I am trying to get notification from a remote machine 's event viewer using WMI and C#. I am able to connect the system and also get event log by using ManagementObjectSearcher
. But when I tried to use ManagementEventWatcher.Start
method I am getting a exception:
Access is denied. (Exception from HRESULT: 0x80070005
(E_ACCESSDENIED))
I have given the permisions in WMI Control to root\cimv2
and also given the admin rights to the user's account in DCOM Config.
I have normal windows application hence I am not using ASP.net(ASPNET user) in my case.
My code is:
ConnectionOptions connectionOptions = new ConnectionOptions();
connectionOptions.Username = @"Domain\UName";//txtUserName.Text;
connectionOptions.Password = "pass";//txtPassword.Text;
connectionOptions.Impersonation = ImpersonationLevel.Impersonate;
ManagementScope managementScope = new ManagementScope(@"\\server\root\cimv2",connectionOptions);
managementScope.Options.EnablePrivileges = true;
managementScope.Connect(); // this line is executing fine.
eventWatcher = new ManagementEventWatcher(managementScope, new EventQuery("Select * From __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' and TargetInstance.LogFile = 'Application'"));
eventWatcher.EventArrived += new EventArrivedEventHandler(Arrived);
eventWatcher.Scope.Options.EnablePrivileges = true;
eventWatcher.Start(); // Error occurs here
Best Answer
First, keep in mind that Microsoft recommends the use of semi-synchronous operations (as Brian suggested):
See also Setting Security on an Asynchronous Call in VBScript.
If you still want to use Async operations, refer to the following articles:
YMMV, but for me (Client: Win7 x64 SP1 Server: Windows Server 2008 Enterprise SP2 w/o firewall) the solution for the
E_ACCESSDENIED
exception was found in the third article:Note that I did the above in the client. While that fixed the DCOM permission problem for me, I then encountered WMI access denied errors (
0x80041003
). Turns out it was due to a registry key mentioned in the second article:Note that you need to set the above in the server. Once I did that, async callbacks worked. Other things you could try are running your client as an administrator and setting ConnectionOptions.EnablePrivileges to true.
For troubleshooting see:
Finally, I recommend you take advantage of Microsoft's WMI tester (
%windir%\system32\wbem\wbemtest.exe
)