Microsoft KB Archive/259861

= SMS: Some Queries Do Not Show Results Unless User Has Class Rights to Collections (All Instances) =

Article ID: 259861

Article Last Modified on 10/27/2006

-

APPLIES TO


 * Microsoft Systems Management Server 2.0 Standard Edition

-



This article was previously published under Q259861



SYMPTOMS
When you run the following queries in Microsoft Systems Management Server (SMS) Administrator Console, you may not receive any results:
 * All Systems with Hardware Inventory Collected
 * All Systems with Microsoft Word 97
 * All Systems with Specified Software File Name and File Size
 * All Systems with Specified Software Product Name and Version
 * All User Groups
 * All Users



CAUSE
This problem can occur because of the way security is implemented in Windows Management Instrumentation (WMI) and Web-Based Enterprise Management (WBEM).

Some of the queries that are included with SMS 2.0 do not return results unless class rights to collections are granted. Other queries may work regardless of collection rights.

The queries return results for users that have Read and Read Resource class security rights to Collections\All Instances. However, if instance security rights have been granted to some or all collections, the queries do not return any results. Other queries can display results regardless of collection rights, even if users have no rights to any collections (class or instance).



WORKAROUND
To work around this problem, limit the query to a collection, and then give users Read and Read Resource instance security rights on that collection.

NOTE: If you do not want to limit the query to a specific collection, another option is to grant users Read and Read Resource class security rights to the entire collection class.



STATUS
Microsoft has confirmed this to be a problem in Systems Management Server version 2.0 Service Pack 1 and SMS 2.0 Service Pack 2.



MORE INFORMATION
Computers that have been upgraded to Windows Management Instrumentation (WMI) 1.5 or Microsoft Windows 2000-based computers do not have the WMI 1.1 tool (Wbemperm.exe).

NOTE: Windows NT 4.0 users which have WMI 1.5 installed, also need to install the Microsoft Security Configuration Editor (SCE), included on the Windows NT 4.0 Service Pack 4 (SP4) (and later) CD-ROM. On Windows NT-based computers, the tool is Wbemcntl.exe. The Microsoft SCE is required to edit the Access Control Lists (ACLs) on the Windows Installer (WI) namespaces.

Additional query words: prodsms blank empty

Keywords: kbbug kbcollections kbnofix kbquery kbreport kbsecurity kbsmsadmin kbwbem KB259861

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.