Local Security policy using WMI

Question

I need to retrieve list of users/groups who have access to perform volume maintain tasks using WMI objects on remote machine.

What I can do it explicitly is

1. On the Start menu, click Run. In the Open box, type secpol.msc.
2. Expand Local Policies.
3. Select the User Rights Assignment folder. The policies will be displayed in the details pane.
4. In the pane, double-click Perform Volume Maintenance Tasks.
5. In properties window, I can see user/group list who have access.

I need to get this exact list using WMI call in my C# application.

Answer 1

In order to get or modify the values of the windows security policy you must access the windows registry. Now to find the exact key which store the values which you are looking for you must check the Group Policy Settings Reference for Windows and Windows Server which contains a excel file with all the group policy settings and the location in the windows registry.

Answer 2

Password Policy, Account lockout policies are a part of secured registry settings. It cannot be read remotely until explicit permissions are given.

Answer 3

FYI that document doesn't actually work fully. Manually editing the values do not actually change the gp setting (still shows not set in gpedit), yet it does restrict the process you are setting. Also, if you manually set the value with gpedit while running procmon, the key it is hitting is not as listed in the document.