Audit WMI Repository. Record all namespace removal events.

Question

Hello,
Every night some of the namespaces in my WMI repository are removed by an unknown source. I have enabled WMI auditing and "Other object access events" in order to populate the security log with WMI access events. The unfortunate thing is that a
full search of the events does not even mention the namespace that was deleted after an overnight log. Yet in the morning, the namespace is gone. I am looking for a way to audit the repository for all deleted namespaces and who the source was (PID, Login Name,
etc)

Answer 1

Hi,
Have you configured System Access Control Lists (SACL) on the security tab of the WMI Control?
If yes, please ensure that auditing has been enabled correctly. You may use Auditpol /get command to display auditing settings of the local machine.
Auditpol get
https://technet.microsoft.com/en-us/library/cc772576.aspx
Please note that namespace auditing is not available on Windows Server 2003.
More information for you:
Access to WMI Namespaces
https://technet.microsoft.com/en-us/scriptcenter/aa822575
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]