EnumKey", inParams, Nothing)
retval = DirectCast(outParams.Properties("sNames").Value, String())
Return retval
End Function
End Class
The value of sSubKeyName is the user's SID + "\" + Network (e.g. S-1-5-21-1606980848-2025429265-839522115-560021\Network). Now under that key are various subkeys containing mapped drive letters. But it never returns anything.
Strangely, if I use the OpenRemoteBaseKey method it works BUT I don't want to use that because using WMI lets me specify alternate credentials and OpenRemoteBaseKey doesn't
Any ideas?
Re: Reading remote registry with WMI returns no results
G'd evening Ginolard,
I don't use to work with WMI, but i know that if you want to have access to the registry, all your machines must have running the remote registry service and the remote administration.
Having said that. WMI is not the only tool that can let you impersonate, the System.Security.Permissions class let you do just that.
G'd luck