为什么仅对于非管理员用户的某些进程，WMI win32_process 命令行属性为 null？

大家好，

我创建了一个非管理员用户，并尝试获取 Win32_Process 的详细信息，但我没有获得任何值，或者命令行参数的值不正确。我按照以下步骤创建非管理员用户并向非管理员用户授予权限：

非管理员用户创建-

在独立 Windows 服务器上创建发现用户帐户。

通过运行 compmgmt.msc 命令打开计算机管理控制台。
在导航树中展开“系统工具 > 本地用户和组 > 用户”
从“操作”菜单中，单击“新建用户”
提供以下信息：
- 用户名：user1
- 全名：非管理员用户
- 描述：非管理员用户
- 密码
清除用户下次登录时必须更改密码复选框。
选中密码永不过期复选框。
单击创建

要验证新用户默认情况下是否为标准用户，请右键单击用户名，然后单击“属性”。在“属性”窗口中，转到“成员”选项卡。如果用户是标准用户，则管理员组不在列表中。

设置 WMI 配置 –

设置 WMI 配置时，可以将用户添加到访问列表以启用发现所需的权限。

在计算机管理控制台的导航树中，展开服务和应用程序 > WMI 控制。
从“操作”菜单中，单击“属性”。
单击安全选项卡，选择根命名空间，然后单击安全。
将 ibmcol 用户添加到列表中。必须允许以下权限：
- 执行方法
- 启用帐户
- 远程启用
单击高级并从列表中选择 ibmcol 用户
将“应用到”属性更改为“此命名空间和子命名空间”。
单击“确定”。

在独立 Windows 服务器上设置 ibmcol 的 DCOM 访问 –

完成以下步骤，为独立 Windows 服务器上的用户设置 DCOM 访问。

通过运行 dcomcnfg 命令打开组件服务管理工具。
在导航树中，展开组件服务 > 计算机 > 我的电脑
从“操作”菜单中，单击“属性”，然后转到“COM 安全性”选项卡。
在访问权限部分中，单击编辑默认值
将 user1 添加到列表中并确保其已启用本地访问和远程访问权限，然后单击“确定”
在访问权限部分中，单击编辑限制
将 user1 添加到列表中并确保启用本地访问和远程访问权限，然后单击“确定”
在“启动和激活权限”部分中，单击“编辑默认值”
将 user1 添加到列表中并确保其启用了本地启动和远程启动权限，然后单击确定
在“启动和激活权限”部分中，单击“编辑限制”
将 user1 添加到列表中，并确保启用本地启动、远程启动、本地激活和远程激活权限，然后单击“确定”。
重新启动 Windows 服务器。

我尝试过的：

我创建了一个下面的 .vbs 脚本 –

VB脚本

' VBScript to query Win32_Process 

' Create the WMI service object
Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
			
' Query Win32_Process
Set colProcess= objWMIService.ExecQuery("SELECT * FROM Win32_Process")
For Each objProcess In colProcess
    WScript.Echo "Process Name: " & objProcess.Name & ",Command line: " & objProcess.commandline
Next

当我从管理员用户执行此脚本时，它给出了正确的 o/p as-

Process Name: notepad++.exe,Command line: "C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\Log\ERRORLOG"         
Process Name: msedge.exe,Command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=1 --renderer-client-id=61 --time-ticks-at-unix-epoch=-1710314528264240 --launch-time-ticks=86505940061 --mojo-platform-channel-handle=5492 --field-trial-handle=2024,i,7735249812583322662,9714461642129916857,262144 --variations-seed-version /prefetch:1           
Process Name: msedge.exe,Command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=5168 --field-trial-handle=2024,i,7735249812583322662,9714461642129916857,262144 --variations-seed-version /prefetch:8                                                                                                                                                
Process Name: sqlservr.exe,Command line: "C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER                                  
Process Name: SQLAGENT.EXE,Command line: "C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE" -i MSSQLSERVER                                 
Process Name: conhost.exe,Command line: \??\C:\Windows\system32\conhost.exe 0x4                                                                                             
Process Name: fdhost.exe,Command line: "C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\Binn\fdhost.exe" "MSSQL16.MSSQLSERVERD33b06c22f3184f4737fbdc7ff9fb0698fed98no53i" "MSSQL16.MSSQLSERVER" "MSSQL16.MSSQLSERVER" "4" "" "16384" "M" "0" "" "" ""                                                                                   
Process Name: conhost.exe,Command line: \??\C:\Windows\system32\conhost.exe 0x4                                                                                             
Process Name: msmdsrv.exe,Command line: "C:\Program Files\Microsoft SQL Server\MSAS16.MSSQLSERVER\OLAP\bin\msmdsrv.exe" -s "C:\Program Files\Microsoft SQL Server\MSAS16.MSSQLSERVER\OLAP\Config"                                                                                                                                                       
Process Name: sqlceip.exe,Command line: "C:\Program Files\Microsoft SQL Server\MSAS16.MSSQLSERVER\OLAP\Bin\sqlceip.exe" -Service MSSQLSERVER  MSAS                          
Process Name: sqlbrowser.exe,Command line: "C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe"                                                           
Process Name: sqlceip.exe,Command line: "C:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\Binn\sqlceip.exe" -Service                                         
Process Name: MsDtsSrvr.exe,Command line: "C:\Program Files\Microsoft SQL Server\160\DTS\Binn\MsDtsSrvr.exe"                                                                
Process Name: sqlceip.exe,Command line: "C:\Program Files\Microsoft SQL Server\160\DTS\Binn\sqlceip.exe" -Service default MSIS                                              
Process Name: sqlwriter.exe,Command line: "C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"                                                                   
Process Name: mmc.exe,Command line: "C:\Windows\SysWOW64\mmc.exe" /32 C:\Windows\SysWOW64\SQLServerManager16.msc                                                            
Process Name: unsecapp.exe,Command line: C:\Windows\system32\wbem\unsecapp.exe -Embedding                                                                                   
Process Name: Ssms.exe,Command line: "C:\Program Files (x86)\Microsoft SQL Server Management Studio 19\Common7\IDE\Ssms.exe"                                                
Process Name: mmc.exe,Command line: "C:\Windows\SysWOW64\mmc.exe" /32 C:\Windows\SysWOW64\SQLServerManager16.msc                                                            
Process Name: unsecapp.exe,Command line: C:\Windows\system32\wbem\unsecapp.exe -Embedding                                                                                   
Process Name: cmd.exe,Command line: "C:\Windows\system32\cmd.exe"                                                                                                           
Process Name: conhost.exe,Command line: \??\C:\Windows\system32\conhost.exe 0x4                                                                                             
Process Name: msedge.exe,Command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=1 --renderer-client-id=98 --time-ticks-at-unix-epoch=-1710314528264240 --launch-time-ticks=92784109333 --mojo-platform-channel-handle=6876 --field-trial-handle=2024,i,7735249812583322662,9714461642129916857,262144 --variations-seed-version /prefetch:1                                                                                                                                                                     
Process Name: dllhost.exe,Command line: C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}                                                   
Process Name: cmd.exe,Command line: "C:\Windows\system32\cmd.exe"                                                                                                           
Process Name: conhost.exe,Command line: \??\C:\Windows\system32\conhost.exe 0x4                                                                                             
Process Name: regedit.exe,Command line: "C:\Windows\regedit.exe"                                                                                                            
Process Name: msedge.exe,Command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=1 --renderer-client-id=134 --time-ticks-at-unix-epoch=-1710314528264240 --launch-time-ticks=93756406444 --mojo-platform-channel-handle=8764 --field-trial-handle=2024,i,7735249812583322662,9714461642129916857,262144 --variations-seed-version /prefetch:1          
Process Name: mmc.exe,Command line: "C:\WINDOWS\SYSTEM32\MMC.EXE" "C:\WINDOWS\SYSTEM32\GPEDIT.MSC"                                                                          
Process Name: ApplicationFrameHost.exe,Command line: C:\Windows\system32\ApplicationFrameHost.exe -Embedding

但对于非管理员用户，我没有获得命令行的值，如下所示 –

Process Name: msedge.exe,Command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1710314528266916 --launch-time-ticks=84642249813 --mojo-platform-channel-handle=5300 --field-trial-handle=2404,i,2867887684073055332,4233896353366572665,262144 --variations-seed-version /prefetch:1           
Process Name: msedge.exe,Command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=1 --renderer-client-id=17 --time-ticks-at-unix-epoch=-1710314528266916 --launch-time-ticks=84657853849 --mojo-platform-channel-handle=4692 --field-trial-handle=2404,i,2867887684073055332,4233896353366572665,262144 --variations-seed-version /prefetch:1           
Process Name: msedge.exe,Command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=1 --renderer-client-id=18 --time-ticks-at-unix-epoch=-1710314528266916 --launch-time-ticks=84658031655 --mojo-platform-channel-handle=6724 --field-trial-handle=2404,i,2867887684073055332,4233896353366572665,262144 --variations-seed-version /prefetch:1           
Process Name: msedge.exe,Command line: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=4768 --field-trial-handle=2404,i,2867887684073055332,4233896353366572665,262144 --variations-seed-version /prefetch:8                                                                                  
Process Name: mmc.exe,Command line:                                                                                                                                         
Process Name: mmc.exe,Command line:                                                                                                                                         
Process Name: notepad++.exe,Command line:                                                                                                                                   
Process Name: msedge.exe,Command line:                                                                                                                                      
Process Name: msedge.exe,Command line:                                                                                                                                      
Process Name: sqlservr.exe,Command line:                                                                                                                                    
Process Name: SQLAGENT.EXE,Command line:                                                                                                                                    
Process Name: conhost.exe,Command line:                                                                                                                                     
Process Name: fdhost.exe,Command line:                                                                                                                                      
Process Name: conhost.exe,Command line:                                                                                                                                     
Process Name: msmdsrv.exe,Command line:                                                                                                                                     
Process Name: sqlceip.exe,Command line:                                                                                                                                     
Process Name: sqlbrowser.exe,Command line:                                                                                                                                  
Process Name: sqlceip.exe,Command line:                                                                                                                                     
Process Name: MsDtsSrvr.exe,Command line:                                                                                                                                   
Process Name: sqlceip.exe,Command line:                                                                                                                                     
Process Name: sqlwriter.exe,Command line:                                                                                                                                   
Process Name: Ssms.exe,Command line: "C:\Program Files (x86)\Microsoft SQL Server Management Studio 19\Common7\IDE\Ssms.exe"                                                
Process Name: mmc.exe,Command line: "C:\Windows\SysWOW64\mmc.exe" /32 C:\Windows\SysWOW64\SQLServerManager16.msc                                                            
Process Name: unsecapp.exe,Command line: C:\Windows\system32\wbem\unsecapp.exe -Embedding                                                                                   
Process Name: cmd.exe,Command line: "C:\Windows\system32\cmd.exe"                                                                                                           
Process Name: conhost.exe,Command line: \??\C:\Windows\system32\conhost.exe 0x4                                                                                             
Process Name: msedge.exe,Command line:                                                                                                                                      
Process Name: dllhost.exe,Command line:                                                                                                                                     
Process Name: cmd.exe,Command line: "C:\Windows\system32\cmd.exe"                                                                                                           
Process Name: conhost.exe,Command line: \??\C:\Windows\system32\conhost.exe 0x4                                                                                             
Process Name: regedit.exe,Command line: "C:\Windows\regedit.exe"                                                                                                            
Process Name: msedge.exe,Command line:                                                                                                                                      
Process Name: mmc.exe,Command line: