• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 858
  • Last Modified:

Lock down WMI information

We have a company that wants to monitor primarly security events and etc of all servers in our domain.
They also want to pull all WMI information from all the servers and send to their appliance\application\server.

I want to know is there a way to filter what WMI information they get on our servers, and limit to only what they need. security event logs. I do not want them to have all WMI information.
Can we filter this to only the service account we create
Can we do this via a GPO
I need help restricting this company of what WMI information they see on our servers.
I dont want them seeing everything.
Thanks in advance


0
Indyrb
Asked:
Indyrb
3 Solutions
 
Psy053Commented:
Rather than allowing them any access to extract the data, could you look at simply providing them the "relevant" data?

0
 
AJRDevCommented:
WMI security is provided at the namespace level. Event log data is provided by the Win32_NTLogEventLog WMI class which is in the root/cimv2 namespace. You can set a security descriptor (with a user account) on the namepace, but not at the level of the class. And even if you could, that would apply to all event logs and not just the security log.

I think the only way to do what you want is as Psy053 says, proxy the access on the external company's behalf. You could write whatever WMI query(s) you like and wrap that up in some sort of IPC mechanism - perhaps a web service.
0
 
IndyrbAuthor Commented:
The system that they use, pulls the information automatically per say. So me handing off only relevant data, would probably be a huge feat.

I am confused. How would you set a security descriptor on a namespace and tie it to a user account.
I am new to WMI so I need further explanation.
Thank you
0
What Security Threats Are We Predicting for 2018?

Cryptocurrency, IoT botnets, MFA, and more! Hackers are already planning their next big attacks for 2018. Learn what you might face, and how to defend against it with our 2018 security predictions.

 
AJRDevCommented:
1. Open the Computer Management MMC from Control Panel/Administrative Tools
2. Connect to whichever computer you want.
3. Expand the Services and Applications node, right click WMI Control and select Properties.
4. Expand the root node and select the CIMV2 node.
5. Click the Security button and set the user permissions you need.
0
 
IndyrbAuthor Commented:
Can you do this via a GPO?
0
 
AJRDevCommented:
Good article on MSDN about how to do this:
http://blogs.msdn.com/b/spatdsg/archive/2007/11/21/set-wmi-namespace-security-via-gpo-script.aspx

I've tried it and it works perfectly..
0
 
Ted BouskillSenior Software DeveloperCommented:
Pulling the information for them is trivial using a free tool called Log Parser from Microsoft or using PowerShell.  If their application lacks flexibility it might not be able to handle the permission denied response if the do lock the other logs from them.
0

Featured Post

A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now