set-wmi-namespace-security-via-gpo-script

http://blogs.msdn.com/b/spatdsg/archive/2007/11/21/set-wmi-namespace-security-via-gpo-script.aspx

 

http://community.spiceworks.com/how_to/show/2447

 

Analyze SD data  as below …. 

 

 

When you call getSD, you will get the data as below

 

1, 0, 4, 129, 112, 0, 0, 0, 128, 0, 0, 0, 0, 0, 0, 0, 20, 0, 0, 0, 2, 0, 92, 0, 4, 0, 0, 0,

0, 18, 20, 0, 19, 0, 0, 0,

1, 1, 0, 0, 0, 0, 0, 5, 11, 0, 0, 0,

0, 18, 20, 0, 19, 0, 0, 0,

1, 1, 0, 0, 0, 0, 0, 5, 19, 0, 0, 0,

0, 18, 20, 0, 19, 0, 0, 0,

1, 1, 0, 0, 0, 0, 0, 5, 20, 0, 0, 0,

0, 18, 24, 0, 63, 0, 6, 0,

1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0,

1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0,

1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0

 

 

我還是用中文解釋好了

當我們新增一個User 並設定為遠端啟用 enabled 後

SD 的資料會變成

1, 0, 4, 129, 148, 0, 0, 0, 164, 0, 0, 0, 0, 0, 0, 0, 20, 0, 0, 0, 2, 0, 128, 0, 5, 0, 0, 0,

0, 0, 36, 0, 33, 0, 0, 0,

1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 46, 122, 181, 67, 143, 137, 56, 124, 22, 195, 198, 37, 232, 3, 0, 0,

0, 18, 20, 0, 19, 0, 0, 0,

1, 1, 0, 0, 0, 0, 0, 5, 11, 0, 0, 0,

0, 18, 20, 0, 19, 0, 0, 0,

1, 1, 0, 0, 0, 0, 0, 5, 19, 0, 0, 0,

0, 18, 20, 0, 19, 0, 0, 0,

1, 1, 0, 0, 0, 0, 0, 5, 20, 0, 0, 0,

0, 18, 24, 0, 63, 0, 6, 0,

1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0,

1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0,

1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0

 

我用紅字標起來有變化的地方

 

這時候就要來解釋一下為什麼有這樣的變化了

 

112->148, 92->128  我想就是因為新的資料多了9*4個byte 所以多了36

4->5 就是有原本有四筆資料 後來變五筆

 

0,0,36,0 指的是新增個這一筆資料多36個byte

33,0,0,0 指的是設定的權限

1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 46, 122, 181, 67, 143, 137, 56, 124, 22, 195, 198, 37, 232, 3, 0, 0, 這一串就是這個Account的SID，

讓我們來對照SID來看

 

SID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 46, 122, 181, 67, 143, 137, 56, 124, 22, 195, 198, 37, 232, 3, 0, 0};

SIDString = "S-1-5-21-1135966766-2084080015-633783062-1000";

 

橘色的5表示這個Account的SID的資料佔5*4個byte

紅色的5為什麼標成0,0,0,5 我就不確定了

後面的就是用顏色作對應

1135966766 / 256 =4437370 餘 46 所以第一位就填46

4437370 / 256 = 17333 餘 122 所以第二位就填122

17333 / 256 = 67 餘 181 所以第三位填181

67 / 256 = 0 餘 67 所以第四位就填67