VB.net WMI Win32_NtlogEven t problem, please help

[Jason80]

First I wrote some _VBScript to get info from OS, and now I wrote some code
in VB.Net, and I have a problem now.

Look at this script in vbs

List1.vbs:

strComputer = "."

Set objWMIService = GetObject("winm gmts:\\" & strComputer & "\root\cimv 2")

strWQL="SELECT * FROM __InstanceCreat ionEvent WITHIN 5 WHERE
TargetInstance ISA ""Win32_NTLogEv ent"" "

Set objEventSource = objWMIService.E xecNotification Query(strWQL)

Do

Set objLatestEvent = colMonitoredEve nts.NextEvent

Wscript.Echo "OK"

Loop

I use it to register the Win32_ntlogEven t , so that i can get some info
where a new log written into the logfiles. List1 works very well on Windows
2003 Server, but when I try it on Windows 2000 Server, it echoed the
connection was refused .

So I edited it into List2,

strComputer = "."

Set objWMIService = GetObject("winm gmts:" & "{impersonation Level=
impersonate, (Security)}!\\" & strComputer & "\root\cimv 2")

Set colMonitoredEve nts = objWMIService.E xecNotification Query _

("Select * from __instancecreat ionevent WITHIN 5 where TargetInstance
isa 'Win32_NTLogEve nt' ")

Do

Set objLatestEvent = colMonitoredEve nts.NextEvent

Wscript.Echo "OK"

Loop

and list2 works well on Window2000. i noticed the security setting so when I
wrote the code(List3) in vb.net, I added

" watcher.Scope.O ptions.Imperson ation = ImpersonationLe vel.Impersonate

watcher.Scope.O ptions.Authenti cation = AuthenticationL evel.Default

" options in the vb.net code, but the bin still can not run on windows2000,
while it works well on Server2003.

i am puzzled! : ( ,

List3:
Imports System.manageme nt

Module Module1

Sub main()

Dim eventQuery As New EventQuery("SEL ECT * FROM
__InstanceCreat ionEvent WHERE TargetInstance ISA 'Win32_NTLogEve nt' ")

'Initialize an event watcher object with this query

Dim watcher As New ManagementEvent Watcher

watcher.Scope.P ath.Server = "."

watcher.Scope.P ath.Path = "\\.\root\CIMV2 "

watcher.Scope.P ath.NamespacePa th = "root\CIMV2 "

watcher.Scope.O ptions.Imperson ation = ImpersonationLe vel.Impersonate

watcher.Scope.O ptions.Authenti cation = AuthenticationL evel.Default

watcher.Scope.O ptions.EnablePr ivileges = False

watcher.Query = eventQuery

watcher.Start()

MsgBox("Listeni ng started�")

Dim handler As New EventHandler

AddHandler watcher.EventAr rived, AddressOf handler.HandleE vent

System.Threadin g.Thread.Sleep(-1)

End Sub

End Module

Public Class EventHandler

Public Sub HandleEvent(ByV al sender As Object, ByVal e As
EventArrivedEve ntArgs)

Console.Write(" OK")

End Sub

End Class

but after I changed the Query String to :

'Dim eventQuery As New EventQuery("SEL ECT * FROM __InstanceCreat ionEvent
WHERE TargetInstance ISA 'Win32_NTLogEve nt' and TargetInstance ='Application'
")

The bin could run well under windows2000 too, but if you change the
targetinstance to Security, you get the access denied message again.

So finally i have two questions:

Why can not i register to the Win32_NtlogEven t, bu t i can register to the
application part in Win32_ntlogeven t?

Is that a security problem?

Thank you for you time.

[MarkD VIT]

Hello Jason,

I am not an expert on this but I have written some vb.net code to do
something similar. My understanding is the even if you run this with an
administravtive level account some security permissions are not enabled
unless you explicitly do so.

The line "watcher.Scope. Options.EnableP rivileges = True" allows me to do the
same type of thing.

I have bene running this code on Win XP SP1, Win XP SP2, Win2003, Win2000
Server under .Net 1.1 without any problems. I have upgraded a few test
machines for .Net 1.1 SP1 and I now have security related problems (access
denied on the watcher start command).

The access deinied is driven by trying to access the "security" logfile.
This may be the case for you. I have used the command

Dim q As New WqlEventQuery( _
"__InstanceCrea tionEvent", _
New TimeSpan(0, 0, 10), _
"TargetInst ance ISA ""Win32_NTLogEv ent"" " & _
"and (" & _
"TargetInstance .LogFile = ""Audit Success"" or " & _
"TargetInstance .LogFile = ""Audit Failure"" or " & _
"TargetInstance .LogFile = ""Applicati on"" or " & _
"TargetInstance .LogFile = ""System"" " & _
")")

which explicitly identifies the logfiles of interest (and does not require
EnabledPrivilag es to be set to true).

I hope this helps,
Mark

"Jason80" wrote:

First I wrote some _VBScript to get info from OS, and now I wrote some code
in VB.Net, and I have a problem now.

Look at this script in vbs

List1.vbs:

strComputer = "."

Set objWMIService = GetObject("winm gmts:\\" & strComputer & "\root\cimv 2")

strWQL="SELECT * FROM __InstanceCreat ionEvent WITHIN 5 WHERE
TargetInstance ISA ""Win32_NTLogEv ent"" "

Set objEventSource = objWMIService.E xecNotification Query(strWQL)

Do

Set objLatestEvent = colMonitoredEve nts.NextEvent

Wscript.Echo "OK"

Loop

I use it to register the Win32_ntlogEven t , so that i can get some info
where a new log written into the logfiles. List1 works very well on Windows
2003 Server, but when I try it on Windows 2000 Server, it echoed the
connection was refused .

So I edited it into List2,

strComputer = "."

Set objWMIService = GetObject("winm gmts:" & "{impersonation Level=
impersonate, (Security)}!\\" & strComputer & "\root\cimv 2")

Set colMonitoredEve nts = objWMIService.E xecNotification Query _

("Select * from __instancecreat ionevent WITHIN 5 where TargetInstance
isa 'Win32_NTLogEve nt' ")

Do

Set objLatestEvent = colMonitoredEve nts.NextEvent

Wscript.Echo "OK"

Loop

and list2 works well on Window2000. i noticed the security setting so when I
wrote the code(List3) in vb.net, I added

" watcher.Scope.O ptions.Imperson ation = ImpersonationLe vel.Impersonate

watcher.Scope.O ptions.Authenti cation = AuthenticationL evel.Default

" options in the vb.net code, but the bin still can not run on windows2000,
while it works well on Server2003.

i am puzzled! : ( ,

List3:
Imports System.manageme nt

Module Module1

Sub main()

Dim eventQuery As New EventQuery("SEL ECT * FROM
__InstanceCreat ionEvent WHERE TargetInstance ISA 'Win32_NTLogEve nt' ")

'Initialize an event watcher object with this query

Dim watcher As New ManagementEvent Watcher

watcher.Scope.P ath.Server = "."

watcher.Scope.P ath.Path = "\\.\root\CIMV2 "

watcher.Scope.P ath.NamespacePa th = "root\CIMV2 "

watcher.Scope.O ptions.Imperson ation = ImpersonationLe vel.Impersonate

watcher.Scope.O ptions.Authenti cation = AuthenticationL evel.Default

watcher.Scope.O ptions.EnablePr ivileges = False

watcher.Query = eventQuery

watcher.Start()

MsgBox("Listeni ng started�")

Dim handler As New EventHandler

AddHandler watcher.EventAr rived, AddressOf handler.HandleE vent

System.Threadin g.Thread.Sleep(-1)

End Sub

End Module

Public Class EventHandler

Public Sub HandleEvent(ByV al sender As Object, ByVal e As
EventArrivedEve ntArgs)

Console.Write(" OK")

End Sub

End Class

but after I changed the Query String to :

'Dim eventQuery As New EventQuery("SEL ECT * FROM __InstanceCreat ionEvent
WHERE TargetInstance ISA 'Win32_NTLogEve nt' and TargetInstance ='Application'
")

The bin could run well under windows2000 too, but if you change the
targetinstance to Security, you get the access denied message again.

So finally i have two questions:

Why can not i register to the Win32_NtlogEven t, bu t i can register to the
application part in Win32_ntlogeven t?

Is that a security problem?

Thank you for you time.

[Jason80]

Thank you for your answer, and i have tried the
"watcher.Scope. Options.EnableP rivileges = True"
but i still can not access the whole "Win32_NtlogEve nt" class,
and i can access Application, System. So strange.

Thank you anyway, hope you can get your answer soon

"MarkD VIT@UK" wrote:

Hello Jason,

I am not an expert on this but I have written some vb.net code to do
something similar. My understanding is the even if you run this with an
administravtive level account some security permissions are not enabled
unless you explicitly do so.

The line "watcher.Scope. Options.EnableP rivileges = True" allows me to do the
same type of thing.

I have bene running this code on Win XP SP1, Win XP SP2, Win2003, Win2000
Server under .Net 1.1 without any problems. I have upgraded a few test
machines for .Net 1.1 SP1 and I now have security related problems (access
denied on the watcher start command).

The access deinied is driven by trying to access the "security" logfile.
This may be the case for you. I have used the command

Dim q As New WqlEventQuery( _
"__InstanceCrea tionEvent", _
New TimeSpan(0, 0, 10), _
"TargetInst ance ISA ""Win32_NTLogEv ent"" " & _
"and (" & _
"TargetInstance .LogFile = ""Audit Success"" or " & _
"TargetInstance .LogFile = ""Audit Failure"" or " & _
"TargetInstance .LogFile = ""Applicati on"" or " & _
"TargetInstance .LogFile = ""System"" " & _
")")

which explicitly identifies the logfiles of interest (and does not require
EnabledPrivilag es to be set to true).

I hope this helps,
Mark

[Jason80]

Thank you for your answer, and i have tried the
"watcher.Scope. Options.EnableP rivileges = True"
but i still can not access the whole "Win32_NtlogEve nt" class,
and i can access Application, System. So strange.

Thank you anyway, hope you can get your answer soon

"MarkD VIT@UK" wrote:

Hello Jason,

I am not an expert on this but I have written some vb.net code to do
something similar. My understanding is the even if you run this with an
administravtive level account some security permissions are not enabled
unless you explicitly do so.

The line "watcher.Scope. Options.EnableP rivileges = True" allows me to do the
same type of thing.

I have bene running this code on Win XP SP1, Win XP SP2, Win2003, Win2000
Server under .Net 1.1 without any problems. I have upgraded a few test
machines for .Net 1.1 SP1 and I now have security related problems (access
denied on the watcher start command).

The access deinied is driven by trying to access the "security" logfile.
This may be the case for you. I have used the command

Dim q As New WqlEventQuery( _
"__InstanceCrea tionEvent", _
New TimeSpan(0, 0, 10), _
"TargetInst ance ISA ""Win32_NTLogEv ent"" " & _
"and (" & _
"TargetInstance .LogFile = ""Audit Success"" or " & _
"TargetInstance .LogFile = ""Audit Failure"" or " & _
"TargetInstance .LogFile = ""Applicati on"" or " & _
"TargetInstance .LogFile = ""System"" " & _
")")

which explicitly identifies the logfiles of interest (and does not require
EnabledPrivilag es to be set to true).

I hope this helps,
Mark

[MarkD VIT]

Hi Janson,

There was another discussion I had on this subject in the
microsoft.publi c.dotnet.framew ork group - the subject was

Subject: Problem with .NET 1.1 SP1 - Events

This may help give more details on the subject.

Thanks,
Mark

"Jason80" wrote:

Thank you for your answer, and i have tried the
"watcher.Scope. Options.EnableP rivileges = True"
but i still can not access the whole "Win32_NtlogEve nt" class,
and i can access Application, System. So strange.

Thank you anyway, hope you can get your answer soon

"MarkD VIT@UK" wrote:

Hello Jason,

I am not an expert on this but I have written some vb.net code to do
something similar. My understanding is the even if you run this with an
administravtive level account some security permissions are not enabled
unless you explicitly do so.

The line "watcher.Scope. Options.EnableP rivileges = True" allows me to do the
same type of thing.

I have bene running this code on Win XP SP1, Win XP SP2, Win2003, Win2000
Server under .Net 1.1 without any problems. I have upgraded a few test
machines for .Net 1.1 SP1 and I now have security related problems (access
denied on the watcher start command).

The access deinied is driven by trying to access the "security" logfile.
This may be the case for you. I have used the command

Dim q As New WqlEventQuery( _
"__InstanceCrea tionEvent", _
New TimeSpan(0, 0, 10), _
"TargetInst ance ISA ""Win32_NTLogEv ent"" " & _
"and (" & _
"TargetInstance .LogFile = ""Audit Success"" or " & _
"TargetInstance .LogFile = ""Audit Failure"" or " & _
"TargetInstance .LogFile = ""Applicati on"" or " & _
"TargetInstance .LogFile = ""System"" " & _
")")

which explicitly identifies the logfiles of interest (and does not require
EnabledPrivilag es to be set to true).

I hope this helps,
Mark