WMI Access Denied Exception (Exception from HRESULT: 0x80041003)

[RK]

I get the following exception when I fire a management event. The code works
fine if I run as an ADMIN but the moment I switch to a local user, I get
this exception. Does anybody know how to fix this problem.

Thanks

Exception: System.Runtime.InteropServices.COMException
Message: Exception from HRESULT: 0x80041003.
Source: mscorlib
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32
errorCode, IntPtr errorInfo)
at System.Management.Instrumentation.EventSource..ctor(String
namespaceName, String appName, InstrumentedAssembly instrumentedAssembly)
at
System.Management.Instrumentation.InstrumentedAssembly.InitEventSource(Object
param)
at System.Management.Instrumentation.InstrumentedAssembly..ctor(Assembly
assembly, SchemaNaming naming)
at System.Management.Instrumentation.Instrumentation.Initialize(Assembly
assembly)
at
System.Management.Instrumentation.Instrumentation.GetInstrumentedAssembly(Assembly
assembly)
at System.Management.Instrumentation.Instrumentation.Fire(Object
eventData)

[Willy Denoyette [MVP]]

The generated mof file (see
system32\wbem\framework\root\your-provider-namespace ) doesn't include any
SecurityDescriptor attributes for the decoupled provider, that means that
only admins, NetworkService, Localservice and LocalSystem can register the
decoupled provider by calling IWbemDecoupledRegistrar:Register for the
decoupled provider (that's the call that fails in your case).
In order to let other users run the provider you will have to edit the mof
file as follows:

...
class MSFT_DecoupledProvider : __Win32Provider
{
string CLSID = "{..........some class GUID...........}";
uint32 Version = 1;
string HostingModel = "Decoupled:Com";
// Remove the SecurityDescriptor attribute here
};


class WMINET_ManagedAssemblyProvider : MSFT_DecoupledProvider
{
string Assembly;

};


instance of WMINET_ManagedAssemblyProvider
{
HostingModel = "Decoupled:Com";
Name = "yourEventProviderName";
// Add a security descriptor in SDDL format - see the Platform SDK for
correct format
// Here a sample that grants access to the intrinsic Users group
SecurityDescriptor = "O:BUG:BUD:(A;;0x1;;;BU)";
};
....

When done editing, save and run mofcomp.

Willy.

Post by RK
I get the following exception when I fire a management event. The code
works fine if I run as an ADMIN but the moment I switch to a local user, I
get this exception. Does anybody know how to fix this problem.
Thanks
Exception: System.Runtime.InteropServices.COMException
Message: Exception from HRESULT: 0x80041003.
Source: mscorlib
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32
errorCode, IntPtr errorInfo)
at System.Management.Instrumentation.EventSource..ctor(String
namespaceName, String appName, InstrumentedAssembly instrumentedAssembly)
at
System.Management.Instrumentation.InstrumentedAssembly.InitEventSource(Object
param)
at System.Management.Instrumentation.InstrumentedAssembly..ctor(Assembly
assembly, SchemaNaming naming)
at System.Management.Instrumentation.Instrumentation.Initialize(Assembly
assembly)
at
System.Management.Instrumentation.Instrumentation.GetInstrumentedAssembly(Assembly
assembly)
at System.Management.Instrumentation.Instrumentation.Fire(Object
eventData)

[Kishore Chaliparambil]

Oh Thanks.

Now I am trying to run the service as "NetworkService". I get an exception
when I try to delete performance counter. Is there a way to assign this
priviledge to the NetworkService account?

Exception: System.ComponentModel.Win32Exception
Message: Access is denied
Source: System
at System.Diagnostics.PerformanceCounterLib.RegisterFiles(String
machineName, String arg0, Boolean unregister)
at System.Diagnostics.PerformanceCounterLib.UnregisterCategory(String
machineName, String categoryName)
at System.Diagnostics.PerformanceCounterCategory.DeleteCategory(String
categoryName, String machineName)
at System.Diagnostics.PerformanceCounterCategory.Delete(String
categoryName)

Post by Willy Denoyette [MVP]
The generated mof file (see
system32\wbem\framework\root\your-provider-namespace ) doesn't include any
SecurityDescriptor attributes for the decoupled provider, that means that
only admins, NetworkService, Localservice and LocalSystem can register the
decoupled provider by calling IWbemDecoupledRegistrar:Register for the
decoupled provider (that's the call that fails in your case).
In order to let other users run the provider you will have to edit the mof
...
class MSFT_DecoupledProvider : __Win32Provider
{
string CLSID = "{..........some class GUID...........}";
uint32 Version = 1;
string HostingModel = "Decoupled:Com";
// Remove the SecurityDescriptor attribute here
};
class WMINET_ManagedAssemblyProvider : MSFT_DecoupledProvider
{
string Assembly;
};
instance of WMINET_ManagedAssemblyProvider
{
HostingModel = "Decoupled:Com";
Name = "yourEventProviderName";
// Add a security descriptor in SDDL format - see the Platform SDK for
correct format
// Here a sample that grants access to the intrinsic Users group
SecurityDescriptor = "O:BUG:BUD:(A;;0x1;;;BU)";
};
....
When done editing, save and run mofcomp.
Willy.

Post by RK
I get the following exception when I fire a management event. The code
works fine if I run as an ADMIN but the moment I switch to a local user, I
get this exception. Does anybody know how to fix this problem.
Thanks
Exception: System.Runtime.InteropServices.COMException
Message: Exception from HRESULT: 0x80041003.
Source: mscorlib
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32
errorCode, IntPtr errorInfo)
at System.Management.Instrumentation.EventSource..ctor(String
namespaceName, String appName, InstrumentedAssembly instrumentedAssembly)
at
System.Management.Instrumentation.InstrumentedAssembly.InitEventSource(Object
param)
at
System.Management.Instrumentation.InstrumentedAssembly..ctor(Assembly
assembly, SchemaNaming naming)
at
System.Management.Instrumentation.Instrumentation.Initialize(Assembly
assembly)
at
System.Management.Instrumentation.Instrumentation.GetInstrumentedAssembly(Assembly
assembly)
at System.Management.Instrumentation.Instrumentation.Fire(Object
eventData)

[Willy Denoyette [MVP]]

NetworkService has only read permission on the registry path for perflib,
so you'll need to give Delete permission to NetworkService.
Note that elevating local pseudo accounts permissions is in general a bad
idea, better would be to create a delete your counters outside the Service.

Willy.

Post by Kishore Chaliparambil
Oh Thanks.
Now I am trying to run the service as "NetworkService". I get an exception
when I try to delete performance counter. Is there a way to assign this
priviledge to the NetworkService account?
Exception: System.ComponentModel.Win32Exception
Message: Access is denied
Source: System
at System.Diagnostics.PerformanceCounterLib.RegisterFiles(String
machineName, String arg0, Boolean unregister)
at System.Diagnostics.PerformanceCounterLib.UnregisterCategory(String
machineName, String categoryName)
at System.Diagnostics.PerformanceCounterCategory.DeleteCategory(String
categoryName, String machineName)
at System.Diagnostics.PerformanceCounterCategory.Delete(String
categoryName)

Post by Willy Denoyette [MVP]
The generated mof file (see
system32\wbem\framework\root\your-provider-namespace ) doesn't include
any SecurityDescriptor attributes for the decoupled provider, that means
that only admins, NetworkService, Localservice and LocalSystem can
register the decoupled provider by calling
IWbemDecoupledRegistrar:Register for the decoupled provider (that's the
call that fails in your case).
In order to let other users run the provider you will have to edit the
...
class MSFT_DecoupledProvider : __Win32Provider
{
string CLSID = "{..........some class GUID...........}";
uint32 Version = 1;
string HostingModel = "Decoupled:Com";
// Remove the SecurityDescriptor attribute here
};
class WMINET_ManagedAssemblyProvider : MSFT_DecoupledProvider
{
string Assembly;
};
instance of WMINET_ManagedAssemblyProvider
{
HostingModel = "Decoupled:Com";
Name = "yourEventProviderName";
// Add a security descriptor in SDDL format - see the Platform SDK for
correct format
// Here a sample that grants access to the intrinsic Users group
SecurityDescriptor = "O:BUG:BUD:(A;;0x1;;;BU)";
};
....
When done editing, save and run mofcomp.
Willy.

Post by RK
I get the following exception when I fire a management event. The code
works fine if I run as an ADMIN but the moment I switch to a local user,
I get this exception. Does anybody know how to fix this problem.
Thanks
Exception: System.Runtime.InteropServices.COMException
Message: Exception from HRESULT: 0x80041003.
Source: mscorlib
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32
errorCode, IntPtr errorInfo)
at System.Management.Instrumentation.EventSource..ctor(String
namespaceName, String appName, InstrumentedAssembly
instrumentedAssembly)
at
System.Management.Instrumentation.InstrumentedAssembly.InitEventSource(Object
param)
at
System.Management.Instrumentation.InstrumentedAssembly..ctor(Assembly
assembly, SchemaNaming naming)
at
System.Management.Instrumentation.Instrumentation.Initialize(Assembly
assembly)
at
System.Management.Instrumentation.Instrumentation.GetInstrumentedAssembly(Assembly
assembly)
at System.Management.Instrumentation.Instrumentation.Fire(Object
eventData)

[Kishore Chaliparambil]

Thanks Willy

Kishore

Post by Willy Denoyette [MVP]
NetworkService has only read permission on the registry path for perflib,
so you'll need to give Delete permission to NetworkService.
Note that elevating local pseudo accounts permissions is in general a bad
idea, better would be to create a delete your counters outside the Service.
Willy.

Post by Kishore Chaliparambil
Oh Thanks.
Now I am trying to run the service as "NetworkService". I get an
exception when I try to delete performance counter. Is there a way to
assign this priviledge to the NetworkService account?
Exception: System.ComponentModel.Win32Exception
Message: Access is denied
Source: System
at System.Diagnostics.PerformanceCounterLib.RegisterFiles(String
machineName, String arg0, Boolean unregister)
at System.Diagnostics.PerformanceCounterLib.UnregisterCategory(String
machineName, String categoryName)
at System.Diagnostics.PerformanceCounterCategory.DeleteCategory(String
categoryName, String machineName)
at System.Diagnostics.PerformanceCounterCategory.Delete(String
categoryName)

Post by Willy Denoyette [MVP]
The generated mof file (see
system32\wbem\framework\root\your-provider-namespace ) doesn't include
any SecurityDescriptor attributes for the decoupled provider, that means
that only admins, NetworkService, Localservice and LocalSystem can
register the decoupled provider by calling
IWbemDecoupledRegistrar:Register for the decoupled provider (that's the
call that fails in your case).
In order to let other users run the provider you will have to edit the
...
class MSFT_DecoupledProvider : __Win32Provider
{
string CLSID = "{..........some class GUID...........}";
uint32 Version = 1;
string HostingModel = "Decoupled:Com";
// Remove the SecurityDescriptor attribute here
};
class WMINET_ManagedAssemblyProvider : MSFT_DecoupledProvider
{
string Assembly;
};
instance of WMINET_ManagedAssemblyProvider
{
HostingModel = "Decoupled:Com";
Name = "yourEventProviderName";
// Add a security descriptor in SDDL format - see the Platform SDK for
correct format
// Here a sample that grants access to the intrinsic Users group
SecurityDescriptor = "O:BUG:BUD:(A;;0x1;;;BU)";
};
....
When done editing, save and run mofcomp.
Willy.

Post by RK
I get the following exception when I fire a management event. The code
works fine if I run as an ADMIN but the moment I switch to a local user,
I get this exception. Does anybody know how to fix this problem.
Thanks
Exception: System.Runtime.InteropServices.COMException
Message: Exception from HRESULT: 0x80041003.
Source: mscorlib
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHR(Int32
errorCode, IntPtr errorInfo)
at System.Management.Instrumentation.EventSource..ctor(String
namespaceName, String appName, InstrumentedAssembly
instrumentedAssembly)
at
System.Management.Instrumentation.InstrumentedAssembly.InitEventSource(Object
param)
at
System.Management.Instrumentation.InstrumentedAssembly..ctor(Assembly
assembly, SchemaNaming naming)
at
System.Management.Instrumentation.Instrumentation.Initialize(Assembly
assembly)
at
System.Management.Instrumentation.Instrumentation.GetInstrumentedAssembly(Assembly
assembly)
at System.Management.Instrumentation.Instrumentation.Fire(Object
eventData)