First – Setting done from Active Directory

Open the Active Directory Administrative Center:

• Go to APMCLU -> Users
  
• Right-click and select New -> User
  
• Create the user as a normal user and ways User UPN logon to wmiuser@APMCLU.COM
• Make sure Member of is set to Domain Users so that the user is in a valid group.
  

1 – Create the Group Policy Object

Open Group Policy Management:

• Create a new GPO and name it WMI Access
  
• Link it to APMCLU.COM domain (drag and drop it on APMCLU.COM)
  
• Make sure that the GPO will be applied to all machines in the domain to be scanned (WMI adjust Security Filtering, etc.)
  

2 – Settings GPO

DCOM

• Right-click WMI Access (which is the GPO we just created), select Edit
  
• Go to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options
  
• Select Properties at DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax
  
• Check the Define this policy setting
  
• Select Edit Security …
  
• Click Add …
  
• Under Enter the object names to select: Enter APMCLU\wmiuser and click Check Names. The user is now filled in automatically
  
• Click OK
  
• Select wmiuser (wmiuser@apmclu.com)
  
• Under Permissions: Tick Allow on both Local Access and Remote Access
  
• Click OK
  
• Click OK
  
• Select Properties under: DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax
  
• Check Define this policy setting
  
• Select Edit Security …
  
• Click Add …
  
• Under Enter the object names to select: Enter APMCLU\wmiuser and click Check Names. The user is now filled in automatically
  
• Click OK
  
• Select wmiuser (wmiuser@apmclu.com)
  
• Under Permissions: Tick Allow at Local Launch, Remote Launch, Local Activation, and Remote Activation
  
• Click OK
  
• Click OK
  

Firewall

• Right-click WMI Access (the GPO we just created), select Edit
  
• Go to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security
  
• In the right pane, expand Windows Firewall with Advanced Security until Inbound Rules visible. Right-click on it
  
• Choose New Rule …
  
• Select Predefined and Windows Management Instrumentation (WMI) in the list
  
• Click Next
  
• Tick all the Windows Management Instrumentation-rules in the list (usually 3 pieces)
  
• Click Next
  
• Select Allow The Connection
  
• Click Finish
  

3 – Rights for WMI namespace

These settings can not be done with regular GPO. For a user who is not Admin this step is critical and must be done exactly as instructed below. If not properly done, login attempts via WMI result in Access Denied.

• Write wmimgmt.msc in command prompt
  
• Right-click WMI Control, and select Properties
  
• Select the Security tab
  
• Select Root of the tree and click on Security
  
• Click Add …
  
• Under Enter the object names to select: Enter APMCLU\wmiuser and click Check Names. The user is now filled in automatically
  
• Click OK
  
• Select wmiuser (wmiuser@apmclu.com)
  
• Select Allow for Execute Methods, Enable Account, Remote Enable and Read Security under Permissions for wmiuser
  
• Mark wmiuser and click Advanced
  
• Under the Permission tab: Select wmiuser
  
• Click Edit
  
• Under Applies To-list: Choose This namespace and all subnamespaces. It is very important that the rights are applied recursively down the entire tree!
  
• Click OK
  
• Click OK
  
• Click OK
  
• Click OK
  

Second – Settings did on each machine

4 – Verify

On the machines, make sure that the GPO is applied. To force an update:

• In a command prompt: type gpupdate /force
  
• Ensure that the GPO is applied: Enter gpresult /r
  
• Under COMPUTER SETTINGS in the printout, look for WMI Access (the GPO we created) under the Applied Group Policy Objects. If it is listed there, it means that it is applied to the machine.

5 – Additional Information

We recommend turning off UAC filtering on the target machines. It can be done by setting a registry key manually or through a GPO.

UAC can in some cases filter information through WMI so that the information is not as complete as it could be. Usually, you do not need to do this step, but if the information is missing, do the following on the target machine:

• Open regedit
  
• Add or edit the DWORD* key:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\LocalAccountTokenFilterPolicy *to 1*
  

• Close regedit
  

0 = Remote UAC access token filtering is enabled.