|
-
Feb 9th, 2012, 08:44 AM
#1
Thread Starter
Fanatic Member
Reading remote registry with WMI returns no results
I am trying to read the HKEY_USERS hive of a remote machine with this Class
Code:
Imports System.Management
Imports System.Management.Instrumentation
Public Enum RegHive As UInteger
HKEY_CLASSES_ROOT = &H80000000UI
HKEY_CURRENT_USER = &H80000001UI
HKEY_LOCAL_MACHINE = &H80000002UI
HKEY_USERS = &H80000003UI
HKEY_CURRENT_CONFIG = &H80000005UI
End Enum
Public Enum RegType
REG_SZ = 1
REG_EXPAND_SZ = 2
REG_BINARY = 3
REG_DWORD = 4
REG_MULTI_SZ = 7
End Enum
Public Class RemoteRegistry
Implements IDisposable
Friend Shared mc As ManagementClass
Public Sub New(target As String)
Dim options As New ConnectionOptions()
options.Impersonation = ImpersonationLevel.Impersonate
options.EnablePrivileges = True
If My.Settings.WMIUsingAlternateCredentials Then
options.Username = My.Settings.WMIUserID
options.Password = My.Settings.WMIPassword
End If
Dim myScope As New ManagementScope("\\" & target & "\root\default", options)
Dim mypath As New ManagementPath("StdRegProv")
mc = New ManagementClass(myScope, mypath, Nothing)
End Sub
Public Function EnumKeys(hDefKey As RegHive, sSubKeyName As String) As String()
Dim retval As String()
Dim inParams As ManagementBaseObject = mc.GetMethodParameters("EnumKey")
Dim outParams As ManagementBaseObject
inParams("hDefKey") = hDefKey
inParams("sSubKeyName") = sSubKeyName
outParams = mc.InvokeMethod("EnumKey", inParams, Nothing)
retval = DirectCast(outParams.Properties("sNames").Value, String())
Return retval
End Function
End Class
The value of sSubKeyName is the user's SID + "\" + Network (e.g. S-1-5-21-1606980848-2025429265-839522115-560021\Network). Now under that key are various subkeys containing mapped drive letters. But it never returns anything.
Strangely, if I use the OpenRemoteBaseKey method it works BUT I don't want to use that because using WMI lets me specify alternate credentials and OpenRemoteBaseKey doesn't
Any ideas?
ManagePC - the all-in-one PC management and inventory tool
-
Feb 16th, 2012, 08:05 PM
#2
Lively Member
Re: Reading remote registry with WMI returns no results
G'd evening Ginolard,
I don't use to work with WMI, but i know that if you want to have access to the registry, all your machines must have running the remote registry service and the remote administration.
Having said that. WMI is not the only tool that can let you impersonate, the System.Security.Permissions class let you do just that.
G'd luck
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
Click Here to Expand Forum to Full Width
|