Results 1 to 2 of 2

Thread: Reading remote registry with WMI returns no results

  1. #1

    Thread Starter
    Fanatic Member
    Join Date
    Apr 2006
    Posts
    746

    Reading remote registry with WMI returns no results

    I am trying to read the HKEY_USERS hive of a remote machine with this Class

    Code:
        
    Imports System.Management
    Imports System.Management.Instrumentation
    
    
    Public Enum RegHive As UInteger
        HKEY_CLASSES_ROOT = &H80000000UI
        HKEY_CURRENT_USER = &H80000001UI
        HKEY_LOCAL_MACHINE = &H80000002UI
        HKEY_USERS = &H80000003UI
        HKEY_CURRENT_CONFIG = &H80000005UI
    End Enum
    
    Public Enum RegType
        REG_SZ = 1
        REG_EXPAND_SZ = 2
        REG_BINARY = 3
        REG_DWORD = 4
        REG_MULTI_SZ = 7
    End Enum
    Public Class RemoteRegistry
        Implements IDisposable
        Friend Shared mc As ManagementClass
    
        Public Sub New(target As String)
            Dim options As New ConnectionOptions()
            options.Impersonation = ImpersonationLevel.Impersonate
            options.EnablePrivileges = True
            If My.Settings.WMIUsingAlternateCredentials Then
                options.Username = My.Settings.WMIUserID
                options.Password = My.Settings.WMIPassword
            End If
    
            Dim myScope As New ManagementScope("\\" & target & "\root\default", options)
            Dim mypath As New ManagementPath("StdRegProv")
            mc = New ManagementClass(myScope, mypath, Nothing)
        End Sub
    
    Public Function EnumKeys(hDefKey As RegHive, sSubKeyName As String) As String()
    
            Dim retval As String()
            Dim inParams As ManagementBaseObject = mc.GetMethodParameters("EnumKey")
            Dim outParams As ManagementBaseObject
    
            inParams("hDefKey") = hDefKey
            inParams("sSubKeyName") = sSubKeyName
            outParams = mc.InvokeMethod("EnumKey", inParams, Nothing)
            retval = DirectCast(outParams.Properties("sNames").Value, String())
            
            Return retval
        End Function
    End Class
    The value of sSubKeyName is the user's SID + "\" + Network (e.g. S-1-5-21-1606980848-2025429265-839522115-560021\Network). Now under that key are various subkeys containing mapped drive letters. But it never returns anything.

    Strangely, if I use the OpenRemoteBaseKey method it works BUT I don't want to use that because using WMI lets me specify alternate credentials and OpenRemoteBaseKey doesn't

    Any ideas?
    ManagePC - the all-in-one PC management and inventory tool

  2. #2
    Lively Member
    Join Date
    Apr 2006
    Posts
    68

    Re: Reading remote registry with WMI returns no results

    G'd evening Ginolard,
    I don't use to work with WMI, but i know that if you want to have access to the registry, all your machines must have running the remote registry service and the remote administration.
    Having said that. WMI is not the only tool that can let you impersonate, the System.Security.Permissions class let you do just that.
    G'd luck

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width