root\MsCluster - The WMI provider returned an 'access denied' error

Question

I have prepared the non-administrator user for collecting data using WMI.

I can query any namespace using this user except root/MSCluster. For root/MSCluster it returns 'access denied'. At the same time, I can successfully query it using domain administrator account.

Get-WSManInstance wmi/root/mscluster/* -Enumerate -Filter "SELECT * FROM MSCluster_Resource" -ComputerName host1.corp.com -Authentication Kerberos -Credential john.doe@corp.com

'john.doe@corp.com' is added to 'Performance Monitor Users', 'Distributed COM Users' and 'WinRMRemoteWMIUsers__' groups, 'Event Log Read Permission' is granted, full access is granted for all WMI namespaces, full DCOM access is granted

score 0 · Answer 1 · answered Jan 14 '16 at 11:39

0

You asked for the entire class to be instantiated. Looking at the class enumerator on msdn I'm not surprised it failed needing administrator access.

You could try querying the specific properties you need and see if you trigger an exception, but most will require admin access.

Here's the msdn page for the class you're using:

https://msdn.microsoft.com/en-us/library/windows/desktop/aa371464(v=vs.85).aspx

answered Jan 14 '16 at 11:39

Colyn1337

2,397
2
23
40

I tried 'SELECT Name FROM MSCluster_Resource' and it fails with 'access denied' – John Jan 14 '16 at 12:08
I'm not surprised. Cluster management like hyper v management requires admin access. – Colyn1337 Jan 14 '16 at 14:29
I have not found any information that reading from MSCluster requires admin rights – John Jan 14 '16 at 15:34
That's a joke right? – Colyn1337 Jan 15 '16 at 13:52
That is not a joke, it doesn't requires admin rights, it requires only access to the cluster, that can be granted for non-amins. – John Jan 15 '16 at 16:17

score -2 · Accepted Answer · answered Jan 15 '16 at 15:54

I found that querying root/MsCluster requires additional privileges. This privileges may be granted using Grant-ClusterAccess (https://technet.microsoft.com/en-us/library/ee460969.aspx).

Also querying root/virtualization/v2 requires user to be added to 'Hyper-V Administrators' local group

root\MsCluster - The WMI provider returned an 'access denied' error

2 Answers2