Use DSC to manage WMI namespace security

Almost 6 years ago, I wrote some PowerShell scripts in a multi-part series explaining WMI namespace security and also how to manage them using PowerShell. If you’re not familiar with WMI namespace security, I recommend reading the blog posts above or even as a refresher.

I received some feedback fairly recently about some issues and this presented itself as an opportunity for me to revisit this topic, but rewrite it as a DSC resource using the new PowerShell Classes syntax.

Since I’m using PowerShell classes, you’ll need either Windows 10, Windows Server 2016 Preview, or Windows Management Framework 5.0 installed.

Using DSC, you can configure WMI namespace security much more simply using a declarative language:

configuration Sample {
    Import-DSCResource -ModuleName WmiNamespaceSecurity
    WMINamespaceSecurity Jason {
        Path = "root/cimv2"
        Principal = "Jason"
        AppliesTo = "Self"
        AccessType = "Allow"
        Permission = "Enable", "MethodExecute", "ProviderWrite"
        Ensure = "Present"
    }
    WMINamespaceSecurity Steve {
        Path = "root/cimv2"
        Principal = "Contoso\Steve"
        AppliesTo = "Children"
        AccessType = "Deny"
        Permission = "Enable", "MethodExecute", "ProviderWrite", "RemoteAccess"
        Ensure = "Present"
    }
}

Here, I’m allowing a local user called Jason access to the root/cimv2 namespace and denying a domain user called Steve from the same namespace. This configuration should be much easier to read and maintain.

Once you’ve authored your configuration document, you can execute it like a function and start DSC to apply the resulting mof:

. .\Sample.ps1
Sample -OutputPath c:\temp
Start-DSCConfiguration -Path c:\temp -Wait -Verbose -Force

If you want to try the sample, be sure to change the principals to real user accounts in your environment, otherwise you’ll get an error when you use Start-DSCConfiguration and this DSC resource gets executed.

Please provide feedback, reports bugs, or submit changes as pull requests as issues in the GitHub repository.

If you just want to use this resource, you can install it from the PowerShell Gallery:

Install-Module WmiNamespaceSecurity -Scope AllUsers
# AllUsers is needed for DSC Local Configuration Manager (LCM) which runs as LocalSystem

Steve Lee
Principal Software Engineer Manager
PowerShell Core