[python-win32] python vs vbs with parental controls (security issue?)

[Tim Golden]

Ross Boylan wrote:
> This python script gets no URL overrides and no user settings:
> PythonWin 2.6.4 (r264:75706, Nov  3 2009, 13:23:17) [MSC v.1500 32 bit
> (Intel)] on win32.
> Portions Copyright 1994-2008 Mark Hammond - see 'Help/About PythonWin'
> for further copyright information.
>>>> import win32com.client
>>>> locator = win32com.client.Dispatch("WbemScripting.SwbemLocator")
>>>> s = locator.ConnectServer(".", "\\\\.\\ROOT\\CIMV2\\Applications\
> \WindowsParentalControls")


>>>> s.Security_.ImpersonationLevel = 3
>>>> x = s.InstancesOf("WpcURLOverride")
>>>> x.Count
> 0
>>>> x = s.InstancesOf("WpcUserSettings")
>>>> x.Count
> 0
>>>> s.InstancesOf("WpcSystemSettings")  #works OK
> <COMObject InstancesOf>
> 
> Numerous false starts deleted.  I tried without setting the
> ImpersonationLevel, and I tried ExecQuery, with the same results.
> I am running from an admin account on Vista.
> 
> The comparable VBS script works fine:
> Set objWMIService = GetObject("winmgmts:\\.\ROOT\CIMV2\Applications
> \WindowsParentalControls")
> Set urls = objWMIService.ExecQuery("select * from WpcURLOverride where
> SID = """ _
>  & kelsey.SID &"""")
> WScript.Echo urls.Count
> 
> I speculate this is a permission issue, since I understand admin
> accounts have an elevated and a regular privilege token.  The parental
> controls documentation doesn't indicate there are permission issues with
> read access, however.

I'm afraid I don't have that particular WMI provider on my XP
box, but assuming I read the VBS code aright, this should do
the trick (using the wmi module from:

http://timgolden.me.uk/python/wmi/index.html

<code>
import wmi

c = wmi.WMI (namespace="cimv2/Applications/WindowsParentalControls")
rules = c.WpcURLOverride (Sid=kelsey.SID)
print len (rules)

</code>

Feel free to come back if this doesn't work (or if it does
but you're not sure how to proceed with other queries). It's
possible that there are permission issues at work, and you
can play with the privileges in the wmi.WMI call if you need
to, but the VBS script isn't doing anything special there.

TJG