通过PowerShell DCOM机器级别访问和启动权限

Question

是否可以从PowerShell设置机器级别“我的电脑”访问权限和启动权限？

的

DComPerm.exe -ma set name permit level:l,r 
DComPerm.exe -ml set name permit level:l,r 

等效我要找使用PowerShell 3.0版本的解决方案。目标服务器的Windows Server 2008 R2和2012年

我已经发现了一些用于设置DCOM应用程序的安全设置的参考。但是我不知道如何将它设置在机器或顶层。

https://janbk.wordpress.com/2015/03/12/automating-dcom-acl-with-powershell/

Alternative to using DcomPerm.exe and SetAcl.exe in powershell

Answer 1

我们一直在使用WMI设置启动权限。 参见：https://rkeithhill.wordpress.com/2013/07/25/using-powershell-to-modify-dcom-launch-activation-settings/

此停止后，推出了Windows安全补丁程序的（补丁＃：4012212，4012213，和4012213）

我们转换WIM PowerShell脚本使用CIM，要花上DCOM设置启动权限的护理对象&适用于安全修补程序。代码如下供参考：

$ComponentName = "TestComponent" #--- change value as needed 
$Username = "Username"   #--- change value as needed 
$Domain = "Domain"    #--- change value as needed 

# If you already have a CimSession that you used to get the security descriptor, you can leave this line out and use the existing one: 
$CimSession = New-CimSession localhost 

Grant-DComAccessToUser -ComponentName $ComponentName -Username $Username -Domain $Domain 

# Cleanup 
$CimSession | Remove-CimSession 

function Grant-DComAccessToUser { 
    param(
     [Parameter(Mandatory=$true)][string] $ComponentName, 
     [Parameter(Mandatory=$true)][string] $Username, 
     [string] $Domain 
    ) 

    $DCom = Get-CimInstance -Query "SELECT * from Win32_DCOMApplicationSetting WHERE Description LIKE '$ComponentName%'" 

    $GetDescriptor = Invoke-CimMethod -InputObject $DCom -MethodName "GetLaunchSecurityDescriptor"; 

    $ExistingDacl = $GetDescriptor.Descriptor.DACL | Where {$_.Trustee.Name -eq $Username} 

    if ($ExistingDacl) 
    { 
     $ExistingDacl.AccessMask = 11 
    } 
    else 
    { 
     $NewAce = New-DComAccessControlEntry -Domain $Domain -Username $Username 
     $GetDescriptor.Descriptor.DACL += $NewAce 
    } 

    Invoke-CimMethod -InputObject $DCom -MethodName "SetLaunchSecurityDescriptor" -Arguments @{Descriptor=$GetDescriptor.Descriptor}; 
} 

function New-DComAccessControlEntry { 
    param(
     [Parameter(Mandatory=$true)][string] $Username, 
     [string] $Domain 
    ) 

    # Create the Win32_Trustee instance 
    $Trustee = New-Object ciminstance $CimSession.GetClass("root/cimv2", "Win32_Trustee") 
    $Trustee.Name = $Username 
    $Trustee.Domain = $Domain 

    # Create the Win32_ACE instance 
    $Ace = New-Object ciminstance $CimSession.GetClass("root/cimv2", "Win32_ACE") 
    $Ace.AceType = [uint32] [System.Security.AccessControl.AceType]::AccessAllowed 
    $Ace.AccessMask = 11 
    $Ace.AceFlags = [uint32] [System.Security.AccessControl.AceFlags]::None 
    $Ace.Trustee = $Trustee 

    $Ace  
}