Server 2012 R2 wmi access to root/MicrosoftDfs

hello,

try grant user access rights wmi /root/microsoftdfs.
don't want promote user local admin. want use user monitoring purposes (dfs backlog monitoring).

i've done far:

- i've assign user groups "distributed com users" , "winrmremotewmiusers__
- i've used wmimgmt.msc grant access rights /root/microsoftdfs user. set 'activate', 'remote activation', 'execute method'

test desired namespace:
wmic /namespace:\\root\microsoftdfs path dfsrmachineconfig
... result: access denied

test namespace /root/cimv2:
wmic /namespace:\\root\cimv2 path win32_product version
... result: access granted

see behavior on windows server 2012 r2 readonlydc.
did same configuration domain controller based on windows server 2008 r2 , domain member test server based on windows server 2012. seems work fine. @ least don't receive 'access denied' results when trying access root/microsoftdfs. assume, 2012 r2 specific behaviour.
different server 2012 r2? how have extend configuration provide access non-admin user wmi namespace?

hi michael,

dfsr depends on active directory (ad) , domain controller (dc) settings, topology, , other goo configures replication.

i did lot of research, can make part of classes under namespace "root/microsoftdfs" worked  without admin right:

1. add domain user groups: performance log users, distributed com users

2. open cmd: wmimgmt->locate "root\microsoftdfs"->assign domain user permissions

execute methods
enable account
remote enable
read security

3. open adsi on dc, , locate "cn=dfsr-globalsettings,cn=system,dc=domainnc" and "cn=dfsr-localsettings,cn=servername,ou=someou,dc=domainnc"->proerties->security->add domain user , assign full controll permission on entry , their subtree.

and ran these classes in powershell query wmi domain user on dc:

get-wmiobject -namespace root/microsoftdfs -class dfsrinfo get-wmiobject -namespace root/microsoftdfs -class dfsrconfig

for more detailed information, please refer information , screenshot in article:

five common causes of “waiting dfs replication service retrieve replication settings active directory”

best regards,

anna wang

---

please remember mark replies answers if , unmark them if provide no help. if have feedback technet support, contact tnmff@microsoft.com

Windows Server  >  Windows Server 2012 General