Connecting Tech Pros Worldwide Forums | Help | Site Map

Please help with [STAThread], WMI and access denied

Guest
 
Posts: n/a
#1: Nov 15 '05
Hi All,

I have allready tried to ask a similar question [WQLEventQuery:Second local
connect:Access denied!], but got no answer until now. In the meantime, I
found, that I cannot understand some thread-settings for the Main() function
[I am using C#].
If I use the [STAThread] attribute for the Main() function, I get "access
denied error", if I use a ManagementEventWatcher to connect to the local
machine to receive events. Is there anybody out there, how possibly can
explain why this happens?? If I remove this attribute or use [MTAThread]
instead it works one time.
I append a short sample at the end.

Some help would be really very good.

Thanks so far and
best regards
Best regards,
Manfred Braun

(Private)
Lange Roetterstrasse 7
D68167 Mannheim
Germany

mailto:_manfred.braun_@manfbraun.de
Phone : +49-621-37 53 86
(Remove the anti-spam-underscore to mail me!)

/*
Name: WMIAsyncQuerySampleReconnectSample5a.cs
*/

using System;
using System.Management;

class Sample_ManagementEventWatcher
{
[STAThread]
public static int Main(string[] args)
{
if(args.Length != 0)
{
string comp = args[0];

MyHandler mh;
EventArrivedEventHandler eventArrivedEventHandler;
ManagementEventWatcher watcher;

mh = new MyHandler();
eventArrivedEventHandler = new EventArrivedEventHandler(mh.Arrived);
watcher = Sample_ManagementEventWatcher.getWatcher(comp);
watcher.EventArrived += eventArrivedEventHandler;

watcher.Start(); //Access denied!
Console.WriteLine("Watcher is running, press <enter> to stop...");
Console.ReadLine();
watcher.Stop();
watcher.EventArrived -= eventArrivedEventHandler;
}
else
Console.WriteLine("Args!!! [P1=Computername]");

return 0;
}

public static ManagementEventWatcher getWatcher(string comp)
{
ConnectionOptions co;
ManagementPath mp;
ManagementScope ms;
WqlEventQuery EventQuery;
ManagementEventWatcher watcher;
string wql;

co = new ConnectionOptions();
co.Timeout = new TimeSpan(0, 0, 60);
co.EnablePrivileges = true;

mp = new ManagementPath();
mp.NamespacePath = @"\root\cimv2";
mp.Server = comp;
ms = new ManagementScope(mp, co);

wql = "select * from __instancecreationevent where targetinstance isa
'Win32_NTLogEvent'";
EventQuery = new WqlEventQuery(wql);

watcher = new ManagementEventWatcher(ms, EventQuery);

return watcher;
}


public class MyHandler
{
public void Arrived(object sender, EventArrivedEventArgs e)
{
ManagementBaseObject mbo =
(ManagementBaseObject)e.NewEvent["TargetInstance"];
Console.WriteLine("Event:{0}", mbo["message"]);
}
}

}//Namespace.




Willy Denoyette [MVP]
Guest
 
Posts: n/a
#2: Nov 15 '05

re: Please help with [STAThread], WMI and access denied


Works for me with both, STA and MTAThread attribute set.

What OS are you runnng?

Willy.


<__mabra__@be.de> wrote in message
news:uEBfsHouDHA.2248@TK2MSFTNGP09.phx.gbl...[color=blue]
> Hi All,
>
> I have allready tried to ask a similar question [WQLEventQuery:Second[/color]
local[color=blue]
> connect:Access denied!], but got no answer until now. In the meantime, I
> found, that I cannot understand some thread-settings for the Main()[/color]
function[color=blue]
> [I am using C#].
> If I use the [STAThread] attribute for the Main() function, I get "access
> denied error", if I use a ManagementEventWatcher to connect to the local
> machine to receive events. Is there anybody out there, how possibly can
> explain why this happens?? If I remove this attribute or use [MTAThread]
> instead it works one time.
> I append a short sample at the end.
>
> Some help would be really very good.
>
> Thanks so far and
> best regards
> Best regards,
> Manfred Braun
>
> (Private)
> Lange Roetterstrasse 7
> D68167 Mannheim
> Germany
>
> mailto:_manfred.braun_@manfbraun.de
> Phone : +49-621-37 53 86
> (Remove the anti-spam-underscore to mail me!)
>
> /*
> Name: WMIAsyncQuerySampleReconnectSample5a.cs
> */
>
> using System;
> using System.Management;
>
> class Sample_ManagementEventWatcher
> {
> [STAThread]
> public static int Main(string[] args)
> {
> if(args.Length != 0)
> {
> string comp = args[0];
>
> MyHandler mh;
> EventArrivedEventHandler eventArrivedEventHandler;
> ManagementEventWatcher watcher;
>
> mh = new MyHandler();
> eventArrivedEventHandler = new EventArrivedEventHandler(mh.Arrived);
> watcher = Sample_ManagementEventWatcher.getWatcher(comp);
> watcher.EventArrived += eventArrivedEventHandler;
>
> watcher.Start(); //Access denied!
> Console.WriteLine("Watcher is running, press <enter> to stop...");
> Console.ReadLine();
> watcher.Stop();
> watcher.EventArrived -= eventArrivedEventHandler;
> }
> else
> Console.WriteLine("Args!!! [P1=Computername]");
>
> return 0;
> }
>
> public static ManagementEventWatcher getWatcher(string comp)
> {
> ConnectionOptions co;
> ManagementPath mp;
> ManagementScope ms;
> WqlEventQuery EventQuery;
> ManagementEventWatcher watcher;
> string wql;
>
> co = new ConnectionOptions();
> co.Timeout = new TimeSpan(0, 0, 60);
> co.EnablePrivileges = true;
>
> mp = new ManagementPath();
> mp.NamespacePath = @"\root\cimv2";
> mp.Server = comp;
> ms = new ManagementScope(mp, co);
>
> wql = "select * from __instancecreationevent where targetinstance isa
> 'Win32_NTLogEvent'";
> EventQuery = new WqlEventQuery(wql);
>
> watcher = new ManagementEventWatcher(ms, EventQuery);
>
> return watcher;
> }
>
>
> public class MyHandler
> {
> public void Arrived(object sender, EventArrivedEventArgs e)
> {
> ManagementBaseObject mbo =
> (ManagementBaseObject)e.NewEvent["TargetInstance"];
> Console.WriteLine("Event:{0}", mbo["message"]);
> }
> }
>
> }//Namespace.
>
>
>[/color]


Manfred Braun
Guest
 
Posts: n/a
#3: Nov 15 '05

re: Please help with [STAThread], WMI and access denied


Hello Willy,

oh, yes and sorry for my inaccuracy about the environment. I am using
Windows 2000 Server, english, SP3, dot.net runtime 1.0, english too. I am
working in an NT4 domain with logged-on account domain admin and the W2K
machine are domain members.

And my chain of experiments always seems to return different results ....
I used two production machines, just to be sure, that not some fumbling ;-)
on my admin machine have caused that. Accidentally, on the next machine, I
found a new behavior:Both versions are not running. After finding and
removing some <account deleted> entries from the ACLs with DCOMCNFG, the
behavior return to that, what I originally described and this is on all my
W2K machines now really the same. But this last experiment tells me, it
could have something to do with DCOM and/or WMI settings, which are normally
remains at the OS defaults.

Thanks so far and
best regards,
Manfred

"Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in message
news:OpphItouDHA.1996@TK2MSFTNGP12.phx.gbl...[color=blue]
> Works for me with both, STA and MTAThread attribute set.
>
> What OS are you runnng?
>
> Willy.
>
>
> <__mabra__@be.de> wrote in message
> news:uEBfsHouDHA.2248@TK2MSFTNGP09.phx.gbl...[color=green]
> > Hi All,
> >
> > I have allready tried to ask a similar question [WQLEventQuery:Second[/color]
> local[color=green]
> > connect:Access denied!], but got no answer until now. In the meantime, I
> > found, that I cannot understand some thread-settings for the Main()[/color]
> function[color=green]
> > [I am using C#].
> > If I use the [STAThread] attribute for the Main() function, I get[/color][/color]
"access[color=blue][color=green]
> > denied error", if I use a ManagementEventWatcher to connect to the local
> > machine to receive events. Is there anybody out there, how possibly can
> > explain why this happens?? If I remove this attribute or use [MTAThread]
> > instead it works one time.
> > I append a short sample at the end.
> >
> > Some help would be really very good.
> >
> > Thanks so far and
> > best regards
> > Best regards,
> > Manfred Braun
> >
> > (Private)
> > Lange Roetterstrasse 7
> > D68167 Mannheim
> > Germany
> >
> > mailto:_manfred.braun_@manfbraun.de
> > Phone : +49-621-37 53 86
> > (Remove the anti-spam-underscore to mail me!)
> >
> > /*
> > Name: WMIAsyncQuerySampleReconnectSample5a.cs
> > */
> >
> > using System;
> > using System.Management;
> >
> > class Sample_ManagementEventWatcher
> > {
> > [STAThread]
> > public static int Main(string[] args)
> > {
> > if(args.Length != 0)
> > {
> > string comp = args[0];
> >
> > MyHandler mh;
> > EventArrivedEventHandler eventArrivedEventHandler;
> > ManagementEventWatcher watcher;
> >
> > mh = new MyHandler();
> > eventArrivedEventHandler = new EventArrivedEventHandler(mh.Arrived);
> > watcher = Sample_ManagementEventWatcher.getWatcher(comp);
> > watcher.EventArrived += eventArrivedEventHandler;
> >
> > watcher.Start(); //Access denied!
> > Console.WriteLine("Watcher is running, press <enter> to stop...");
> > Console.ReadLine();
> > watcher.Stop();
> > watcher.EventArrived -= eventArrivedEventHandler;
> > }
> > else
> > Console.WriteLine("Args!!! [P1=Computername]");
> >
> > return 0;
> > }
> >
> > public static ManagementEventWatcher getWatcher(string comp)
> > {
> > ConnectionOptions co;
> > ManagementPath mp;
> > ManagementScope ms;
> > WqlEventQuery EventQuery;
> > ManagementEventWatcher watcher;
> > string wql;
> >
> > co = new ConnectionOptions();
> > co.Timeout = new TimeSpan(0, 0, 60);
> > co.EnablePrivileges = true;
> >
> > mp = new ManagementPath();
> > mp.NamespacePath = @"\root\cimv2";
> > mp.Server = comp;
> > ms = new ManagementScope(mp, co);
> >
> > wql = "select * from __instancecreationevent where targetinstance isa
> > 'Win32_NTLogEvent'";
> > EventQuery = new WqlEventQuery(wql);
> >
> > watcher = new ManagementEventWatcher(ms, EventQuery);
> >
> > return watcher;
> > }
> >
> >
> > public class MyHandler
> > {
> > public void Arrived(object sender, EventArrivedEventArgs e)
> > {
> > ManagementBaseObject mbo =
> > (ManagementBaseObject)e.NewEvent["TargetInstance"];
> > Console.WriteLine("Event:{0}", mbo["message"]);
> > }
> > }
> >
> > }//Namespace.
> >
> >
> >[/color]
>
>[/color]

Manfred Braun
Guest
 
Posts: n/a
#4: Nov 15 '05

re: Please help with [STAThread], WMI and access denied


Hi All,

interestingly, in one of my latest tests, I found privilege failure audit in
the eventlog, claming the denied access to the right SeSecurityPrivilege
......

With this in mind, I changed the query in my sample

from:
select * from __instancecreationevent where targetinstance isa
'Win32_NTLogEvent'";

to:
"select * from __instancecreationevent where TargetInstance isa
'Win32_NTLogEvent' and TargetInstance.LogFile = 'Application'";

This is working. But this means, that setting the
ConnectionOptions.EnablePrivileges = true has no effect using the
ManagementEventWatcher. But in the constructor, I pass a ManagementScope,
with this option set!

I found no information inside the SDK in the EventWatcherOptions or the
WqlEventQuery about security. But even all this does not explain that after
a first connect, a second one fails and does not explain what this has to do
with setting the [xxxThread] option for my Main() function.

Any help would be really very welcomed!

Thanks so far and
best regards,
Manfred


"Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
news:OKjZnMruDHA.536@tk2msftngp13.phx.gbl...[color=blue]
> Hello Willy,
>
> oh, yes and sorry for my inaccuracy about the environment. I am using
> Windows 2000 Server, english, SP3, dot.net runtime 1.0, english too. I am
> working in an NT4 domain with logged-on account domain admin and the W2K
> machine are domain members.
>
> And my chain of experiments always seems to return different results ....
> I used two production machines, just to be sure, that not some fumbling[/color]
;-)[color=blue]
> on my admin machine have caused that. Accidentally, on the next machine, I
> found a new behavior:Both versions are not running. After finding and
> removing some <account deleted> entries from the ACLs with DCOMCNFG, the
> behavior return to that, what I originally described and this is on all my
> W2K machines now really the same. But this last experiment tells me, it
> could have something to do with DCOM and/or WMI settings, which are[/color]
normally[color=blue]
> remains at the OS defaults.
>
> Thanks so far and
> best regards,
> Manfred
>
> "Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in message
> news:OpphItouDHA.1996@TK2MSFTNGP12.phx.gbl...[color=green]
> > Works for me with both, STA and MTAThread attribute set.
> >
> > What OS are you runnng?
> >
> > Willy.
> >
> >
> > <__mabra__@be.de> wrote in message
> > news:uEBfsHouDHA.2248@TK2MSFTNGP09.phx.gbl...[color=darkred]
> > > Hi All,
> > >
> > > I have allready tried to ask a similar question [WQLEventQuery:Second[/color]
> > local[color=darkred]
> > > connect:Access denied!], but got no answer until now. In the meantime,[/color][/color][/color]
I[color=blue][color=green][color=darkred]
> > > found, that I cannot understand some thread-settings for the Main()[/color]
> > function[color=darkred]
> > > [I am using C#].
> > > If I use the [STAThread] attribute for the Main() function, I get[/color][/color]
> "access[color=green][color=darkred]
> > > denied error", if I use a ManagementEventWatcher to connect to the[/color][/color][/color]
local[color=blue][color=green][color=darkred]
> > > machine to receive events. Is there anybody out there, how possibly[/color][/color][/color]
can[color=blue][color=green][color=darkred]
> > > explain why this happens?? If I remove this attribute or use[/color][/color][/color]
[MTAThread][color=blue][color=green][color=darkred]
> > > instead it works one time.
> > > I append a short sample at the end.
> > >
> > > Some help would be really very good.
> > >
> > > Thanks so far and
> > > best regards
> > > Best regards,
> > > Manfred Braun
> > >
> > > (Private)
> > > Lange Roetterstrasse 7
> > > D68167 Mannheim
> > > Germany
> > >
> > > mailto:_manfred.braun_@manfbraun.de
> > > Phone : +49-621-37 53 86
> > > (Remove the anti-spam-underscore to mail me!)
> > >
> > > /*
> > > Name: WMIAsyncQuerySampleReconnectSample5a.cs
> > > */
> > >
> > > using System;
> > > using System.Management;
> > >
> > > class Sample_ManagementEventWatcher
> > > {
> > > [STAThread]
> > > public static int Main(string[] args)
> > > {
> > > if(args.Length != 0)
> > > {
> > > string comp = args[0];
> > >
> > > MyHandler mh;
> > > EventArrivedEventHandler eventArrivedEventHandler;
> > > ManagementEventWatcher watcher;
> > >
> > > mh = new MyHandler();
> > > eventArrivedEventHandler = new[/color][/color][/color]
EventArrivedEventHandler(mh.Arrived);[color=blue][color=green][color=darkred]
> > > watcher = Sample_ManagementEventWatcher.getWatcher(comp);
> > > watcher.EventArrived += eventArrivedEventHandler;
> > >
> > > watcher.Start(); //Access denied!
> > > Console.WriteLine("Watcher is running, press <enter> to stop...");
> > > Console.ReadLine();
> > > watcher.Stop();
> > > watcher.EventArrived -= eventArrivedEventHandler;
> > > }
> > > else
> > > Console.WriteLine("Args!!! [P1=Computername]");
> > >
> > > return 0;
> > > }
> > >
> > > public static ManagementEventWatcher getWatcher(string comp)
> > > {
> > > ConnectionOptions co;
> > > ManagementPath mp;
> > > ManagementScope ms;
> > > WqlEventQuery EventQuery;
> > > ManagementEventWatcher watcher;
> > > string wql;
> > >
> > > co = new ConnectionOptions();
> > > co.Timeout = new TimeSpan(0, 0, 60);
> > > co.EnablePrivileges = true;
> > >
> > > mp = new ManagementPath();
> > > mp.NamespacePath = @"\root\cimv2";
> > > mp.Server = comp;
> > > ms = new ManagementScope(mp, co);
> > >
> > > wql = "select * from __instancecreationevent where targetinstance[/color][/color][/color]
isa[color=blue][color=green][color=darkred]
> > > 'Win32_NTLogEvent'";
> > > EventQuery = new WqlEventQuery(wql);
> > >
> > > watcher = new ManagementEventWatcher(ms, EventQuery);
> > >
> > > return watcher;
> > > }
> > >
> > >
> > > public class MyHandler
> > > {
> > > public void Arrived(object sender, EventArrivedEventArgs e)
> > > {
> > > ManagementBaseObject mbo =
> > > (ManagementBaseObject)e.NewEvent["TargetInstance"];
> > > Console.WriteLine("Event:{0}", mbo["message"]);
> > > }
> > > }
> > >
> > > }//Namespace.
> > >
> > >
> > >[/color]
> >
> >[/color]
>[/color]

Ivan Brugiolo [MSFT]
Guest
 
Posts: n/a
#5: Nov 15 '05

re: Please help with [STAThread], WMI and access denied


This has all to do with Identity Tracking and STATIC/DYNAMIC cloaking.
If you are writing C++ code, all these settings are exposed and obvious.

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm


"Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
news:eC9fFgruDHA.2712@TK2MSFTNGP11.phx.gbl...[color=blue]
> Hi All,
>
> interestingly, in one of my latest tests, I found privilege failure audit[/color]
in[color=blue]
> the eventlog, claming the denied access to the right SeSecurityPrivilege
> .....
>
> With this in mind, I changed the query in my sample
>
> from:
> select * from __instancecreationevent where targetinstance isa
> 'Win32_NTLogEvent'";
>
> to:
> "select * from __instancecreationevent where TargetInstance isa
> 'Win32_NTLogEvent' and TargetInstance.LogFile = 'Application'";
>
> This is working. But this means, that setting the
> ConnectionOptions.EnablePrivileges = true has no effect using the
> ManagementEventWatcher. But in the constructor, I pass a ManagementScope,
> with this option set!
>
> I found no information inside the SDK in the EventWatcherOptions or the
> WqlEventQuery about security. But even all this does not explain that[/color]
after[color=blue]
> a first connect, a second one fails and does not explain what this has to[/color]
do[color=blue]
> with setting the [xxxThread] option for my Main() function.
>
> Any help would be really very welcomed!
>
> Thanks so far and
> best regards,
> Manfred
>
>
> "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> news:OKjZnMruDHA.536@tk2msftngp13.phx.gbl...[color=green]
> > Hello Willy,
> >
> > oh, yes and sorry for my inaccuracy about the environment. I am using
> > Windows 2000 Server, english, SP3, dot.net runtime 1.0, english too. I[/color][/color]
am[color=blue][color=green]
> > working in an NT4 domain with logged-on account domain admin and the W2K
> > machine are domain members.
> >
> > And my chain of experiments always seems to return different results[/color][/color]
.....[color=blue][color=green]
> > I used two production machines, just to be sure, that not some fumbling[/color]
> ;-)[color=green]
> > on my admin machine have caused that. Accidentally, on the next machine,[/color][/color]
I[color=blue][color=green]
> > found a new behavior:Both versions are not running. After finding and
> > removing some <account deleted> entries from the ACLs with DCOMCNFG, the
> > behavior return to that, what I originally described and this is on all[/color][/color]
my[color=blue][color=green]
> > W2K machines now really the same. But this last experiment tells me, it
> > could have something to do with DCOM and/or WMI settings, which are[/color]
> normally[color=green]
> > remains at the OS defaults.
> >
> > Thanks so far and
> > best regards,
> > Manfred
> >
> > "Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in message
> > news:OpphItouDHA.1996@TK2MSFTNGP12.phx.gbl...[color=darkred]
> > > Works for me with both, STA and MTAThread attribute set.
> > >
> > > What OS are you runnng?
> > >
> > > Willy.
> > >
> > >
> > > <__mabra__@be.de> wrote in message
> > > news:uEBfsHouDHA.2248@TK2MSFTNGP09.phx.gbl...
> > > > Hi All,
> > > >
> > > > I have allready tried to ask a similar question[/color][/color][/color]
[WQLEventQuery:Second[color=blue][color=green][color=darkred]
> > > local
> > > > connect:Access denied!], but got no answer until now. In the[/color][/color][/color]
meantime,[color=blue]
> I[color=green][color=darkred]
> > > > found, that I cannot understand some thread-settings for the Main()
> > > function
> > > > [I am using C#].
> > > > If I use the [STAThread] attribute for the Main() function, I get[/color]
> > "access[color=darkred]
> > > > denied error", if I use a ManagementEventWatcher to connect to the[/color][/color]
> local[color=green][color=darkred]
> > > > machine to receive events. Is there anybody out there, how possibly[/color][/color]
> can[color=green][color=darkred]
> > > > explain why this happens?? If I remove this attribute or use[/color][/color]
> [MTAThread][color=green][color=darkred]
> > > > instead it works one time.
> > > > I append a short sample at the end.
> > > >
> > > > Some help would be really very good.
> > > >
> > > > Thanks so far and
> > > > best regards
> > > > Best regards,
> > > > Manfred Braun
> > > >
> > > > (Private)
> > > > Lange Roetterstrasse 7
> > > > D68167 Mannheim
> > > > Germany
> > > >
> > > > mailto:_manfred.braun_@manfbraun.de
> > > > Phone : +49-621-37 53 86
> > > > (Remove the anti-spam-underscore to mail me!)
> > > >
> > > > /*
> > > > Name: WMIAsyncQuerySampleReconnectSample5a.cs
> > > > */
> > > >
> > > > using System;
> > > > using System.Management;
> > > >
> > > > class Sample_ManagementEventWatcher
> > > > {
> > > > [STAThread]
> > > > public static int Main(string[] args)
> > > > {
> > > > if(args.Length != 0)
> > > > {
> > > > string comp = args[0];
> > > >
> > > > MyHandler mh;
> > > > EventArrivedEventHandler eventArrivedEventHandler;
> > > > ManagementEventWatcher watcher;
> > > >
> > > > mh = new MyHandler();
> > > > eventArrivedEventHandler = new[/color][/color]
> EventArrivedEventHandler(mh.Arrived);[color=green][color=darkred]
> > > > watcher = Sample_ManagementEventWatcher.getWatcher(comp);
> > > > watcher.EventArrived += eventArrivedEventHandler;
> > > >
> > > > watcher.Start(); //Access denied!
> > > > Console.WriteLine("Watcher is running, press <enter> to[/color][/color][/color]
stop...");[color=blue][color=green][color=darkred]
> > > > Console.ReadLine();
> > > > watcher.Stop();
> > > > watcher.EventArrived -= eventArrivedEventHandler;
> > > > }
> > > > else
> > > > Console.WriteLine("Args!!! [P1=Computername]");
> > > >
> > > > return 0;
> > > > }
> > > >
> > > > public static ManagementEventWatcher getWatcher(string comp)
> > > > {
> > > > ConnectionOptions co;
> > > > ManagementPath mp;
> > > > ManagementScope ms;
> > > > WqlEventQuery EventQuery;
> > > > ManagementEventWatcher watcher;
> > > > string wql;
> > > >
> > > > co = new ConnectionOptions();
> > > > co.Timeout = new TimeSpan(0, 0, 60);
> > > > co.EnablePrivileges = true;
> > > >
> > > > mp = new ManagementPath();
> > > > mp.NamespacePath = @"\root\cimv2";
> > > > mp.Server = comp;
> > > > ms = new ManagementScope(mp, co);
> > > >
> > > > wql = "select * from __instancecreationevent where targetinstance[/color][/color]
> isa[color=green][color=darkred]
> > > > 'Win32_NTLogEvent'";
> > > > EventQuery = new WqlEventQuery(wql);
> > > >
> > > > watcher = new ManagementEventWatcher(ms, EventQuery);
> > > >
> > > > return watcher;
> > > > }
> > > >
> > > >
> > > > public class MyHandler
> > > > {
> > > > public void Arrived(object sender, EventArrivedEventArgs e)
> > > > {
> > > > ManagementBaseObject mbo =
> > > > (ManagementBaseObject)e.NewEvent["TargetInstance"];
> > > > Console.WriteLine("Event:{0}", mbo["message"]);
> > > > }
> > > > }
> > > >
> > > > }//Namespace.
> > > >
> > > >
> > > >
> > >
> > >[/color]
> >[/color]
>[/color]


Willy Denoyette [MVP]
Guest
 
Posts: n/a
#6: Nov 15 '05

re: Please help with [STAThread], WMI and access denied


Manfred,

WMI provider COM objects are "free" threaded, that means they need to run in
a MTA thread.
When your main thread is initialized for STA, the Management classes check
the current apartment for MTA compatibility, and will create a new thread
and enter the MTA to create the COM objects, COM will marshal the interfaces
between the STA thread (running your managed code) and the MTA thread
running the native COM code.
But, your main thread (STA) has enabled the SeSecurityPrivilege for the main
thread, but this privilege is not propagated to the MTA thread, resulting in
an access denied exception.
Therefore I suggest you allways run your code on an MTA thread, the net
benifits are
- no marshaling overhead
- no difficult to track security issues.
- no issues due to eventsink marshalin between MTA and STA threads.

Willy.

"Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
news:eC9fFgruDHA.2712@TK2MSFTNGP11.phx.gbl...[color=blue]
> Hi All,
>
> interestingly, in one of my latest tests, I found privilege failure audit[/color]
in[color=blue]
> the eventlog, claming the denied access to the right SeSecurityPrivilege
> .....
>
> With this in mind, I changed the query in my sample
>
> from:
> select * from __instancecreationevent where targetinstance isa
> 'Win32_NTLogEvent'";
>
> to:
> "select * from __instancecreationevent where TargetInstance isa
> 'Win32_NTLogEvent' and TargetInstance.LogFile = 'Application'";
>
> This is working. But this means, that setting the
> ConnectionOptions.EnablePrivileges = true has no effect using the
> ManagementEventWatcher. But in the constructor, I pass a ManagementScope,
> with this option set!
>
> I found no information inside the SDK in the EventWatcherOptions or the
> WqlEventQuery about security. But even all this does not explain that[/color]
after[color=blue]
> a first connect, a second one fails and does not explain what this has to[/color]
do[color=blue]
> with setting the [xxxThread] option for my Main() function.
>
> Any help would be really very welcomed!
>
> Thanks so far and
> best regards,
> Manfred
>
>
> "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> news:OKjZnMruDHA.536@tk2msftngp13.phx.gbl...[color=green]
> > Hello Willy,
> >
> > oh, yes and sorry for my inaccuracy about the environment. I am using
> > Windows 2000 Server, english, SP3, dot.net runtime 1.0, english too. I[/color][/color]
am[color=blue][color=green]
> > working in an NT4 domain with logged-on account domain admin and the W2K
> > machine are domain members.
> >
> > And my chain of experiments always seems to return different results[/color][/color]
.....[color=blue][color=green]
> > I used two production machines, just to be sure, that not some fumbling[/color]
> ;-)[color=green]
> > on my admin machine have caused that. Accidentally, on the next machine,[/color][/color]
I[color=blue][color=green]
> > found a new behavior:Both versions are not running. After finding and
> > removing some <account deleted> entries from the ACLs with DCOMCNFG, the
> > behavior return to that, what I originally described and this is on all[/color][/color]
my[color=blue][color=green]
> > W2K machines now really the same. But this last experiment tells me, it
> > could have something to do with DCOM and/or WMI settings, which are[/color]
> normally[color=green]
> > remains at the OS defaults.
> >
> > Thanks so far and
> > best regards,
> > Manfred
> >
> > "Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in message
> > news:OpphItouDHA.1996@TK2MSFTNGP12.phx.gbl...[color=darkred]
> > > Works for me with both, STA and MTAThread attribute set.
> > >
> > > What OS are you runnng?
> > >
> > > Willy.
> > >
> > >
> > > <__mabra__@be.de> wrote in message
> > > news:uEBfsHouDHA.2248@TK2MSFTNGP09.phx.gbl...
> > > > Hi All,
> > > >
> > > > I have allready tried to ask a similar question[/color][/color][/color]
[WQLEventQuery:Second[color=blue][color=green][color=darkred]
> > > local
> > > > connect:Access denied!], but got no answer until now. In the[/color][/color][/color]
meantime,[color=blue]
> I[color=green][color=darkred]
> > > > found, that I cannot understand some thread-settings for the Main()
> > > function
> > > > [I am using C#].
> > > > If I use the [STAThread] attribute for the Main() function, I get[/color]
> > "access[color=darkred]
> > > > denied error", if I use a ManagementEventWatcher to connect to the[/color][/color]
> local[color=green][color=darkred]
> > > > machine to receive events. Is there anybody out there, how possibly[/color][/color]
> can[color=green][color=darkred]
> > > > explain why this happens?? If I remove this attribute or use[/color][/color]
> [MTAThread][color=green][color=darkred]
> > > > instead it works one time.
> > > > I append a short sample at the end.
> > > >
> > > > Some help would be really very good.
> > > >
> > > > Thanks so far and
> > > > best regards
> > > > Best regards,
> > > > Manfred Braun
> > > >
> > > > (Private)
> > > > Lange Roetterstrasse 7
> > > > D68167 Mannheim
> > > > Germany
> > > >
> > > > mailto:_manfred.braun_@manfbraun.de
> > > > Phone : +49-621-37 53 86
> > > > (Remove the anti-spam-underscore to mail me!)
> > > >
> > > > /*
> > > > Name: WMIAsyncQuerySampleReconnectSample5a.cs
> > > > */
> > > >
> > > > using System;
> > > > using System.Management;
> > > >
> > > > class Sample_ManagementEventWatcher
> > > > {
> > > > [STAThread]
> > > > public static int Main(string[] args)
> > > > {
> > > > if(args.Length != 0)
> > > > {
> > > > string comp = args[0];
> > > >
> > > > MyHandler mh;
> > > > EventArrivedEventHandler eventArrivedEventHandler;
> > > > ManagementEventWatcher watcher;
> > > >
> > > > mh = new MyHandler();
> > > > eventArrivedEventHandler = new[/color][/color]
> EventArrivedEventHandler(mh.Arrived);[color=green][color=darkred]
> > > > watcher = Sample_ManagementEventWatcher.getWatcher(comp);
> > > > watcher.EventArrived += eventArrivedEventHandler;
> > > >
> > > > watcher.Start(); //Access denied!
> > > > Console.WriteLine("Watcher is running, press <enter> to[/color][/color][/color]
stop...");[color=blue][color=green][color=darkred]
> > > > Console.ReadLine();
> > > > watcher.Stop();
> > > > watcher.EventArrived -= eventArrivedEventHandler;
> > > > }
> > > > else
> > > > Console.WriteLine("Args!!! [P1=Computername]");
> > > >
> > > > return 0;
> > > > }
> > > >
> > > > public static ManagementEventWatcher getWatcher(string comp)
> > > > {
> > > > ConnectionOptions co;
> > > > ManagementPath mp;
> > > > ManagementScope ms;
> > > > WqlEventQuery EventQuery;
> > > > ManagementEventWatcher watcher;
> > > > string wql;
> > > >
> > > > co = new ConnectionOptions();
> > > > co.Timeout = new TimeSpan(0, 0, 60);
> > > > co.EnablePrivileges = true;
> > > >
> > > > mp = new ManagementPath();
> > > > mp.NamespacePath = @"\root\cimv2";
> > > > mp.Server = comp;
> > > > ms = new ManagementScope(mp, co);
> > > >
> > > > wql = "select * from __instancecreationevent where targetinstance[/color][/color]
> isa[color=green][color=darkred]
> > > > 'Win32_NTLogEvent'";
> > > > EventQuery = new WqlEventQuery(wql);
> > > >
> > > > watcher = new ManagementEventWatcher(ms, EventQuery);
> > > >
> > > > return watcher;
> > > > }
> > > >
> > > >
> > > > public class MyHandler
> > > > {
> > > > public void Arrived(object sender, EventArrivedEventArgs e)
> > > > {
> > > > ManagementBaseObject mbo =
> > > > (ManagementBaseObject)e.NewEvent["TargetInstance"];
> > > > Console.WriteLine("Event:{0}", mbo["message"]);
> > > > }
> > > > }
> > > >
> > > > }//Namespace.
> > > >
> > > >
> > > >
> > >
> > >[/color]
> >[/color]
>[/color]


Manfred Braun
Guest
 
Posts: n/a
#7: Nov 15 '05

re: Please help with [STAThread], WMI and access denied


Hello Willy,

thanks a lot, I had not understand this completely, and so I tried to use
the [STAThread], because my code, using a [MTAThread] fails to re-connect.
Using ManagementEventWatcher.Start(), followed by .Stop() and another
..Start() failes also with access denied using the [MTAThread] attribute.

As a test, I opened a direct connection to WMI via the
ManagementScope.Connect(), left this connection open, do a .Start(),
followed by a .Stop() and another .Start() and this works! So I have to
assume, the the ConnectionOptions.EnablePrivileges is not passed to my
second ManagementEventWatcher.Start() code. This now looks like a bug for
me. Because I really want to connect to a huge number of computers with a
service, I would not use the Scope.Connect(), because I assume, it would
need much more resources.

Do you, or maybe someone else, have a good hint to handle this situation? I
am lerning C# and the framework, but I cannot code this in C++.

Thanks so far and
best regards,
Manfred


"Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in message
news:eF%23Ha3wuDHA.1576@TK2MSFTNGP11.phx.gbl...[color=blue]
> Manfred,
>
> WMI provider COM objects are "free" threaded, that means they need to run[/color]
in[color=blue]
> a MTA thread.
> When your main thread is initialized for STA, the Management classes check
> the current apartment for MTA compatibility, and will create a new thread
> and enter the MTA to create the COM objects, COM will marshal the[/color]
interfaces[color=blue]
> between the STA thread (running your managed code) and the MTA thread
> running the native COM code.
> But, your main thread (STA) has enabled the SeSecurityPrivilege for the[/color]
main[color=blue]
> thread, but this privilege is not propagated to the MTA thread, resulting[/color]
in[color=blue]
> an access denied exception.
> Therefore I suggest you allways run your code on an MTA thread, the net
> benifits are
> - no marshaling overhead
> - no difficult to track security issues.
> - no issues due to eventsink marshalin between MTA and STA threads.
>
> Willy.
>
> "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> news:eC9fFgruDHA.2712@TK2MSFTNGP11.phx.gbl...[color=green]
> > Hi All,
> >
> > interestingly, in one of my latest tests, I found privilege failure[/color][/color]
audit[color=blue]
> in[color=green]
> > the eventlog, claming the denied access to the right SeSecurityPrivilege
> > .....
> >
> > With this in mind, I changed the query in my sample
> >
> > from:
> > select * from __instancecreationevent where targetinstance isa
> > 'Win32_NTLogEvent'";
> >
> > to:
> > "select * from __instancecreationevent where TargetInstance isa
> > 'Win32_NTLogEvent' and TargetInstance.LogFile = 'Application'";
> >
> > This is working. But this means, that setting the
> > ConnectionOptions.EnablePrivileges = true has no effect using the
> > ManagementEventWatcher. But in the constructor, I pass a[/color][/color]
ManagementScope,[color=blue][color=green]
> > with this option set!
> >
> > I found no information inside the SDK in the EventWatcherOptions or the
> > WqlEventQuery about security. But even all this does not explain that[/color]
> after[color=green]
> > a first connect, a second one fails and does not explain what this has[/color][/color]
to[color=blue]
> do[color=green]
> > with setting the [xxxThread] option for my Main() function.
> >
> > Any help would be really very welcomed!
> >
> > Thanks so far and
> > best regards,
> > Manfred
> >
> >
> > "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> > news:OKjZnMruDHA.536@tk2msftngp13.phx.gbl...[color=darkred]
> > > Hello Willy,
> > >
> > > oh, yes and sorry for my inaccuracy about the environment. I am using
> > > Windows 2000 Server, english, SP3, dot.net runtime 1.0, english too. I[/color][/color]
> am[color=green][color=darkred]
> > > working in an NT4 domain with logged-on account domain admin and the[/color][/color][/color]
W2K[color=blue][color=green][color=darkred]
> > > machine are domain members.
> > >
> > > And my chain of experiments always seems to return different results[/color][/color]
> ....[color=green][color=darkred]
> > > I used two production machines, just to be sure, that not some[/color][/color][/color]
fumbling[color=blue][color=green]
> > ;-)[color=darkred]
> > > on my admin machine have caused that. Accidentally, on the next[/color][/color][/color]
machine,[color=blue]
> I[color=green][color=darkred]
> > > found a new behavior:Both versions are not running. After finding and
> > > removing some <account deleted> entries from the ACLs with DCOMCNFG,[/color][/color][/color]
the[color=blue][color=green][color=darkred]
> > > behavior return to that, what I originally described and this is on[/color][/color][/color]
all[color=blue]
> my[color=green][color=darkred]
> > > W2K machines now really the same. But this last experiment tells me,[/color][/color][/color]
it[color=blue][color=green][color=darkred]
> > > could have something to do with DCOM and/or WMI settings, which are[/color]
> > normally[color=darkred]
> > > remains at the OS defaults.
> > >
> > > Thanks so far and
> > > best regards,
> > > Manfred
> > >
> > > "Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in message
> > > news:OpphItouDHA.1996@TK2MSFTNGP12.phx.gbl...
> > > > Works for me with both, STA and MTAThread attribute set.
> > > >
> > > > What OS are you runnng?
> > > >
> > > > Willy.
> > > >
> > > >
> > > > <__mabra__@be.de> wrote in message
> > > > news:uEBfsHouDHA.2248@TK2MSFTNGP09.phx.gbl...
> > > > > Hi All,
> > > > >
> > > > > I have allready tried to ask a similar question[/color][/color]
> [WQLEventQuery:Second[color=green][color=darkred]
> > > > local
> > > > > connect:Access denied!], but got no answer until now. In the[/color][/color]
> meantime,[color=green]
> > I[color=darkred]
> > > > > found, that I cannot understand some thread-settings for the[/color][/color][/color]
Main()[color=blue][color=green][color=darkred]
> > > > function
> > > > > [I am using C#].
> > > > > If I use the [STAThread] attribute for the Main() function, I get
> > > "access
> > > > > denied error", if I use a ManagementEventWatcher to connect to the[/color]
> > local[color=darkred]
> > > > > machine to receive events. Is there anybody out there, how[/color][/color][/color]
possibly[color=blue][color=green]
> > can[color=darkred]
> > > > > explain why this happens?? If I remove this attribute or use[/color]
> > [MTAThread][color=darkred]
> > > > > instead it works one time.
> > > > > I append a short sample at the end.
> > > > >
> > > > > Some help would be really very good.
> > > > >
> > > > > Thanks so far and
> > > > > best regards
> > > > > Best regards,
> > > > > Manfred Braun
> > > > >
> > > > > (Private)
> > > > > Lange Roetterstrasse 7
> > > > > D68167 Mannheim
> > > > > Germany
> > > > >
> > > > > mailto:_manfred.braun_@manfbraun.de
> > > > > Phone : +49-621-37 53 86
> > > > > (Remove the anti-spam-underscore to mail me!)
> > > > >
> > > > > /*
> > > > > Name: WMIAsyncQuerySampleReconnectSample5a.cs
> > > > > */
> > > > >
> > > > > using System;
> > > > > using System.Management;
> > > > >
> > > > > class Sample_ManagementEventWatcher
> > > > > {
> > > > > [STAThread]
> > > > > public static int Main(string[] args)
> > > > > {
> > > > > if(args.Length != 0)
> > > > > {
> > > > > string comp = args[0];
> > > > >
> > > > > MyHandler mh;
> > > > > EventArrivedEventHandler eventArrivedEventHandler;
> > > > > ManagementEventWatcher watcher;
> > > > >
> > > > > mh = new MyHandler();
> > > > > eventArrivedEventHandler = new[/color]
> > EventArrivedEventHandler(mh.Arrived);[color=darkred]
> > > > > watcher = Sample_ManagementEventWatcher.getWatcher(comp);
> > > > > watcher.EventArrived += eventArrivedEventHandler;
> > > > >
> > > > > watcher.Start(); //Access denied!
> > > > > Console.WriteLine("Watcher is running, press <enter> to[/color][/color]
> stop...");[color=green][color=darkred]
> > > > > Console.ReadLine();
> > > > > watcher.Stop();
> > > > > watcher.EventArrived -= eventArrivedEventHandler;
> > > > > }
> > > > > else
> > > > > Console.WriteLine("Args!!! [P1=Computername]");
> > > > >
> > > > > return 0;
> > > > > }
> > > > >
> > > > > public static ManagementEventWatcher getWatcher(string comp)
> > > > > {
> > > > > ConnectionOptions co;
> > > > > ManagementPath mp;
> > > > > ManagementScope ms;
> > > > > WqlEventQuery EventQuery;
> > > > > ManagementEventWatcher watcher;
> > > > > string wql;
> > > > >
> > > > > co = new ConnectionOptions();
> > > > > co.Timeout = new TimeSpan(0, 0, 60);
> > > > > co.EnablePrivileges = true;
> > > > >
> > > > > mp = new ManagementPath();
> > > > > mp.NamespacePath = @"\root\cimv2";
> > > > > mp.Server = comp;
> > > > > ms = new ManagementScope(mp, co);
> > > > >
> > > > > wql = "select * from __instancecreationevent where[/color][/color][/color]
targetinstance[color=blue][color=green]
> > isa[color=darkred]
> > > > > 'Win32_NTLogEvent'";
> > > > > EventQuery = new WqlEventQuery(wql);
> > > > >
> > > > > watcher = new ManagementEventWatcher(ms, EventQuery);
> > > > >
> > > > > return watcher;
> > > > > }
> > > > >
> > > > >
> > > > > public class MyHandler
> > > > > {
> > > > > public void Arrived(object sender, EventArrivedEventArgs e)
> > > > > {
> > > > > ManagementBaseObject mbo =
> > > > > (ManagementBaseObject)e.NewEvent["TargetInstance"];
> > > > > Console.WriteLine("Event:{0}", mbo["message"]);
> > > > > }
> > > > > }
> > > > >
> > > > > }//Namespace.
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >[/color]
> >[/color]
>
>[/color]

Andy Cheung [MSFT]
Guest
 
Posts: n/a
#8: Nov 15 '05

re: Please help with [STAThread], WMI and access denied


This is a known bug in System.Management.dll in .NET Framework v1.0. The bug
that prevents WMI privileges from propagating from managed code running on
STAThread to WMI core. Applying [MTAThread] to the calling thread appears to
be a partial workaround to this problem as Access Denied would still be
returned on the second time of event subscription. This problem should be
fixed in .NET Framework v1.1. Have you tried running your application with
v1.1?

--
Andy Cheung
Microsoft WMI Test Engineer
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm


"Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
news:eUb$IZ0uDHA.2432@TK2MSFTNGP10.phx.gbl...[color=blue]
> Hello Willy,
>
> thanks a lot, I had not understand this completely, and so I tried to use
> the [STAThread], because my code, using a [MTAThread] fails to re-connect.
> Using ManagementEventWatcher.Start(), followed by .Stop() and another
> .Start() failes also with access denied using the [MTAThread] attribute.
>
> As a test, I opened a direct connection to WMI via the
> ManagementScope.Connect(), left this connection open, do a .Start(),
> followed by a .Stop() and another .Start() and this works! So I have to
> assume, the the ConnectionOptions.EnablePrivileges is not passed to my
> second ManagementEventWatcher.Start() code. This now looks like a bug for
> me. Because I really want to connect to a huge number of computers with a
> service, I would not use the Scope.Connect(), because I assume, it would
> need much more resources.
>
> Do you, or maybe someone else, have a good hint to handle this situation?[/color]
I[color=blue]
> am lerning C# and the framework, but I cannot code this in C++.
>
> Thanks so far and
> best regards,
> Manfred
>
>
> "Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in message
> news:eF%23Ha3wuDHA.1576@TK2MSFTNGP11.phx.gbl...[color=green]
> > Manfred,
> >
> > WMI provider COM objects are "free" threaded, that means they need to[/color][/color]
run[color=blue]
> in[color=green]
> > a MTA thread.
> > When your main thread is initialized for STA, the Management classes[/color][/color]
check[color=blue][color=green]
> > the current apartment for MTA compatibility, and will create a new[/color][/color]
thread[color=blue][color=green]
> > and enter the MTA to create the COM objects, COM will marshal the[/color]
> interfaces[color=green]
> > between the STA thread (running your managed code) and the MTA thread
> > running the native COM code.
> > But, your main thread (STA) has enabled the SeSecurityPrivilege for the[/color]
> main[color=green]
> > thread, but this privilege is not propagated to the MTA thread,[/color][/color]
resulting[color=blue]
> in[color=green]
> > an access denied exception.
> > Therefore I suggest you allways run your code on an MTA thread, the net
> > benifits are
> > - no marshaling overhead
> > - no difficult to track security issues.
> > - no issues due to eventsink marshalin between MTA and STA threads.
> >
> > Willy.
> >
> > "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> > news:eC9fFgruDHA.2712@TK2MSFTNGP11.phx.gbl...[color=darkred]
> > > Hi All,
> > >
> > > interestingly, in one of my latest tests, I found privilege failure[/color][/color]
> audit[color=green]
> > in[color=darkred]
> > > the eventlog, claming the denied access to the right[/color][/color][/color]
SeSecurityPrivilege[color=blue][color=green][color=darkred]
> > > .....
> > >
> > > With this in mind, I changed the query in my sample
> > >
> > > from:
> > > select * from __instancecreationevent where targetinstance isa
> > > 'Win32_NTLogEvent'";
> > >
> > > to:
> > > "select * from __instancecreationevent where TargetInstance isa
> > > 'Win32_NTLogEvent' and TargetInstance.LogFile = 'Application'";
> > >
> > > This is working. But this means, that setting the
> > > ConnectionOptions.EnablePrivileges = true has no effect using the
> > > ManagementEventWatcher. But in the constructor, I pass a[/color][/color]
> ManagementScope,[color=green][color=darkred]
> > > with this option set!
> > >
> > > I found no information inside the SDK in the EventWatcherOptions or[/color][/color][/color]
the[color=blue][color=green][color=darkred]
> > > WqlEventQuery about security. But even all this does not explain that[/color]
> > after[color=darkred]
> > > a first connect, a second one fails and does not explain what this has[/color][/color]
> to[color=green]
> > do[color=darkred]
> > > with setting the [xxxThread] option for my Main() function.
> > >
> > > Any help would be really very welcomed!
> > >
> > > Thanks so far and
> > > best regards,
> > > Manfred
> > >
> > >
> > > "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> > > news:OKjZnMruDHA.536@tk2msftngp13.phx.gbl...
> > > > Hello Willy,
> > > >
> > > > oh, yes and sorry for my inaccuracy about the environment. I am[/color][/color][/color]
using[color=blue][color=green][color=darkred]
> > > > Windows 2000 Server, english, SP3, dot.net runtime 1.0, english too.[/color][/color][/color]
I[color=blue][color=green]
> > am[color=darkred]
> > > > working in an NT4 domain with logged-on account domain admin and the[/color][/color]
> W2K[color=green][color=darkred]
> > > > machine are domain members.
> > > >
> > > > And my chain of experiments always seems to return different results[/color]
> > ....[color=darkred]
> > > > I used two production machines, just to be sure, that not some[/color][/color]
> fumbling[color=green][color=darkred]
> > > ;-)
> > > > on my admin machine have caused that. Accidentally, on the next[/color][/color]
> machine,[color=green]
> > I[color=darkred]
> > > > found a new behavior:Both versions are not running. After finding[/color][/color][/color]
and[color=blue][color=green][color=darkred]
> > > > removing some <account deleted> entries from the ACLs with DCOMCNFG,[/color][/color]
> the[color=green][color=darkred]
> > > > behavior return to that, what I originally described and this is on[/color][/color]
> all[color=green]
> > my[color=darkred]
> > > > W2K machines now really the same. But this last experiment tells me,[/color][/color]
> it[color=green][color=darkred]
> > > > could have something to do with DCOM and/or WMI settings, which are
> > > normally
> > > > remains at the OS defaults.
> > > >
> > > > Thanks so far and
> > > > best regards,
> > > > Manfred
> > > >
> > > > "Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in[/color][/color][/color]
message[color=blue][color=green][color=darkred]
> > > > news:OpphItouDHA.1996@TK2MSFTNGP12.phx.gbl...
> > > > > Works for me with both, STA and MTAThread attribute set.
> > > > >
> > > > > What OS are you runnng?
> > > > >
> > > > > Willy.
> > > > >
> > > > >
> > > > > <__mabra__@be.de> wrote in message
> > > > > news:uEBfsHouDHA.2248@TK2MSFTNGP09.phx.gbl...
> > > > > > Hi All,
> > > > > >
> > > > > > I have allready tried to ask a similar question[/color]
> > [WQLEventQuery:Second[color=darkred]
> > > > > local
> > > > > > connect:Access denied!], but got no answer until now. In the[/color]
> > meantime,[color=darkred]
> > > I
> > > > > > found, that I cannot understand some thread-settings for the[/color][/color]
> Main()[color=green][color=darkred]
> > > > > function
> > > > > > [I am using C#].
> > > > > > If I use the [STAThread] attribute for the Main() function, I[/color][/color][/color]
get[color=blue][color=green][color=darkred]
> > > > "access
> > > > > > denied error", if I use a ManagementEventWatcher to connect to[/color][/color][/color]
the[color=blue][color=green][color=darkred]
> > > local
> > > > > > machine to receive events. Is there anybody out there, how[/color][/color]
> possibly[color=green][color=darkred]
> > > can
> > > > > > explain why this happens?? If I remove this attribute or use
> > > [MTAThread]
> > > > > > instead it works one time.
> > > > > > I append a short sample at the end.
> > > > > >
> > > > > > Some help would be really very good.
> > > > > >
> > > > > > Thanks so far and
> > > > > > best regards
> > > > > > Best regards,
> > > > > > Manfred Braun
> > > > > >
> > > > > > (Private)
> > > > > > Lange Roetterstrasse 7
> > > > > > D68167 Mannheim
> > > > > > Germany
> > > > > >
> > > > > > mailto:_manfred.braun_@manfbraun.de
> > > > > > Phone : +49-621-37 53 86
> > > > > > (Remove the anti-spam-underscore to mail me!)
> > > > > >
> > > > > > /*
> > > > > > Name: WMIAsyncQuerySampleReconnectSample5a.cs
> > > > > > */
> > > > > >
> > > > > > using System;
> > > > > > using System.Management;
> > > > > >
> > > > > > class Sample_ManagementEventWatcher
> > > > > > {
> > > > > > [STAThread]
> > > > > > public static int Main(string[] args)
> > > > > > {
> > > > > > if(args.Length != 0)
> > > > > > {
> > > > > > string comp = args[0];
> > > > > >
> > > > > > MyHandler mh;
> > > > > > EventArrivedEventHandler eventArrivedEventHandler;
> > > > > > ManagementEventWatcher watcher;
> > > > > >
> > > > > > mh = new MyHandler();
> > > > > > eventArrivedEventHandler = new
> > > EventArrivedEventHandler(mh.Arrived);
> > > > > > watcher = Sample_ManagementEventWatcher.getWatcher(comp);
> > > > > > watcher.EventArrived += eventArrivedEventHandler;
> > > > > >
> > > > > > watcher.Start(); //Access denied!
> > > > > > Console.WriteLine("Watcher is running, press <enter> to[/color]
> > stop...");[color=darkred]
> > > > > > Console.ReadLine();
> > > > > > watcher.Stop();
> > > > > > watcher.EventArrived -= eventArrivedEventHandler;
> > > > > > }
> > > > > > else
> > > > > > Console.WriteLine("Args!!! [P1=Computername]");
> > > > > >
> > > > > > return 0;
> > > > > > }
> > > > > >
> > > > > > public static ManagementEventWatcher getWatcher(string comp)
> > > > > > {
> > > > > > ConnectionOptions co;
> > > > > > ManagementPath mp;
> > > > > > ManagementScope ms;
> > > > > > WqlEventQuery EventQuery;
> > > > > > ManagementEventWatcher watcher;
> > > > > > string wql;
> > > > > >
> > > > > > co = new ConnectionOptions();
> > > > > > co.Timeout = new TimeSpan(0, 0, 60);
> > > > > > co.EnablePrivileges = true;
> > > > > >
> > > > > > mp = new ManagementPath();
> > > > > > mp.NamespacePath = @"\root\cimv2";
> > > > > > mp.Server = comp;
> > > > > > ms = new ManagementScope(mp, co);
> > > > > >
> > > > > > wql = "select * from __instancecreationevent where[/color][/color]
> targetinstance[color=green][color=darkred]
> > > isa
> > > > > > 'Win32_NTLogEvent'";
> > > > > > EventQuery = new WqlEventQuery(wql);
> > > > > >
> > > > > > watcher = new ManagementEventWatcher(ms, EventQuery);
> > > > > >
> > > > > > return watcher;
> > > > > > }
> > > > > >
> > > > > >
> > > > > > public class MyHandler
> > > > > > {
> > > > > > public void Arrived(object sender, EventArrivedEventArgs e)
> > > > > > {
> > > > > > ManagementBaseObject mbo =
> > > > > > (ManagementBaseObject)e.NewEvent["TargetInstance"];
> > > > > > Console.WriteLine("Event:{0}", mbo["message"]);
> > > > > > }
> > > > > > }
> > > > > >
> > > > > > }//Namespace.
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > >[/color]
> >
> >[/color]
>[/color]


Manfred Braun
Guest
 
Posts: n/a
#9: Nov 15 '05

re: Please help with [STAThread], WMI and access denied


Hello Andy,

that's the best news I heard about this !!!!! Ok, not that bugs are all the
time good news, but if there
is a solution .... ;-) ;-)

I have a lot of ASP.Net page using the framework and I was to "shy" to triy
this, but now, I have a good reason. I'll do the update shortly and will see
and answer, if this helps/or other results.

Thanks a lot and
best regards,
Manfred

"Andy Cheung [MSFT]" <hangc@online.microsoft.com> wrote in message
news:3fd0ebd5@news.microsoft.com...[color=blue]
> This is a known bug in System.Management.dll in .NET Framework v1.0. The[/color]
bug[color=blue]
> that prevents WMI privileges from propagating from managed code running on
> STAThread to WMI core. Applying [MTAThread] to the calling thread appears[/color]
to[color=blue]
> be a partial workaround to this problem as Access Denied would still be
> returned on the second time of event subscription. This problem should be
> fixed in .NET Framework v1.1. Have you tried running your application with
> v1.1?
>
> --
> Andy Cheung
> Microsoft WMI Test Engineer
> This posting is provided "As Is" with no warranties, and confers no[/color]
rights.[color=blue]
> Use of included script samples are subject to the terms specified at
> http://www.microsoft.com/info/cpyright.htm
>
>
> "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> news:eUb$IZ0uDHA.2432@TK2MSFTNGP10.phx.gbl...[color=green]
> > Hello Willy,
> >
> > thanks a lot, I had not understand this completely, and so I tried to[/color][/color]
use[color=blue][color=green]
> > the [STAThread], because my code, using a [MTAThread] fails to[/color][/color]
re-connect.[color=blue][color=green]
> > Using ManagementEventWatcher.Start(), followed by .Stop() and another
> > .Start() failes also with access denied using the [MTAThread] attribute.
> >
> > As a test, I opened a direct connection to WMI via the
> > ManagementScope.Connect(), left this connection open, do a .Start(),
> > followed by a .Stop() and another .Start() and this works! So I have to
> > assume, the the ConnectionOptions.EnablePrivileges is not passed to my
> > second ManagementEventWatcher.Start() code. This now looks like a bug[/color][/color]
for[color=blue][color=green]
> > me. Because I really want to connect to a huge number of computers with[/color][/color]
a[color=blue][color=green]
> > service, I would not use the Scope.Connect(), because I assume, it would
> > need much more resources.
> >
> > Do you, or maybe someone else, have a good hint to handle this[/color][/color]
situation?[color=blue]
> I[color=green]
> > am lerning C# and the framework, but I cannot code this in C++.
> >
> > Thanks so far and
> > best regards,
> > Manfred
> >
> >
> > "Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in message
> > news:eF%23Ha3wuDHA.1576@TK2MSFTNGP11.phx.gbl...[color=darkred]
> > > Manfred,
> > >
> > > WMI provider COM objects are "free" threaded, that means they need to[/color][/color]
> run[color=green]
> > in[color=darkred]
> > > a MTA thread.
> > > When your main thread is initialized for STA, the Management classes[/color][/color]
> check[color=green][color=darkred]
> > > the current apartment for MTA compatibility, and will create a new[/color][/color]
> thread[color=green][color=darkred]
> > > and enter the MTA to create the COM objects, COM will marshal the[/color]
> > interfaces[color=darkred]
> > > between the STA thread (running your managed code) and the MTA thread
> > > running the native COM code.
> > > But, your main thread (STA) has enabled the SeSecurityPrivilege for[/color][/color][/color]
the[color=blue][color=green]
> > main[color=darkred]
> > > thread, but this privilege is not propagated to the MTA thread,[/color][/color]
> resulting[color=green]
> > in[color=darkred]
> > > an access denied exception.
> > > Therefore I suggest you allways run your code on an MTA thread, the[/color][/color][/color]
net[color=blue][color=green][color=darkred]
> > > benifits are
> > > - no marshaling overhead
> > > - no difficult to track security issues.
> > > - no issues due to eventsink marshalin between MTA and STA threads.
> > >
> > > Willy.
> > >
> > > "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> > > news:eC9fFgruDHA.2712@TK2MSFTNGP11.phx.gbl...
> > > > Hi All,
> > > >
> > > > interestingly, in one of my latest tests, I found privilege failure[/color]
> > audit[color=darkred]
> > > in
> > > > the eventlog, claming the denied access to the right[/color][/color]
> SeSecurityPrivilege[color=green][color=darkred]
> > > > .....
> > > >
> > > > With this in mind, I changed the query in my sample
> > > >
> > > > from:
> > > > select * from __instancecreationevent where targetinstance isa
> > > > 'Win32_NTLogEvent'";
> > > >
> > > > to:
> > > > "select * from __instancecreationevent where TargetInstance isa
> > > > 'Win32_NTLogEvent' and TargetInstance.LogFile = 'Application'";
> > > >
> > > > This is working. But this means, that setting the
> > > > ConnectionOptions.EnablePrivileges = true has no effect using the
> > > > ManagementEventWatcher. But in the constructor, I pass a[/color]
> > ManagementScope,[color=darkred]
> > > > with this option set!
> > > >
> > > > I found no information inside the SDK in the EventWatcherOptions or[/color][/color]
> the[color=green][color=darkred]
> > > > WqlEventQuery about security. But even all this does not explain[/color][/color][/color]
that[color=blue][color=green][color=darkred]
> > > after
> > > > a first connect, a second one fails and does not explain what this[/color][/color][/color]
has[color=blue][color=green]
> > to[color=darkred]
> > > do
> > > > with setting the [xxxThread] option for my Main() function.
> > > >
> > > > Any help would be really very welcomed!
> > > >
> > > > Thanks so far and
> > > > best regards,
> > > > Manfred
> > > >
> > > >
> > > > "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> > > > news:OKjZnMruDHA.536@tk2msftngp13.phx.gbl...
> > > > > Hello Willy,
> > > > >
> > > > > oh, yes and sorry for my inaccuracy about the environment. I am[/color][/color]
> using[color=green][color=darkred]
> > > > > Windows 2000 Server, english, SP3, dot.net runtime 1.0, english[/color][/color][/color]
too.[color=blue]
> I[color=green][color=darkred]
> > > am
> > > > > working in an NT4 domain with logged-on account domain admin and[/color][/color][/color]
the[color=blue][color=green]
> > W2K[color=darkred]
> > > > > machine are domain members.
> > > > >
> > > > > And my chain of experiments always seems to return different[/color][/color][/color]
results[color=blue][color=green][color=darkred]
> > > ....
> > > > > I used two production machines, just to be sure, that not some[/color]
> > fumbling[color=darkred]
> > > > ;-)
> > > > > on my admin machine have caused that. Accidentally, on the next[/color]
> > machine,[color=darkred]
> > > I
> > > > > found a new behavior:Both versions are not running. After finding[/color][/color]
> and[color=green][color=darkred]
> > > > > removing some <account deleted> entries from the ACLs with[/color][/color][/color]
DCOMCNFG,[color=blue][color=green]
> > the[color=darkred]
> > > > > behavior return to that, what I originally described and this is[/color][/color][/color]
on[color=blue][color=green]
> > all[color=darkred]
> > > my
> > > > > W2K machines now really the same. But this last experiment tells[/color][/color][/color]
me,[color=blue][color=green]
> > it[color=darkred]
> > > > > could have something to do with DCOM and/or WMI settings, which[/color][/color][/color]
are[color=blue][color=green][color=darkred]
> > > > normally
> > > > > remains at the OS defaults.
> > > > >
> > > > > Thanks so far and
> > > > > best regards,
> > > > > Manfred
> > > > >
> > > > > "Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in[/color][/color]
> message[color=green][color=darkred]
> > > > > news:OpphItouDHA.1996@TK2MSFTNGP12.phx.gbl...
> > > > > > Works for me with both, STA and MTAThread attribute set.
> > > > > >
> > > > > > What OS are you runnng?
> > > > > >
> > > > > > Willy.
> > > > > >
> > > > > >
> > > > > > <__mabra__@be.de> wrote in message
> > > > > > news:uEBfsHouDHA.2248@TK2MSFTNGP09.phx.gbl...
> > > > > > > Hi All,
> > > > > > >
> > > > > > > I have allready tried to ask a similar question
> > > [WQLEventQuery:Second
> > > > > > local
> > > > > > > connect:Access denied!], but got no answer until now. In the
> > > meantime,
> > > > I
> > > > > > > found, that I cannot understand some thread-settings for the[/color]
> > Main()[color=darkred]
> > > > > > function
> > > > > > > [I am using C#].
> > > > > > > If I use the [STAThread] attribute for the Main() function, I[/color][/color]
> get[color=green][color=darkred]
> > > > > "access
> > > > > > > denied error", if I use a ManagementEventWatcher to connect to[/color][/color]
> the[color=green][color=darkred]
> > > > local
> > > > > > > machine to receive events. Is there anybody out there, how[/color]
> > possibly[color=darkred]
> > > > can
> > > > > > > explain why this happens?? If I remove this attribute or use
> > > > [MTAThread]
> > > > > > > instead it works one time.
> > > > > > > I append a short sample at the end.
> > > > > > >
> > > > > > > Some help would be really very good.
> > > > > > >
> > > > > > > Thanks so far and
> > > > > > > best regards
> > > > > > > Best regards,
> > > > > > > Manfred Braun
> > > > > > >
> > > > > > > (Private)
> > > > > > > Lange Roetterstrasse 7
> > > > > > > D68167 Mannheim
> > > > > > > Germany
> > > > > > >
> > > > > > > mailto:_manfred.braun_@manfbraun.de
> > > > > > > Phone : +49-621-37 53 86
> > > > > > > (Remove the anti-spam-underscore to mail me!)
> > > > > > >
> > > > > > > /*
> > > > > > > Name: WMIAsyncQuerySampleReconnectSample5a.cs
> > > > > > > */
> > > > > > >
> > > > > > > using System;
> > > > > > > using System.Management;
> > > > > > >
> > > > > > > class Sample_ManagementEventWatcher
> > > > > > > {
> > > > > > > [STAThread]
> > > > > > > public static int Main(string[] args)
> > > > > > > {
> > > > > > > if(args.Length != 0)
> > > > > > > {
> > > > > > > string comp = args[0];
> > > > > > >
> > > > > > > MyHandler mh;
> > > > > > > EventArrivedEventHandler eventArrivedEventHandler;
> > > > > > > ManagementEventWatcher watcher;
> > > > > > >
> > > > > > > mh = new MyHandler();
> > > > > > > eventArrivedEventHandler = new
> > > > EventArrivedEventHandler(mh.Arrived);
> > > > > > > watcher = Sample_ManagementEventWatcher.getWatcher(comp);
> > > > > > > watcher.EventArrived += eventArrivedEventHandler;
> > > > > > >
> > > > > > > watcher.Start(); //Access denied!
> > > > > > > Console.WriteLine("Watcher is running, press <enter> to
> > > stop...");
> > > > > > > Console.ReadLine();
> > > > > > > watcher.Stop();
> > > > > > > watcher.EventArrived -= eventArrivedEventHandler;
> > > > > > > }
> > > > > > > else
> > > > > > > Console.WriteLine("Args!!! [P1=Computername]");
> > > > > > >
> > > > > > > return 0;
> > > > > > > }
> > > > > > >
> > > > > > > public static ManagementEventWatcher getWatcher(string comp)
> > > > > > > {
> > > > > > > ConnectionOptions co;
> > > > > > > ManagementPath mp;
> > > > > > > ManagementScope ms;
> > > > > > > WqlEventQuery EventQuery;
> > > > > > > ManagementEventWatcher watcher;
> > > > > > > string wql;
> > > > > > >
> > > > > > > co = new ConnectionOptions();
> > > > > > > co.Timeout = new TimeSpan(0, 0, 60);
> > > > > > > co.EnablePrivileges = true;
> > > > > > >
> > > > > > > mp = new ManagementPath();
> > > > > > > mp.NamespacePath = @"\root\cimv2";
> > > > > > > mp.Server = comp;
> > > > > > > ms = new ManagementScope(mp, co);
> > > > > > >
> > > > > > > wql = "select * from __instancecreationevent where[/color]
> > targetinstance[color=darkred]
> > > > isa
> > > > > > > 'Win32_NTLogEvent'";
> > > > > > > EventQuery = new WqlEventQuery(wql);
> > > > > > >
> > > > > > > watcher = new ManagementEventWatcher(ms, EventQuery);
> > > > > > >
> > > > > > > return watcher;
> > > > > > > }
> > > > > > >
> > > > > > >
> > > > > > > public class MyHandler
> > > > > > > {
> > > > > > > public void Arrived(object sender, EventArrivedEventArgs e)
> > > > > > > {
> > > > > > > ManagementBaseObject mbo =
> > > > > > > (ManagementBaseObject)e.NewEvent["TargetInstance"];
> > > > > > > Console.WriteLine("Event:{0}", mbo["message"]);
> > > > > > > }
> > > > > > > }
> > > > > > >
> > > > > > > }//Namespace.
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > >
> > > >
> > >
> > >[/color]
> >[/color]
>
>[/color]

Manfred Braun
Guest
 
Posts: n/a
#10: Nov 15 '05

re: Please help with [STAThread], WMI and access denied


Hello Andy and All,

a lot of thanks for the help again! After upgrading to runtime V1.1 the same
code is excact doing what I expect!!!

A lot of thanks and
best regards,
Manfred

"Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
news:%23VRWPC3uDHA.1888@TK2MSFTNGP10.phx.gbl...[color=blue]
> Hello Andy,
>
> that's the best news I heard about this !!!!! Ok, not that bugs are all[/color]
the[color=blue]
> time good news, but if there
> is a solution .... ;-) ;-)
>
> I have a lot of ASP.Net page using the framework and I was to "shy" to[/color]
triy[color=blue]
> this, but now, I have a good reason. I'll do the update shortly and will[/color]
see[color=blue]
> and answer, if this helps/or other results.
>
> Thanks a lot and
> best regards,
> Manfred
>
> "Andy Cheung [MSFT]" <hangc@online.microsoft.com> wrote in message
> news:3fd0ebd5@news.microsoft.com...[color=green]
> > This is a known bug in System.Management.dll in .NET Framework v1.0. The[/color]
> bug[color=green]
> > that prevents WMI privileges from propagating from managed code running[/color][/color]
on[color=blue][color=green]
> > STAThread to WMI core. Applying [MTAThread] to the calling thread[/color][/color]
appears[color=blue]
> to[color=green]
> > be a partial workaround to this problem as Access Denied would still be
> > returned on the second time of event subscription. This problem should[/color][/color]
be[color=blue][color=green]
> > fixed in .NET Framework v1.1. Have you tried running your application[/color][/color]
with[color=blue][color=green]
> > v1.1?
> >
> > --
> > Andy Cheung
> > Microsoft WMI Test Engineer
> > This posting is provided "As Is" with no warranties, and confers no[/color]
> rights.[color=green]
> > Use of included script samples are subject to the terms specified at
> > http://www.microsoft.com/info/cpyright.htm
> >
> >
> > "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> > news:eUb$IZ0uDHA.2432@TK2MSFTNGP10.phx.gbl...[color=darkred]
> > > Hello Willy,
> > >
> > > thanks a lot, I had not understand this completely, and so I tried to[/color][/color]
> use[color=green][color=darkred]
> > > the [STAThread], because my code, using a [MTAThread] fails to[/color][/color]
> re-connect.[color=green][color=darkred]
> > > Using ManagementEventWatcher.Start(), followed by .Stop() and another
> > > .Start() failes also with access denied using the [MTAThread][/color][/color][/color]
attribute.[color=blue][color=green][color=darkred]
> > >
> > > As a test, I opened a direct connection to WMI via the
> > > ManagementScope.Connect(), left this connection open, do a .Start(),
> > > followed by a .Stop() and another .Start() and this works! So I have[/color][/color][/color]
to[color=blue][color=green][color=darkred]
> > > assume, the the ConnectionOptions.EnablePrivileges is not passed to my
> > > second ManagementEventWatcher.Start() code. This now looks like a bug[/color][/color]
> for[color=green][color=darkred]
> > > me. Because I really want to connect to a huge number of computers[/color][/color][/color]
with[color=blue]
> a[color=green][color=darkred]
> > > service, I would not use the Scope.Connect(), because I assume, it[/color][/color][/color]
would[color=blue][color=green][color=darkred]
> > > need much more resources.
> > >
> > > Do you, or maybe someone else, have a good hint to handle this[/color][/color]
> situation?[color=green]
> > I[color=darkred]
> > > am lerning C# and the framework, but I cannot code this in C++.
> > >
> > > Thanks so far and
> > > best regards,
> > > Manfred
> > >
> > >
> > > "Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in message
> > > news:eF%23Ha3wuDHA.1576@TK2MSFTNGP11.phx.gbl...
> > > > Manfred,
> > > >
> > > > WMI provider COM objects are "free" threaded, that means they need[/color][/color][/color]
to[color=blue][color=green]
> > run[color=darkred]
> > > in
> > > > a MTA thread.
> > > > When your main thread is initialized for STA, the Management classes[/color]
> > check[color=darkred]
> > > > the current apartment for MTA compatibility, and will create a new[/color]
> > thread[color=darkred]
> > > > and enter the MTA to create the COM objects, COM will marshal the
> > > interfaces
> > > > between the STA thread (running your managed code) and the MTA[/color][/color][/color]
thread[color=blue][color=green][color=darkred]
> > > > running the native COM code.
> > > > But, your main thread (STA) has enabled the SeSecurityPrivilege for[/color][/color]
> the[color=green][color=darkred]
> > > main
> > > > thread, but this privilege is not propagated to the MTA thread,[/color]
> > resulting[color=darkred]
> > > in
> > > > an access denied exception.
> > > > Therefore I suggest you allways run your code on an MTA thread, the[/color][/color]
> net[color=green][color=darkred]
> > > > benifits are
> > > > - no marshaling overhead
> > > > - no difficult to track security issues.
> > > > - no issues due to eventsink marshalin between MTA and STA threads.
> > > >
> > > > Willy.
> > > >
> > > > "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> > > > news:eC9fFgruDHA.2712@TK2MSFTNGP11.phx.gbl...
> > > > > Hi All,
> > > > >
> > > > > interestingly, in one of my latest tests, I found privilege[/color][/color][/color]
failure[color=blue][color=green][color=darkred]
> > > audit
> > > > in
> > > > > the eventlog, claming the denied access to the right[/color]
> > SeSecurityPrivilege[color=darkred]
> > > > > .....
> > > > >
> > > > > With this in mind, I changed the query in my sample
> > > > >
> > > > > from:
> > > > > select * from __instancecreationevent where targetinstance isa
> > > > > 'Win32_NTLogEvent'";
> > > > >
> > > > > to:
> > > > > "select * from __instancecreationevent where TargetInstance isa
> > > > > 'Win32_NTLogEvent' and TargetInstance.LogFile = 'Application'";
> > > > >
> > > > > This is working. But this means, that setting the
> > > > > ConnectionOptions.EnablePrivileges = true has no effect using the
> > > > > ManagementEventWatcher. But in the constructor, I pass a
> > > ManagementScope,
> > > > > with this option set!
> > > > >
> > > > > I found no information inside the SDK in the EventWatcherOptions[/color][/color][/color]
or[color=blue][color=green]
> > the[color=darkred]
> > > > > WqlEventQuery about security. But even all this does not explain[/color][/color]
> that[color=green][color=darkred]
> > > > after
> > > > > a first connect, a second one fails and does not explain what this[/color][/color]
> has[color=green][color=darkred]
> > > to
> > > > do
> > > > > with setting the [xxxThread] option for my Main() function.
> > > > >
> > > > > Any help would be really very welcomed!
> > > > >
> > > > > Thanks so far and
> > > > > best regards,
> > > > > Manfred
> > > > >
> > > > >
> > > > > "Manfred Braun" <_manfred.braun_@manfbraun.de> wrote in message
> > > > > news:OKjZnMruDHA.536@tk2msftngp13.phx.gbl...
> > > > > > Hello Willy,
> > > > > >
> > > > > > oh, yes and sorry for my inaccuracy about the environment. I am[/color]
> > using[color=darkred]
> > > > > > Windows 2000 Server, english, SP3, dot.net runtime 1.0, english[/color][/color]
> too.[color=green]
> > I[color=darkred]
> > > > am
> > > > > > working in an NT4 domain with logged-on account domain admin and[/color][/color]
> the[color=green][color=darkred]
> > > W2K
> > > > > > machine are domain members.
> > > > > >
> > > > > > And my chain of experiments always seems to return different[/color][/color]
> results[color=green][color=darkred]
> > > > ....
> > > > > > I used two production machines, just to be sure, that not some
> > > fumbling
> > > > > ;-)
> > > > > > on my admin machine have caused that. Accidentally, on the next
> > > machine,
> > > > I
> > > > > > found a new behavior:Both versions are not running. After[/color][/color][/color]
finding[color=blue][color=green]
> > and[color=darkred]
> > > > > > removing some <account deleted> entries from the ACLs with[/color][/color]
> DCOMCNFG,[color=green][color=darkred]
> > > the
> > > > > > behavior return to that, what I originally described and this is[/color][/color]
> on[color=green][color=darkred]
> > > all
> > > > my
> > > > > > W2K machines now really the same. But this last experiment tells[/color][/color]
> me,[color=green][color=darkred]
> > > it
> > > > > > could have something to do with DCOM and/or WMI settings, which[/color][/color]
> are[color=green][color=darkred]
> > > > > normally
> > > > > > remains at the OS defaults.
> > > > > >
> > > > > > Thanks so far and
> > > > > > best regards,
> > > > > > Manfred
> > > > > >
> > > > > > "Willy Denoyette [MVP]" <willy.denoyette@pandora.be> wrote in[/color]
> > message[color=darkred]
> > > > > > news:OpphItouDHA.1996@TK2MSFTNGP12.phx.gbl...
> > > > > > > Works for me with both, STA and MTAThread attribute set.
> > > > > > >
> > > > > > > What OS are you runnng?
> > > > > > >
> > > > > > > Willy.
> > > > > > >
> > > > > > >
> > > > > > > <__mabra__@be.de> wrote in message
> > > > > > > news:uEBfsHouDHA.2248@TK2MSFTNGP09.phx.gbl...
> > > > > > > > Hi All,
> > > > > > > >
> > > > > > > > I have allready tried to ask a similar question
> > > > [WQLEventQuery:Second
> > > > > > > local
> > > > > > > > connect:Access denied!], but got no answer until now. In the
> > > > meantime,
> > > > > I
> > > > > > > > found, that I cannot understand some thread-settings for the
> > > Main()
> > > > > > > function
> > > > > > > > [I am using C#].
> > > > > > > > If I use the [STAThread] attribute for the Main() function,[/color][/color][/color]
I[color=blue][color=green]
> > get[color=darkred]
> > > > > > "access
> > > > > > > > denied error", if I use a ManagementEventWatcher to connect[/color][/color][/color]
to[color=blue][color=green]
> > the[color=darkred]
> > > > > local
> > > > > > > > machine to receive events. Is there anybody out there, how
> > > possibly
> > > > > can
> > > > > > > > explain why this happens?? If I remove this attribute or use
> > > > > [MTAThread]
> > > > > > > > instead it works one time.
> > > > > > > > I append a short sample at the end.
> > > > > > > >
> > > > > > > > Some help would be really very good.
> > > > > > > >
> > > > > > > > Thanks so far and
> > > > > > > > best regards
> > > > > > > > Best regards,
> > > > > > > > Manfred Braun
> > > > > > > >
> > > > > > > > (Private)
> > > > > > > > Lange Roetterstrasse 7
> > > > > > > > D68167 Mannheim
> > > > > > > > Germany
> > > > > > > >
> > > > > > > > mailto:_manfred.braun_@manfbraun.de
> > > > > > > > Phone : +49-621-37 53 86
> > > > > > > > (Remove the anti-spam-underscore to mail me!)
> > > > > > > >
> > > > > > > > /*
> > > > > > > > Name: WMIAsyncQuerySampleReconnectSample5a.cs
> > > > > > > > */
> > > > > > > >
> > > > > > > > using System;
> > > > > > > > using System.Management;
> > > > > > > >
> > > > > > > > class Sample_ManagementEventWatcher
> > > > > > > > {
> > > > > > > > [STAThread]
> > > > > > > > public static int Main(string[] args)
> > > > > > > > {
> > > > > > > > if(args.Length != 0)
> > > > > > > > {
> > > > > > > > string comp = args[0];
> > > > > > > >
> > > > > > > > MyHandler mh;
> > > > > > > > EventArrivedEventHandler eventArrivedEventHandler;
> > > > > > > > ManagementEventWatcher watcher;
> > > > > > > >
> > > > > > > > mh = new MyHandler();
> > > > > > > > eventArrivedEventHandler = new
> > > > > EventArrivedEventHandler(mh.Arrived);
> > > > > > > > watcher =[/color][/color][/color]
Sample_ManagementEventWatcher.getWatcher(comp);[color=blue][color=green][color=darkred]
> > > > > > > > watcher.EventArrived += eventArrivedEventHandler;
> > > > > > > >
> > > > > > > > watcher.Start(); //Access denied!
> > > > > > > > Console.WriteLine("Watcher is running, press <enter> to
> > > > stop...");
> > > > > > > > Console.ReadLine();
> > > > > > > > watcher.Stop();
> > > > > > > > watcher.EventArrived -= eventArrivedEventHandler;
> > > > > > > > }
> > > > > > > > else
> > > > > > > > Console.WriteLine("Args!!! [P1=Computername]");
> > > > > > > >
> > > > > > > > return 0;
> > > > > > > > }
> > > > > > > >
> > > > > > > > public static ManagementEventWatcher getWatcher(string[/color][/color][/color]
comp)[color=blue][color=green][color=darkred]
> > > > > > > > {
> > > > > > > > ConnectionOptions co;
> > > > > > > > ManagementPath mp;
> > > > > > > > ManagementScope ms;
> > > > > > > > WqlEventQuery EventQuery;
> > > > > > > > ManagementEventWatcher watcher;
> > > > > > > > string wql;
> > > > > > > >
> > > > > > > > co = new ConnectionOptions();
> > > > > > > > co.Timeout = new TimeSpan(0, 0, 60);
> > > > > > > > co.EnablePrivileges = true;
> > > > > > > >
> > > > > > > > mp = new ManagementPath();
> > > > > > > > mp.NamespacePath = @"\root\cimv2";
> > > > > > > > mp.Server = comp;
> > > > > > > > ms = new ManagementScope(mp, co);
> > > > > > > >
> > > > > > > > wql = "select * from __instancecreationevent where
> > > targetinstance
> > > > > isa
> > > > > > > > 'Win32_NTLogEvent'";
> > > > > > > > EventQuery = new WqlEventQuery(wql);
> > > > > > > >
> > > > > > > > watcher = new ManagementEventWatcher(ms, EventQuery);
> > > > > > > >
> > > > > > > > return watcher;
> > > > > > > > }
> > > > > > > >
> > > > > > > >
> > > > > > > > public class MyHandler
> > > > > > > > {
> > > > > > > > public void Arrived(object sender, EventArrivedEventArgs[/color][/color][/color]
e)[color=blue][color=green][color=darkred]
> > > > > > > > {
> > > > > > > > ManagementBaseObject mbo =
> > > > > > > > (ManagementBaseObject)e.NewEvent["TargetInstance"];
> > > > > > > > Console.WriteLine("Event:{0}", mbo["message"]);
> > > > > > > > }
> > > > > > > > }
> > > > > > > >
> > > > > > > > }//Namespace.
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > >
> > > >
> > > >
> > >[/color]
> >
> >[/color]
>[/color]

Closed Thread