WMI实例提供者创建失败(错误0x800706BE)求助
问题:自定义WMI实例提供者未执行操作即触发访问违规与调用失败
已安装一个WMI实例提供者,通过regsvr32完成注册,并创建了以下MOF实例:
#PRAGMA AUTORECOVER #PRAGMA NAMESPACE ("\\.\Root\MyNamespace") instance of __Win32Provider as $P { Name = "myprovider"; CLSID = "{014D660A-59C4-483F-9F99-1237308B8E98}"; }; instance of __InstanceProviderRegistration { Provider = $P; SupportsGet = TRUE; SupportsEnumeration = TRUE; SupportsPut = FALSE; SupportsDelete = FALSE; QuerySupportLevels; };
以管理员权限启动PowerShell执行以下命令时失败:
Get-WmiObject -Namespace "root/MyNamespace" -Class "MyInfoClass"
错误输出:
Get-WmiObject : At line:1 char:1 + Get-WmiObject -Namespace "root/MyNamespace" -Class "MyInfoClass" + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [Get-WmiObject], COMException + FullyQualifiedErrorId : GetWMICOMException,Microsoft.PowerShell.Commands.GetWmiObjectCommand
事件日志记录:
Id = {ABDF9D5E-3FCE-000A-4B9F-DFABCE3FDB01}; ClientMachine = XYZ; User = XYZ\AnUser; ClientProcessId = 3884; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\MyNamespace: select * from MyInfoClass; ResultCode = 0x800706BE; PossibleCause = Unknown
通过提供者追踪得到以下信息:
DllGetClassObject被调用IClassFactory类型的工厂已创建,返回前引用计数设为1- WmiPrvSE.exe进程因*0xc0000005(EXCEPTION_ACCESS_VIOLATION)*终止
- 工厂的
CreateInstance方法从未被调用
尝试过以下操作但均无效:
- 修改
__Win32Provider和__InstanceProviderRegistration属性 - 执行
winmgmt /resetrepository修复WMI仓库
更新测试:改用控制台程序调用仍报错0x800706BE,代码如下:
CoInitializeEx( nullptr, //[in, optional] LPVOID pvReserved, COINIT_MULTITHREADED //[in] DWORD dwCoInit ); { CoInitializeSecurity( nullptr, //[in, optional] PSECURITY_DESCRIPTOR pSecDesc, -1, //[in] LONG cAuthSvc, nullptr, //[in, optional] SOLE_AUTHENTICATION_SERVICE * asAuthSvc, nullptr, //[in, optional] void* pReserved1, RPC_C_AUTHN_LEVEL_DEFAULT, //[in] DWORD dwAuthnLevel, RPC_C_IMP_LEVEL_IMPERSONATE,//[in] DWORD dwImpLevel, nullptr, //[in, optional] void* pAuthList, EOAC_NONE, //[in] DWORD dwCapabilities, nullptr //[in, optional] void* pReserved3 ); CComPtr<IWbemLocator> locator = nullptr; locator.CoCreateInstance( CLSID_WbemLocator, //[in] REFCLSID rclsid, nullptr, //[in] LPUNKNOWN pUnkOuter, CLSCTX_INPROC_SERVER //[in] DWORD dwClsContext ); CComPtr<IWbemServices> myNamespace = nullptr; hr = locator->ConnectServer( bstr_t(L"\\.\root\MyNamespace"), //[in] const BSTR strNetworkResource, nullptr, //[in] const BSTR strUser, nullptr, //[in] const BSTR strPassword, nullptr, //[in] const BSTR strLocale, 0, //[in] long lSecurityFlags, nullptr, //[in] const BSTR strAuthority, nullptr, //[in] IWbemContext * pCtx, &myNamespace //[out] IWbemServices * *ppNamespace ); CoSetProxyBlanket( myNamespace, //[in] IUnknown * pProxy, RPC_C_AUTHN_WINNT, //[in] DWORD dwAuthnSvc, RPC_C_AUTHZ_NONE, //[in] DWORD dwAuthzSvc, nullptr, //[in, optional] OLECHAR * pServerPrincName, RPC_C_AUTHN_LEVEL_CALL, //[in] DWORD dwAuthnLevel, RPC_C_IMP_LEVEL_IMPERSONATE, //[in] DWORD dwImpLevel, nullptr, //[in, optional] RPC_AUTH_IDENTITY_HANDLE pAuthInfo, EOAC_NONE //[in] DWORD dwCapabilities ); CComPtr<IEnumWbemClassObject> enumerator = nullptr; myNamespace->ExecQuery( bstr_t(L"WQL"), //[in] const BSTR strQueryLanguage, bstr_t(L"SELECT * FROM MyInfoClass"), //[in] const BSTR strQuery, (WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY), //[in] long lFlags, nullptr, //[in] IWbemContext * pCtx, &enumerator //[out] IEnumWbemClassObject * *ppEnum ); ULONG returnedObjCount = 0; for (;;) { CComPtr<IWbemClassObject> classObj = nullptr; enumerator->Next( WBEM_INFINITE, ///* [in] */ long lTimeout, 1, ///* [in] */ ULONG uCount, &classObj, ///* [length_is][size_is][out] */ __RPC__out_ecount_part(uCount, *puReturned) IWbemClassObject * *apObjects, &returnedObjCount ///* [out] */ __RPC__out ULONG * puReturned ); !!! => ERROR 0x800706BE ... } } CoUninitialize();
额外测试情况:
- 扩展
MyNamespace权限无效 - 改用cimv2等现有命名空间部署提供者仍无效
- 查询cimv2命名空间下的
Win32_Process正常
请问为何我的提供者在未执行任何操作前就被拒绝?
内容的提问来源于stack exchange,提问作者Waterman
相关产品推荐
相关产品推荐

