[python-win32] python vs vbs with parental controls (security issue?) [resolved]

[Ross Boylan]

On Tue, 2009-12-15 at 20:21 +0000, Tim Golden wrote:
> Ross Boylan wrote:
> > This python script gets no URL overrides and no user settings:
> > PythonWin 2.6.4 (r264:75706, Nov  3 2009, 13:23:17) [MSC v.1500 32 bit
> > (Intel)] on win32.
> > Portions Copyright 1994-2008 Mark Hammond - see 'Help/About PythonWin'
> > for further copyright information.
> >>>> import win32com.client
> >>>> locator = win32com.client.Dispatch("WbemScripting.SwbemLocator")
> >>>> s = locator.ConnectServer(".", "\\\\.\\ROOT\\CIMV2\\Applications\
> > \WindowsParentalControls")
> 
> 
> >>>> s.Security_.ImpersonationLevel = 3
> >>>> x = s.InstancesOf("WpcURLOverride")
> >>>> x.Count
> > 0
> >>>> x = s.InstancesOf("WpcUserSettings")
> >>>> x.Count
> > 0
> >>>> s.InstancesOf("WpcSystemSettings")  #works OK
> > <COMObject InstancesOf>
> > 
> > Numerous false starts deleted.  I tried without setting the
> > ImpersonationLevel, and I tried ExecQuery, with the same results.
> > I am running from an admin account on Vista.
> > 
> > The comparable VBS script works fine:
> > Set objWMIService = GetObject("winmgmts:\\.\ROOT\CIMV2\Applications
> > \WindowsParentalControls")
> > Set urls = objWMIService.ExecQuery("select * from WpcURLOverride where
> > SID = """ _
> >  & kelsey.SID &"""")
> > WScript.Echo urls.Count
> > 
> > I speculate this is a permission issue, since I understand admin
> > accounts have an elevated and a regular privilege token.  The parental
> > controls documentation doesn't indicate there are permission issues with
> > read access, however.
> 
> I'm afraid I don't have that particular WMI provider on my XP
> box, but assuming I read the VBS code aright, this should do
> the trick (using the wmi module from:
> 
> http://timgolden.me.uk/python/wmi/index.html
> 
> <code>
> import wmi
> 
> c = wmi.WMI (namespace="cimv2/Applications/WindowsParentalControls")
> rules = c.WpcURLOverride (Sid=kelsey.SID)
> print len (rules)
> 
> </code>
> 
> Feel free to come back if this doesn't work (or if it does
> but you're not sure how to proceed with other queries). It's
> possible that there are permission issues at work, and you
> can play with the privileges in the wmi.WMI call if you need
> to, but the VBS script isn't doing anything special there.
> 
> TJG

Thank you for the pointer to the wmi module.  Is there a reference for
it?  I just see the tutorial and cookbook.  I installed it via
ActiveState's pypm, but it doesn't seem to have installed new
documentation in the help browser.

The wmi-based code also returned nothing.  Then I realized my problem: I
did not choose "Run as Administrator" when I launched the pythonwin GUI.
When I did that, everything worked.  I assume the code I tried would
also work in this mode.

In contrast, I had launched the command prompt as administrator, so that
was the environment cscript ran my VBS in.  So that's why it worked, and
the python didn't.