You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

WMI实例提供者创建失败(错误0x800706BE)求助

问题:自定义WMI实例提供者未执行操作即触发访问违规与调用失败

已安装一个WMI实例提供者,通过regsvr32完成注册,并创建了以下MOF实例:

#PRAGMA AUTORECOVER
#PRAGMA NAMESPACE ("\\.\Root\MyNamespace")

instance of __Win32Provider as $P
{
    Name = "myprovider";
    CLSID = "{014D660A-59C4-483F-9F99-1237308B8E98}";
};


instance of __InstanceProviderRegistration
{
    Provider = $P;
    SupportsGet = TRUE;
    SupportsEnumeration = TRUE;
    SupportsPut = FALSE;
    SupportsDelete = FALSE;
    QuerySupportLevels;
};

以管理员权限启动PowerShell执行以下命令时失败:

Get-WmiObject -Namespace "root/MyNamespace"  -Class "MyInfoClass"

错误输出:

Get-WmiObject :
At line:1 char:1
+ Get-WmiObject -Namespace "root/MyNamespace"  -Class "MyInfoClass"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], COMException
    + FullyQualifiedErrorId : GetWMICOMException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

事件日志记录:

Id = {ABDF9D5E-3FCE-000A-4B9F-DFABCE3FDB01}; ClientMachine = XYZ; User = XYZ\AnUser;
ClientProcessId = 3884; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\MyNamespace: select * from MyInfoClass; 
ResultCode = 0x800706BE; PossibleCause = Unknown

通过提供者追踪得到以下信息:

  • DllGetClassObject被调用
  • IClassFactory类型的工厂已创建,返回前引用计数设为1
  • WmiPrvSE.exe进程因*0xc0000005(EXCEPTION_ACCESS_VIOLATION)*终止
  • 工厂的CreateInstance方法从未被调用

尝试过以下操作但均无效:

  • 修改__Win32Provider和__InstanceProviderRegistration属性
  • 执行winmgmt /resetrepository修复WMI仓库

更新测试:改用控制台程序调用仍报错0x800706BE,代码如下:

CoInitializeEx(
    nullptr,                //[in, optional] LPVOID pvReserved,
    COINIT_MULTITHREADED    //[in]           DWORD  dwCoInit
);

{
    CoInitializeSecurity(
        nullptr,                    //[in, optional] PSECURITY_DESCRIPTOR        pSecDesc,
        -1,                         //[in]           LONG                        cAuthSvc,
        nullptr,                    //[in, optional] SOLE_AUTHENTICATION_SERVICE * asAuthSvc,
        nullptr,                    //[in, optional] void* pReserved1,
        RPC_C_AUTHN_LEVEL_DEFAULT,  //[in]           DWORD                       dwAuthnLevel,
        RPC_C_IMP_LEVEL_IMPERSONATE,//[in]           DWORD                       dwImpLevel,
        nullptr,                    //[in, optional] void* pAuthList,
        EOAC_NONE,                  //[in]           DWORD                       dwCapabilities,
        nullptr                     //[in, optional] void* pReserved3
    );
   
    CComPtr<IWbemLocator> locator = nullptr;
    locator.CoCreateInstance(
        CLSID_WbemLocator,      //[in]  REFCLSID  rclsid,
        nullptr,                //[in]  LPUNKNOWN pUnkOuter,
        CLSCTX_INPROC_SERVER    //[in]  DWORD     dwClsContext
    );

    CComPtr<IWbemServices> myNamespace = nullptr;
    hr = locator->ConnectServer(
        bstr_t(L"\\.\root\MyNamespace"),    //[in]  const BSTR    strNetworkResource,
        nullptr,                                //[in]  const BSTR    strUser,
        nullptr,                                //[in]  const BSTR    strPassword,
        nullptr,                                //[in]  const BSTR    strLocale,
        0,                                      //[in]  long          lSecurityFlags,
        nullptr,                                //[in]  const BSTR    strAuthority,
        nullptr,                                //[in]  IWbemContext * pCtx,
        &myNamespace                            //[out] IWbemServices * *ppNamespace
    );

    CoSetProxyBlanket(
        myNamespace,                  //[in]           IUnknown * pProxy,
        RPC_C_AUTHN_WINNT,               //[in]           DWORD                    dwAuthnSvc,
        RPC_C_AUTHZ_NONE,               //[in]           DWORD                    dwAuthzSvc,
        nullptr,                        //[in, optional] OLECHAR * pServerPrincName,
        RPC_C_AUTHN_LEVEL_CALL,         //[in]           DWORD                    dwAuthnLevel,
        RPC_C_IMP_LEVEL_IMPERSONATE,    //[in]           DWORD                    dwImpLevel,
        nullptr,                        //[in, optional] RPC_AUTH_IDENTITY_HANDLE pAuthInfo,
        EOAC_NONE                       //[in]           DWORD                    dwCapabilities
    );

    CComPtr<IEnumWbemClassObject> enumerator = nullptr;
    myNamespace->ExecQuery(
        bstr_t(L"WQL"),                                             //[in]  const BSTR           strQueryLanguage,
        bstr_t(L"SELECT * FROM MyInfoClass"),                       //[in]  const BSTR           strQuery,
        (WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY),    //[in]  long                 lFlags,
        nullptr,                                                    //[in]  IWbemContext * pCtx,
        &enumerator                                                 //[out] IEnumWbemClassObject * *ppEnum
    );
    
    ULONG returnedObjCount = 0;
    for (;;) {

        CComPtr<IWbemClassObject> classObj = nullptr;
        enumerator->Next(
            WBEM_INFINITE,      ///* [in] */ long lTimeout,
            1,                  ///* [in] */ ULONG uCount,
            &classObj,          ///* [length_is][size_is][out] */ __RPC__out_ecount_part(uCount, *puReturned) IWbemClassObject * *apObjects,
            &returnedObjCount   ///* [out] */ __RPC__out ULONG * puReturned
        );
        
        !!! => ERROR 0x800706BE

        ...        
    }
}

CoUninitialize();

额外测试情况:

  • 扩展MyNamespace权限无效
  • 改用cimv2等现有命名空间部署提供者仍无效
  • 查询cimv2命名空间下的Win32_Process正常

请问为何我的提供者在未执行任何操作前就被拒绝?


内容的提问来源于stack exchange,提问作者Waterman

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级,最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分), 限时 9.9 元起

最近更新时间:2026.06.15 22:30:55