通過PowerShell DCOM機器級別訪問和啓動權限

Question

是否可以從PowerShell設置機器級別「我的電腦」訪問權限和啓動權限？

的

DComPerm.exe -ma set name permit level:l,r 
DComPerm.exe -ml set name permit level:l,r 

等效我要找使用PowerShell 3.0版本的解決方案。目標服務器的Windows Server 2008 R2和2012年

我已經發現了一些用於設置DCOM應用程序的安全設置的參考。但是我不知道如何將它設置在機器或頂層。

https://janbk.wordpress.com/2015/03/12/automating-dcom-acl-with-powershell/

Alternative to using DcomPerm.exe and SetAcl.exe in powershell

Answer 1

我們一直在使用WMI設置啓動權限。 參見：https://rkeithhill.wordpress.com/2013/07/25/using-powershell-to-modify-dcom-launch-activation-settings/

此停止後，推出了Windows安全補丁程序的（補丁＃：4012212，4012213，和4012213）

我們轉換WIM PowerShell腳本使用CIM，要花上DCOM設置啓動權限的護理對象&適用於安全修補程序。代碼如下供參考：

$ComponentName = "TestComponent" #--- change value as needed 
$Username = "Username"   #--- change value as needed 
$Domain = "Domain"    #--- change value as needed 

# If you already have a CimSession that you used to get the security descriptor, you can leave this line out and use the existing one: 
$CimSession = New-CimSession localhost 

Grant-DComAccessToUser -ComponentName $ComponentName -Username $Username -Domain $Domain 

# Cleanup 
$CimSession | Remove-CimSession 

function Grant-DComAccessToUser { 
    param(
     [Parameter(Mandatory=$true)][string] $ComponentName, 
     [Parameter(Mandatory=$true)][string] $Username, 
     [string] $Domain 
    ) 

    $DCom = Get-CimInstance -Query "SELECT * from Win32_DCOMApplicationSetting WHERE Description LIKE '$ComponentName%'" 

    $GetDescriptor = Invoke-CimMethod -InputObject $DCom -MethodName "GetLaunchSecurityDescriptor"; 

    $ExistingDacl = $GetDescriptor.Descriptor.DACL | Where {$_.Trustee.Name -eq $Username} 

    if ($ExistingDacl) 
    { 
     $ExistingDacl.AccessMask = 11 
    } 
    else 
    { 
     $NewAce = New-DComAccessControlEntry -Domain $Domain -Username $Username 
     $GetDescriptor.Descriptor.DACL += $NewAce 
    } 

    Invoke-CimMethod -InputObject $DCom -MethodName "SetLaunchSecurityDescriptor" -Arguments @{Descriptor=$GetDescriptor.Descriptor}; 
} 

function New-DComAccessControlEntry { 
    param(
     [Parameter(Mandatory=$true)][string] $Username, 
     [string] $Domain 
    ) 

    # Create the Win32_Trustee instance 
    $Trustee = New-Object ciminstance $CimSession.GetClass("root/cimv2", "Win32_Trustee") 
    $Trustee.Name = $Username 
    $Trustee.Domain = $Domain 

    # Create the Win32_ACE instance 
    $Ace = New-Object ciminstance $CimSession.GetClass("root/cimv2", "Win32_ACE") 
    $Ace.AceType = [uint32] [System.Security.AccessControl.AceType]::AccessAllowed 
    $Ace.AccessMask = 11 
    $Ace.AceFlags = [uint32] [System.Security.AccessControl.AceFlags]::None 
    $Ace.Trustee = $Trustee 

    $Ace  
}