CODEWITHSUNDEEP
wmiwmi-query
ServerMonkey
ServerMonkey

Reputation: 1154

WMI Problem on Win7

Anyone understand why the simple Powershell script below works fine under Windows XP but not under Windows 7?

Get-WmiObject -Class win32_logonsession | %{ get-wmiobject -Query "Associators of {Win32_logonSession.LogonID=$($_.LogonId)} where AssocClass = Win32_LoggedOnUser Role=Dependent" }

Under Windows 7 it doesn't list any interactive accounts, only sessions for the local system account, network service etc. However under XP it returns information for all accounts.

Have been looking on MSDN and Google however haven't found an answer as yet.

Upvotes: 0

Views: 390

Answers (1)

ServerMonkey
ServerMonkey

Reputation: 1154

Seems the problem is that behind the scenes a double hop is occurring and WMI under Windows 7 is trying to find the user account details with an anonymous bind against AD. We only accept authenticated queries so this silently fails.

Going to give WMI a skip and try to pinvoke with LSA functions to get this to work.

Upvotes: 1

Related Questions