winmgmt.exe???

feberj · Jun 20, 2006

My firewell is reporting that winmgmt.exe (windows management instumentation) is trying to be accessed by a remote computer. Anyone know if it is safe to allow this to go ahead, at the moment I’m blocking it simply because I’ve never come across this before. Done a virus scan and it comes up clean. My OP is Windows 2000 pro.

feberj · Jun 20, 2006

Anyone?? Anyway as far as can figure out WMI is used mainly by system administrators in order to access info or change settings on a large network. Since I’m not part of any network I have decided to disable this process with no apparent adverse effects so far. Is it okay to stop this process, can it cause problems with the OS?

DavidGP · Jun 20, 2006

If their are no managment tools that you have installed that would use that service to log data ( performance counters ), then you should be fine but note if a program you have needs that service or a dependancy of that WMI service then they may fail to load or work, so you would have to enable the service again.

But try out your common used apps and see if their running/usage is affected, if not they you should be fine.

Just to check the location of the winmgmt.exe as it should being a legitimate Microsoft file be located in the C:\WINNT\system32\wbem\winmgmt.exe in W2k iirc

Also do you also have the latest SP4 installed for your W2k?

As this seems a non-malware question, I will move it to the Software forum where you will get more detailed advice from some w2k users I have no doubt of to clarify.

feberj · Jun 20, 2006

Thanks for moving it, I wasn’t sure if I was in the right section. As far as common apps so far so good. Winmgmt.exe is in the right location and SP4 is already installed.

I’m just scratching my head wondering how WMI can be accessed by another computer, wouldn’t you need administrator rights? Seems like this process is a potential security flaw, doesn’t seem like there’s a fix for at, not at the moment anyway, apart from disabling.

DavidGP · Jun 21, 2006

While I dont know enough about WMI personally ( I'll admit ) so until someone more knowledgable about this service I will post some links to info I was reading on the subject of WMI and Security.

http://redmondmag.com/columns/article.asp?EditorialsID=381
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/using_wmi.asp

may help?

feberj · Jun 21, 2006

Thanks for the links. I checked the security properties of winmgmt and found that four users are listed as having access, is this unusual? The four are listed below.

Administrators with full access permitted
Power Users with only read & read/execute permitted
SYSTEM with full access
Users with only read & read/execute permitted

Log in or Sign up

winmgmt.exe???

feberj Private E-2

feberj Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

feberj Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

feberj Private E-2