Question

是否可以设置机器级别“我的电脑”访问权限并从PowerShell启动权限？

相当于

DComPerm.exe -ma set name permit level:l,r
DComPerm.exe -ml set name permit level:l,r

我正在寻找使用PowerShell v 3.0的解决方案。目标服务器是Windows Server 2008 R2和2012。

我找到了许多用于设置DCOM应用程序安全设置的参考。但是我无法弄清楚如何在机器或顶层设置它。

https://janbk.wordpress.com/2015/03/12/automating-dcom-acl-with-powershell/

Alternative to using DcomPerm.exe and SetAcl.exe in powershell

Answer 1

我们一直在使用WMI来设置启动权限。请参阅：https://rkeithhill.wordpress.com/2013/07/25/using-powershell-to-modify-dcom-launch-activation-settings/

Windows安全补丁推出后停止工作（补丁编号：4012212,4012213和4012213）

我们将WIM powershell脚本转换为使用CIM，并负责设置DCOM对象的启动权限。适用于安全补丁。代码如下：

$ComponentName = "TestComponent" #--- change value as needed
$Username = "Username"           #--- change value as needed
$Domain = "Domain"               #--- change value as needed

# If you already have a CimSession that you used to get the security descriptor, you can leave this line out and use the existing one:
$CimSession = New-CimSession localhost

Grant-DComAccessToUser -ComponentName $ComponentName -Username $Username -Domain $Domain

# Cleanup
$CimSession | Remove-CimSession

function Grant-DComAccessToUser {
    param(
        [Parameter(Mandatory=$true)][string] $ComponentName,
        [Parameter(Mandatory=$true)][string] $Username,
        [string] $Domain
    )

    $DCom = Get-CimInstance -Query "SELECT * from Win32_DCOMApplicationSetting WHERE Description LIKE '$ComponentName%'"

    $GetDescriptor = Invoke-CimMethod -InputObject $DCom -MethodName "GetLaunchSecurityDescriptor";

    $ExistingDacl = $GetDescriptor.Descriptor.DACL | Where {$_.Trustee.Name -eq $Username}

    if ($ExistingDacl)
    {
        $ExistingDacl.AccessMask = 11
    }
    else
    {
        $NewAce = New-DComAccessControlEntry -Domain $Domain -Username $Username
        $GetDescriptor.Descriptor.DACL += $NewAce
    }

    Invoke-CimMethod -InputObject $DCom -MethodName "SetLaunchSecurityDescriptor" -Arguments @{Descriptor=$GetDescriptor.Descriptor};
}

function New-DComAccessControlEntry {
    param(
        [Parameter(Mandatory=$true)][string] $Username,
        [string] $Domain
    )

    # Create the Win32_Trustee instance
    $Trustee = New-Object ciminstance $CimSession.GetClass("root/cimv2", "Win32_Trustee")
    $Trustee.Name = $Username
    $Trustee.Domain = $Domain

    # Create the Win32_ACE instance
    $Ace = New-Object ciminstance $CimSession.GetClass("root/cimv2", "Win32_ACE")
    $Ace.AceType = [uint32] [System.Security.AccessControl.AceType]::AccessAllowed
    $Ace.AccessMask = 11
    $Ace.AceFlags = [uint32] [System.Security.AccessControl.AceFlags]::None
    $Ace.Trustee = $Trustee

    $Ace    
}

Answer 2

您可以更改以下脚本：https://gallery.technet.microsoft.com/scriptcenter/Grant-Revoke-Get-DCOM-22da5b96。它使用注册表路径“ HKCR：\ AppID \ $ ApplicationID”和注册表项“ AccessPermission”，“ LaunchPermission”使用应用程序权限。

您应使用注册表路径“ HKLM：SOFTWARE \ Microsoft \ Ole”和注册表项“ DefaultAccessPermission”，“ DefaultLaunchPermission”，“ MachineAccessRestriction”，“ MachineLaunchRestriction”。

“配置远程DCOM”一章中的更多信息：https://books.google.ru/books?id=rbpNppFdipkC&pg=PT211&lpg=PT211&dq=dcom+grant+local+launch+permission+powershell&source=bl&ots=5ZfeVca5NA&sig=9lMN_VeymG8cf73KT062QTsWWkc&hl=ru&sa=X&ved=0ahUKEwikn73f6YLcAhVEDSwKHUftCwkQ6AEIfDAI#v=onepage&q&f=true

通过PowerShell进行DCOM机器级访问和启动权限

2 个答案: