so habe nun einige Infos aus den verschiedenen Quellen zusammengetragen und einen für mich scheinbar funktionierenden weg gefunden:
' Author: Duffkess
' Desc: enables a specific user to use the wmi service remotly
' creating needed objects for the wmi_gpo
' objLocalGroup will store the "Distributed COM Users, they are needed to enable remote wmi querys
' objDomainUser will store the user object which will be able to use wmi querys
' objNetwork will be used to get the computername
' wmiUsername is only the preference to set the specific wmi username.. easy hu?
' alreadyInGroup is a simple help flag used to determine if the user is in the group or not
Dim objLocalGroup, objDomainUser, objNetwork, wmiUsername, alreadyInGroup
wmiUsername = "icinga-blabla"
' getting the computername the script is running on
Set objNetwork = CreateObject("Wscript.Network")
strComputer = objNetwork.ComputerName
' bind to local group object.
Set objLocalGroup = GetObject("WinNT://" & strComputer & "/Distributed COM Users")
' bind to domain user object.
Set objDomainUser = GetObject("WinNT://my.domain/" & wmiUsername)
' sets the default of the alreadyInGroup flag
alreadyInGroup = false
' iterates through each member of the group
For Each objMember In objLocalGroup.Members
' check if the user is already in group, if yes sets the alreadyInGroup flag to true
if(objMember.Name = wmiUsername) then
alreadyInGroup = true
End if
Next
' checks if the alreadyInGroup flag is still false, then adds the user,
' if its not in group it adds the user
if(alreadyInGroup = false) then
objLocalGroup.Add(objDomainUser.ADsPath)
End if
' set the security byte array (adding the group distributed com users)
strSD = array(## die security bytes ##)
set namespace = createobject("wbemscripting.swbemlocator").connectserver(,"root")
set security = namespace.get("__systemsecurity=@")
nStatus = security.setsd(strSD)
Das funktioniert aber nur wenn in den DCOM Settings auch die Distributed COM Users eingetragen sind:
http://msdn.microsoft.com/en-us/library/Aa393266.aspx#setting_dcom_security_to_allow_a_user_to_access_a_computer_remotely
Habe das Skript nun einmal Lokal getestet und werde es dann bald mal als GPO ausrollen!
Vielen Dank für die Infos!!
PS: Ja, ich weiß es gibt auch eine IsMember Methode aber irgendwie hats bei mir nich funktioniert..
