CIM_DataFile class may ignore permissions when run remotely


When using CIM_DataFile from WMI, you may notice differences in behavior when running locally versus remotely. Specifically, permissions will be handled differently when run remotely. An example scenario would be that of an Administrator that does not have full access to a file location, specifically being denied DELETE rights. Below is an example script that uses CIM_DataFile to rename a file:

strComputer = WScript.Arguments(0)

strFile = WScript.Arguments(1)

Set objWMIService = GetObject _

    ("winmgmts:" & "!\\" & strComputer & "\root\cimv2")

Set colFiles = objWMIService.ExecQuery _

    ("Select * from CIM_DataFile where Name = " _

        & "'c:\\" + strFile + "'")

For Each objFile in colFiles

    errResult = objFile.Rename("c:\" + strFile + ".old")


If this script example is run locally, access will be denied as expected. However, if the same script is run remotely, the delete or rename operation will succeed, which is not expected.

More Information

This behavior is by design. The remote procedure uses the Backup\Restore privilege to carry out the function, which bypasses the administrator privileges.

NOTE: An Administrator can always delete or rename files with different methods, even if he is not the owner of the files, or does not explicitly have the rights to do so. Administrators and programmers should take care when using this function on remote machines, as it may end in files being renamed or deleted which should, from the user rights perspective, not be touched.