System.Management.ManagementException "Access Denied" with Win32_ProcessStartTrace

Question

I have a piece of code to handle scenarios where specific processes are started or stopped and in order to achieve this I am using ManagementEventWatcher.

       string queryStart = "SELECT * FROM Win32_ProcessStartTrace" +
                     " WHERE ProcessName LIKE '...'"; // WHERE clause includes all the processnames that I want to monitor 
       ManagementEventWatcher startWatch = new ManagementEventWatcher(
            new WqlEventQuery(queryStart));
        startWatch.EventArrived += new EventArrivedEventHandler(ProcessNewInstanceWhenCreated);
        startWatch.Start();

This code works fine locally on my machine but when I deploy it to one of the servers it throw "Access denied" exception. The user running this on the server does not have admin rights and accordingly I added the user as explained in this link - http://world.episerver.com/faq/Items/SystemManagementManagementException-Access-denied/

This doesnt seem to solve the problem. Do I have perform any other action to get this to work on the server?

I added a ManagementScope to the ManagementEventHandler as well but still doesnt help the cause.

       string scopeString = "\\\\" + System.Environment.MachineName + "\\root\\CIMV2";
        ManagementScope theScope = new ManagementScope(scopeString);
        ManagementEventWatcher startWatch = new ManagementEventWatcher(theScope,
            new WqlEventQuery(queryStart));

Thank you for your time and help

Answer 1

I was successful in getting events with process names and ids without admin privileges using the following query:

string queryString = "SELECT * FROM __InstanceCreationEvent WITHIN .025 WHERE TargetInstance ISA 'Win32_Process'";
processWatcher = new ManagementEventWatcher(@"\\.\root\CIMV2", queryString);
processWatcher.EventArrived += ProcessStartHandler;
processWatcher.Start();

Unlike the query you were using, the event received doesn't have most of its properties filled.

However, they are accessible through the event's TargetInstance property.

private void ProcessStartHandler(object sender, EventArrivedEventArgs e)
{
    var targetInstance = ((System.Management.ManagementBaseObject)e.NewEvent.Properties["TargetInstance"].Value);
    var processName = targetInstance.Properties["Caption"].Value.ToString();
    var processId   = (uint)targetInstance.Properties["ProcessId"].Value;
    var parentProcessId = (uint)targetInstance.Properties["ParentProcessId"].Value;
}