使用管理员以wmi查询访问root \\ MicrosoftIISV2拒绝访问

Question

I'm doing a wmi query to check whether a IIS pool is running. Via powershell, the query works

Get-WmiObject `
    -Credential (Get-Credential) `
    -ComputerName MyMachine `
    -Namespace root\MicrosoftIISV2 `
    -Query "select * from IISApplicationPoolSetting where Name='W3SVC/APPPOLLS/MyPool'"

Via C#, I get a ManagementException with the ErrorCode AccessDenied

var ms = new ManagementScope($@"\\{myMachine}\root\MicrosoftIISV2", new ConnectionOptions
{
    Username = $".\\Administrator",
    SecurePassword = Secure("adminPwd")
});
var query = "SELECT * FROM IISApplicationPoolSetting where name='W3SVC/APPPOLLS/MyPool'";
using (var searcher = new ManagementObjectSearcher(ms, new SelectQuery(query)))
{
    var objects = searcher.Get(); // throws here
}

The user in both cases is the machine Administrator account. I'm hoping this won't be necessary by setting the correct permissions.

I'm also checking the status of windows services by doing a query to the root\\cimv2 namespace and the Win32_Service class and it works perfectly in both aproaches.

Before I could get any approach working, I had to disable remote UAC.

Set-ItemProperty `
    -Path HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System `
    -Name LocalAccountTokenFilterPolicy -Value 1 -Type DWORD

My questions are related to permissions/privileges:

1. Why do I get the AccessDenied Exception with the Administrator user? How can I debug this?
2. Is disabling the remote UAC strictly necessary?
3. Is using the Administrator account or an user in the Administrators group unavoidable?

Answer 1

I think I got a part of it.

new ConnectionOptions
{
    Username = ".\\localAdministrator",
    SecurePassword = Secure("localAdminPwd"),
    Authentication = AuthenticationLevel.PacketPrivacy
}

With the PacketPrivacy option, there is no exception no more, and I can use a local administrator (just a user in the Administrators group).

I'm not sure what this option does and why it's needed but it solved my main problem. If anyone understands this well enough to explain I still can mark the answer as accepted.

I'll keep exploring about the permissions to find out exactly what permissions are needed.