3

I have a project to remove admin rights from our users. An application we use, during upgrades, runs a query against WMI:

Namespace: root\Microsoft\sqlserver\computermanagement10
Class: sqlserviceadvancedproperty

Since I've removed admin rights from the user, it fails to return any data when querying that namespace and class and thus fails the install saying the appriopriate SQL Server version is not installed.

I've attempted adding permissions to the namespace from top to bottom and no luck. If I add admin rights back to the user account on the device, the query works again.

I'm using powershell to test:

gwmi -namespace root\Microsoft\sqlserver\computermanagement10 -class sqlserviceadvancedproperty

When I run this without admin rights, it doesn't give an error or anything at all. It just returns null and drops me back to the command prompt. Ran with admin rights, I get a whole heap of data.

Does anyone have any idea what specific items in Windows a user needs access to in order to be able to query a specific WMI namespace?

  • As far as I can tell, these are the locations required for permission: C:\Windows\System32\WBEM; HKLM\SOFTWARE\Microsoft\WBEM; appropriate permissions within WMI Management (wmimgmt.msc). This information doesn't appear to help with my OP. I'm leaning toward other causes as I get no results from the same query while logged in as a local admin. – lightwing Jul 12 '16 at 13:04
  • Turns out I missed an account when adding permissions to the MSSQLSERVER service in my GPO. The built-in account "SERVICE" must have Read permission to the service or else you'll be unable to query that WMI class. If you do sc sdshow mssqlserver from a command line, the SDDL for "SERVICE" should look like this: (A;;CCLCSWLOCRRC;;;SU). If you ever have to deal with SDDL strings, I found these to be very helpful: blogs.msmvps.com/erikr/2007/09/26/… and msdn.microsoft.com/en-us/library/windows/desktop/… – lightwing Jul 13 '16 at 19:52
  • 1
    Please read Can I answer my own question?. You might want to convert your comment into an answer ;) – DavidPostill Aug 3 '16 at 21:15
2

As far as I can tell, these are the locations required for permission:

  • C:\Windows\System32\WBEM

  • HKLM\SOFTWARE\Microsoft\WBEM

  • appropriate permissions within WMI Management (wmimgmt.msc)

This information doesn't appear to help with my OP. I get no results from the same query while logged in as a local admin after verifying these.

Turns out I missed an account when adding permissions to the MSSQLSERVER service in my GPO. The built-in account "SERVICE" must have Read permission to the service or else you'll be unable to query that WMI class. If you do

sc sdshow mssqlserver 

from a command line, the SDDL for "SERVICE" should look like this:

(A;;CCLCSWLOCRRC;;;SU)

If you ever have to deal with SDDL strings, I found these to be very helpful:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.