I have a script where I'm remotely querying some registry keys, and for some reason the ID I'm running this script under continues to populate security events into the remote machines' security event log even after I set the WMI object to Nothing. Don't laugh at my coding, but the following is the subroutine I've narrowed it down to:
'Get the versions of the various Altiris agent sub-components
Sub NSAgentComponentsVersionCheck
If strWMIServiceFlag2 = "N" Then
On Error Resume Next
Set objWMIService2 = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strMachine & "\root\default:StdRegProv")
A = Err.Number
On Error GoTo 0
Else
If strWMIServiceFlag2 = "B" Then
A = -1
Else
A = 0
End If
End If
If A <> 0 Then
If strHLSflag = 0 Then
strHLStext = "WMI/ADSI Error:"
Call HLStracker
strHLSflag = 1
End If
objResultDictionary.Item("NS_Agent_Ver") = "WMI Error"
objResultDictionary.Item("NS_Assigned_Server") = "WMI Error"
objResultDictionary.Item("Patch_Agent_Ver") = "WMI Error"
objResultDictionary.Item("SWD_Agent_Ver") = "WMI Error"
objResultDictionary.Item("Inv_Ver") = "WMI Error"
objResultDictionary.Item("Task_Synch_Ver") = "WMI Error"
objResultDictionary.Item("App_Met_Ver") = "WMI Error"
Else
strWMIServiceFlag2 = "Y"
'Get version of NS Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent"
strRegValue = "Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then
strRegResult = "Not found or cannot query"
If strHLSflag = 0 Then
strHLStext = "WMI/ADSI Error:"
Call HLStracker
strHLSflag = 1
End If
End If
If strRegResult <> "6.0.0.1508" Then
If strHLSflag = 0 Then
strHLStext = "Incorrect Agent Version:"
Call HLStracker
strHLSflag = 1
End If
End If
objResultDictionary.Item("NS_Agent_Ver") = strRegResult
'Get assigned NS server
strRegResult = ""
strRegKeyPath = "Software\Altiris\eXpress\NS Client"
strRegValue = "DefaultServer"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then strRegResult = "Not found or cannot query"
objResultDictionary.Item("NS_Assigned_Server") = strRegResult
'Get version of Patch Sub-Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent\Plugin Objects\Agents\Altiris Software Update Agent"
strRegValue = "Product Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then
strRegResult = "Not found or cannot query"
If strHLSflag = 0 Then
strHLStext = "WMI/ADSI Error:"
Call HLStracker
strHLSflag = 1
End If
End If
If strRegResult <> "6.1.0.1422" Then
If strHLSflag = 0 Then
strHLStext = "Incorrect Sub-Agent Version:"
Call HLStracker
strHLSflag = 1
End If
End If
objResultDictionary.Item("Patch_Agent_Ver") = strRegResult
'Get version of SWD Sub-Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent\Plugin Objects\Agents\Software Delivery Solution"
strRegValue = "Product Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then strRegResult = "Not found or cannot query"
objResultDictionary.Item("SWD_Agent_Ver") = strRegResult
'Get version of Software Inventory Sub-Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent\Plugin Objects\Agents\Software Inventory Agent"
strRegValue = "Product Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then
strRegResult = "Not found or cannot query"
If strHLSflag = 0 Then
strHLStext = "WMI/ADSI Error:"
Call HLStracker
strHLSflag = 1
End If
End If
If strRegResult <> "6.1.0.1422" Then
If strHLSflag = 0 Then
strHLStext = "Incorrect Sub-Agent Version:"
Call HLStracker
strHLSflag = 1
End If
End If
objResultDictionary.Item("Inv_Ver") = strRegResult
'Get version of Task Synchronization Sub-Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent\Plugin Objects\Agents\Task Synchronization"
strRegValue = "Product Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then strRegResult = "Not found or cannot query"
objResultDictionary.Item("Task_Synch_Ver") = strRegResult
'Get version of Application Metering Sub-Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent\Plugin Objects\Agents\ApplicationMeteringAgent"
strRegValue = "Product Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then strRegResult = "Not found or cannot query"
objResultDictionary.Item("App_Met_Ver") = strRegResult
End If
End Sub
I verified via stepping through debugger that I reach and successfully execute a line of code elsewhere after this subroutine:
If strWMIServiceFlag2 = "Y" Then Set objWMIService2 = Nothing
....which should close the WMI object and therefore my connection with the machine. However I'm sitting here as I type on the line immediately following that one, and yet still posting security events to remote machine.
I should also note that sub HLStracker doesn't do any connections, but rather just keeps stats. And this sub works as expected - successfully returning appropriate reg values.
Anyone have thoughts on what I may not be closing or closing incorrectly?
'Get the versions of the various Altiris agent sub-components
Sub NSAgentComponentsVersionCheck
If strWMIServiceFlag2 = "N" Then
On Error Resume Next
Set objWMIService2 = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strMachine & "\root\default:StdRegProv")
A = Err.Number
On Error GoTo 0
Else
If strWMIServiceFlag2 = "B" Then
A = -1
Else
A = 0
End If
End If
If A <> 0 Then
If strHLSflag = 0 Then
strHLStext = "WMI/ADSI Error:"
Call HLStracker
strHLSflag = 1
End If
objResultDictionary.Item("NS_Agent_Ver") = "WMI Error"
objResultDictionary.Item("NS_Assigned_Server") = "WMI Error"
objResultDictionary.Item("Patch_Agent_Ver") = "WMI Error"
objResultDictionary.Item("SWD_Agent_Ver") = "WMI Error"
objResultDictionary.Item("Inv_Ver") = "WMI Error"
objResultDictionary.Item("Task_Synch_Ver") = "WMI Error"
objResultDictionary.Item("App_Met_Ver") = "WMI Error"
Else
strWMIServiceFlag2 = "Y"
'Get version of NS Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent"
strRegValue = "Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then
strRegResult = "Not found or cannot query"
If strHLSflag = 0 Then
strHLStext = "WMI/ADSI Error:"
Call HLStracker
strHLSflag = 1
End If
End If
If strRegResult <> "6.0.0.1508" Then
If strHLSflag = 0 Then
strHLStext = "Incorrect Agent Version:"
Call HLStracker
strHLSflag = 1
End If
End If
objResultDictionary.Item("NS_Agent_Ver") = strRegResult
'Get assigned NS server
strRegResult = ""
strRegKeyPath = "Software\Altiris\eXpress\NS Client"
strRegValue = "DefaultServer"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then strRegResult = "Not found or cannot query"
objResultDictionary.Item("NS_Assigned_Server") = strRegResult
'Get version of Patch Sub-Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent\Plugin Objects\Agents\Altiris Software Update Agent"
strRegValue = "Product Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then
strRegResult = "Not found or cannot query"
If strHLSflag = 0 Then
strHLStext = "WMI/ADSI Error:"
Call HLStracker
strHLSflag = 1
End If
End If
If strRegResult <> "6.1.0.1422" Then
If strHLSflag = 0 Then
strHLStext = "Incorrect Sub-Agent Version:"
Call HLStracker
strHLSflag = 1
End If
End If
objResultDictionary.Item("Patch_Agent_Ver") = strRegResult
'Get version of SWD Sub-Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent\Plugin Objects\Agents\Software Delivery Solution"
strRegValue = "Product Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then strRegResult = "Not found or cannot query"
objResultDictionary.Item("SWD_Agent_Ver") = strRegResult
'Get version of Software Inventory Sub-Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent\Plugin Objects\Agents\Software Inventory Agent"
strRegValue = "Product Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then
strRegResult = "Not found or cannot query"
If strHLSflag = 0 Then
strHLStext = "WMI/ADSI Error:"
Call HLStracker
strHLSflag = 1
End If
End If
If strRegResult <> "6.1.0.1422" Then
If strHLSflag = 0 Then
strHLStext = "Incorrect Sub-Agent Version:"
Call HLStracker
strHLSflag = 1
End If
End If
objResultDictionary.Item("Inv_Ver") = strRegResult
'Get version of Task Synchronization Sub-Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent\Plugin Objects\Agents\Task Synchronization"
strRegValue = "Product Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then strRegResult = "Not found or cannot query"
objResultDictionary.Item("Task_Synch_Ver") = strRegResult
'Get version of Application Metering Sub-Agent
strRegResult = ""
strRegKeyPath = "Software\Altiris\Altiris Agent\Plugin Objects\Agents\ApplicationMeteringAgent"
strRegValue = "Product Version"
On Error Resume Next
objWMIService2.GetStringValue strRegTreeHex,strRegKeyPath,strRegValue,strRegResult
B = Err.Number
On Error Goto 0
If (IsNull(strRegResult)) Or (strRegResult = "") Or (B <> 0) Then strRegResult = "Not found or cannot query"
objResultDictionary.Item("App_Met_Ver") = strRegResult
End If
End Sub
I verified via stepping through debugger that I reach and successfully execute a line of code elsewhere after this subroutine:
If strWMIServiceFlag2 = "Y" Then Set objWMIService2 = Nothing
....which should close the WMI object and therefore my connection with the machine. However I'm sitting here as I type on the line immediately following that one, and yet still posting security events to remote machine.
I should also note that sub HLStracker doesn't do any connections, but rather just keeps stats. And this sub works as expected - successfully returning appropriate reg values.
Anyone have thoughts on what I may not be closing or closing incorrectly?