how to change audit policy using wmi

[Peter Kuschak]

Hello,

I have to change AuditSystemEvents audit policy using WMI.
But running of the following code causes me to receive ManagementException

ManagementScope scope = new
ManagementScope("\\\\.\\root\\RSOP\\Computer");
scope.Connect();
AuditPolicy policy = new AuditPolicy(scope, "AuditSystemEvents", 1);
policy.Failure = true; // Exception will be thrown here

I suppose that problem is related to the value of keyprecedence parameter
of contructor AuditPolicy(ManagementScope scope, string category, int
keyprecedence)

Can someone tell me what I am doing wrong?

Thank you!

regards
Peter Kuschak

[Peter Falz]

Hi Peter Kuschak,

"Peter Kuschak" <pkus...@i-hypergrid.com> schrieb im Newsbeitrag news:e9Vnihcw...@TK2MSFTNGP12.phx.gbl...

i cant say, what is wrong,
because i can't test your codesnip
because i don't find the datatype "AuditPolicy"
and i'm not a C#-programmer.

BUT
i've created a small test with VB.NET and this works fine.
Take a look at the following lines:

' --- CodeSnip: Begin
Dim mngScopeRSOP As New ManagementScope( "\\[SERVER]\root\rsop\computer" )
mngScopeRSOP.Options.Impersonation = ImpersonationLevel.Impersonate 'Default
mngScopeRSOP.Options.Username = "[USER]"
mngScopeRSOP.Options.Password = "[PWD]"
mngScopeRSOP.Options.EnablePrivileges = True
mngScopeRSOP.Connect()

Dim putOptions As New PutOptions
putOptions.Type = PutType.UpdateOnly
putOptions.UseAmendedQualifiers = True

Dim moAuditPolicy As New ManagementObject _
( _
mngScopeRSOP , _
New ManagementPath( "RSOP_AuditPolicy.Category='AuditSystemEvents',precedence=1" ) , _
Nothing _
)
moAuditPolicy.Properties( "Failure" ).Value = True

Try
moAuditPolicy.Put( putOptions )
Catch exAuditPut As Exception
' --- Error occurd
End Try

' --- CodeSnip: End

Maybe, you can convert "translate it to C#".

HTH

Cioa
Peter