DOCUMENT:Q259861 02-JUL-2001 [sms] TITLE :SMS: Queries Do Not Show Results without Class Rights PRODUCT :Microsoft Systems Management Server PROD/VER::2.0 OPER/SYS: KEYWORDS:kbMMC kbSecurity kbWBEM kbsms200 kbsms200bug kbCollections kbQuery kbReport kbsmsAdmin ====================================================================== ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Systems Management Server version 2.0 ------------------------------------------------------------------------------- SYMPTOMS ======== When you run the following queries in Microsoft Systems Management Server (SMS) Administrator Console, you may not receive any results: - All Systems with Hardware Inventory Collected - All Systems with Microsoft Word 97 - All Systems with Specified Software File Name and File Size - All Systems with Specified Software Product Name and Version - All User Groups - All Users CAUSE ===== This problem can occur because of the way security is implemented in Windows Management Instrumentation (WMI) and Web-Based Enterprise Management (WBEM). Some of the queries that are included with SMS 2.0 do not return results unless class rights to collections are granted. Other queries may work regardless of collection rights. The queries return results for users that have Read and Read Resource class security rights to Collections\All Instances. However, if instance security rights have been granted to some or all collections, the queries do not return any results. Other queries can display results regardless of collection rights, even if users have no rights to any collections (class or instance). WORKAROUND ========== To work around this problem, limit the query to a collection, and then give users Read and Read Resource instance security rights on that collection. NOTE: If you do not want to limit the query to a specific collection, another option is to grant users Read and Read Resource class security rights to the entire collection class. STATUS ====== Microsoft has confirmed this to be a problem in Systems Management Server version 2.0 Service Pack 1 and SMS 2.0 Service Pack 2. MORE INFORMATION ================ Computers that have been upgraded to Windows Management Instrumentation (WMI) 1.5 or Microsoft Windows 2000-based computers do not have the WMI 1.1 tool (Wbemperm.exe). NOTE: Windows NT 4.0 users which have WMI 1.5 installed, also need to install the Microsoft Security Configuration Editor (SCE), included on the Windows NT 4.0 Service Pack 4 (SP4) (and later) CD-ROM. On Windows NT-based computers, the tool is Wbemcntl.exe. The Microsoft SCE is required to edit the Access Control Lists (ACLs) on the Windows Installer (WI) namespaces. Additional query words: prodsms blank empty ====================================================================== Keywords : kbMMC kbSecurity kbWBEM kbsms200 kbsms200bug kbCollections kbQuery kbReport kbsmsAdmin Technology : kbSMSSearch kbSMS200 Version : :2.0 Issue type : kbbug Solution Type : kbnofix ============================================================================= THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. Copyright Microsoft Corporation 2001.