4.15 Summary

In this chapter, besides the IIS configuration regarding WMI and the WMI security changes driven by the security push initiative, we discussed how security descriptors are structured and how they can be deciphered, based on:

The selected Operating System (Windows NT 4.0/Windows 2000 versus Windows XP/Windows Server 2003)
The security descriptor origin (file, folders, Active Directory, etc.)
The security descriptor object model representation (WMI versus ADSI)

The management of the security descriptor clearly shows the limitation of WMI in respect to some secured objects. The complementary nature of ADSI and CDOEXM are, of course, a great help in offering good management coverage of most common security descriptors. However, this requires an extended knowledge of these two technologies, which complicates the scripting techniques. Hopefully, to minimize the learning curve of WMI, ADSI, and CDOEXM, the WMIManageSD.Wsf script is generic enough to easily extend its security descriptor management capabilities to support other securable objects, on the condition that some COM components are available to offer a scriptable access.