Chapter 4: WMI Security Scripting

4.1 Objective

Previously, we discovered how to manage various components of Windows. In some cases, we saw that the security configuration is part of the component management. In this chapter, we will discover the WMI capabilities to manage the security settings of various Windows components, such as files, folders, and shares on the file system; Active Directory objects; and CIM repository namespaces. Although quite specific, the manipulation of the security settings, defined by security descriptors, is one of the most complex tasks to script. This chapter will explain the security descriptor components, their roles, and how to decipher them. One of the goals is to help you navigate between the various challenges that you face when automating and maintaining the security configuration under Windows. Beyond that, we will also see the security implication when developing ASP WMI-enabled scripts for Internet Information Server and how the Microsoft security push initiative in early 2002 affects WMI scripting under Windows Server 2003.