Develop Reference

shutdown a specific computer in a network by using C# [duplicate]

I found this code on an old thread to shutdown the local machine:
using System.Management;
void Shutdown()
{
ManagementBaseObject mboShutdown = null;
ManagementClass mcWin32 = new ManagementClass("Win32_OperatingSystem");
mcWin32.Get();
// You can't shutdown without security privileges
mcWin32.Scope.Options.EnablePrivileges = true;
ManagementBaseObject mboShutdownParams =
mcWin32.GetMethodParameters("Win32Shutdown");
// Flag 1 means we want to shut down the system. Use "2" to reboot.
mboShutdownParams["Flags"] = "1";
mboShutdownParams["Reserved"] = "0";
foreach (ManagementObject manObj in mcWin32.GetInstances())
{
mboShutdown = manObj.InvokeMethod("Win32Shutdown",
mboShutdownParams, null);
}
}
Is it possible to use a similar WMI method to reboot flag "2" a remote machine, for which i only have machine name, not IPaddress.
EDIT: I currently have:
SearchResultCollection allMachinesCollected = machineSearch.FindAll();
Methods myMethods = new Methods();
string pcName;
ArrayList allComputers = new ArrayList();
foreach (SearchResult oneMachine in allMachinesCollected)
{
//pcName = oneMachine.Properties.PropertyNames.ToString();
pcName = oneMachine.Properties["name"][0].ToString();
allComputers.Add(pcName);
MessageBox.Show(pcName + "has been sent the restart command.");
Process.Start("shutdown.exe", "-r -f -t 0 -m \\" + pcName);
}
but this doesn't work, and I would prefer WMI going forward.

To address WMI queries to a remote computer, you simply specify that computer's name (or IP address) in the ManagementScope object.
I'm not well up in C#, but here's an example I came up with using MSDN and WMI Code Creator (which is, by the way, an excellent tool for generating WMI code, and supports C# among others). Hope this code will give you the idea.
(Disclaimer: This code is untested.)
using System;
using System.Management;
...
void Shutdown()
{
try
{
const string computerName = "COMPUTER"; // computer name or IP address
ConnectionOptions options = new ConnectionOptions();
options.EnablePrivileges = true;
// To connect to the remote computer using a different account, specify these values:
// options.Username = "USERNAME";
// options.Password = "PASSWORD";
// options.Authority = "ntlmdomain:DOMAIN";
ManagementScope scope = new ManagementScope(
"\\\\" + computerName + "\\root\\CIMV2", options);
scope.Connect();
SelectQuery query = new SelectQuery("Win32_OperatingSystem");
ManagementObjectSearcher searcher =
new ManagementObjectSearcher(scope, query);
foreach (ManagementObject os in searcher.Get())
{
// Obtain in-parameters for the method
ManagementBaseObject inParams =
os.GetMethodParameters("Win32Shutdown");
// Add the input parameters.
inParams["Flags"] = 2;
// Execute the method and obtain the return values.
ManagementBaseObject outParams =
os.InvokeMethod("Win32Shutdown", inParams, null);
}
}
catch(ManagementException err)
{
MessageBox.Show("An error occurred while trying to execute the WMI method: " + err.Message);
}
catch(System.UnauthorizedAccessException unauthorizedErr)
{
MessageBox.Show("Connection error (user name or password might be incorrect): " + unauthorizedErr.Message);
}
}

I had trouble with this also. WMI can be misleading with methods for classes and object. My solution is for rebooting a host on the network with C# and WMI, but is easily simplified for local machine:
private void rebootHost(string hostName)
{
string adsiPath = string.Format(#"\\{0}\root\cimv2", hostName);
ManagementScope scope = new ManagementScope(adsiPath);
// I've seen this, but I found not necessary:
// scope.Options.EnablePrivileges = true;
ManagementPath osPath = new ManagementPath("Win32_OperatingSystem");
ManagementClass os = new ManagementClass(scope, osPath, null);
ManagementObjectCollection instances;
try
{
instances = os.GetInstances();
}
catch (UnauthorizedAccessException exception)
{
throw new MyException("Not permitted to reboot the host: " + hostName, exception);
}
catch (COMException exception)
{
if (exception.ErrorCode == -2147023174)
{
throw new MyException("Could not reach the target host: " + hostName, exception);
}
throw; // Unhandled
}
foreach (ManagementObject instance in instances)
{
object result = instance.InvokeMethod("Reboot", new object[] { });
uint returnValue = (uint)result;
if (returnValue != 0)
{
throw new MyException("Failed to reboot host: " + hostName);
}
}
}

You can use shutdown command if you need an non-WMI solution.
shutdown [{-l|-s|-r|-a}] [-f] [-m [\\ComputerName]] [-t xx] [-c "message"] [-d[u][p]:xx:yy]
Use the -m for shutting the remote machine.
Refer this link for more info.
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/shutdown.mspx

this will work like sharm
gwmi win32_operatingsystem -ComputerName xxxxxxxxxxxx | Invoke-WmiMethod -Name reboot

Searching for a File on Remote Machine WMI C#

I want to search for a file on remote machine. I don't know the EXACT file path but I know its under C:\Windows\System
My query is something like this in WMI
string querystr = "SELECT * FROM CIM_DataFile Where Path='C:\\Windows\\System'";
ObjectQuery query = new ObjectQuery(querystr );
ManagementObjectSearcher Searcher = new ManagementObjectSearcher(Scope, query);
I get invalid query error.
Is the query valid ? Any way to specify Path Under ?

You have two issues in your code
you must double escape the \ char, because this is a reserved symbol in the WMI
the path property must not include the drive.
try this sample
using System;
using System.Collections.Generic;
using System.Management;
using System.Text;
namespace GetWMI_Info
{
class Program
{
static void Main(string[] args)
{
try
{
string ComputerName = "localhost";
ManagementScope Scope;
if (!ComputerName.Equals("localhost", StringComparison.OrdinalIgnoreCase))
{
ConnectionOptions Conn = new ConnectionOptions();
Conn.Username = "";
Conn.Password = "";
Conn.Authority = "ntlmdomain:DOMAIN";
Scope = new ManagementScope(String.Format("\\\\{0}\\root\\CIMV2", ComputerName), Conn);
}
else
Scope = new ManagementScope(String.Format("\\\\{0}\\root\\CIMV2", ComputerName), null);
Scope.Connect();
string Drive = "c:";
//look how the \ char is escaped.
string Path = "\\\\Windows\\\\System32\\\\";
ObjectQuery Query = new ObjectQuery(string.Format("SELECT * FROM CIM_DataFile Where Drive='{0}' AND Path='{1}' ", Drive, Path));
ManagementObjectSearcher Searcher = new ManagementObjectSearcher(Scope, Query);
foreach (ManagementObject WmiObject in Searcher.Get())
{
Console.WriteLine("{0}",(string)WmiObject["Name"]);// String
}
}
catch (Exception e)
{
Console.WriteLine(String.Format("Exception {0} Trace {1}",e.Message,e.StackTrace));
}
Console.WriteLine("Press Enter to exit");
Console.Read();
}
}
}

WMI throwing Exception "Invalid Query" on second attempt to query the same server

I have a following code, almost all the time this code works for most of my server, but for some specific servers, it just fails on second part of query. this code query the SQL Server Service First and in second part it queries the SQL Sevrer Agent Service.
I have tried all possible combination of creating another Scope and Query Object, but somehow the server I am trying to query does not return seccond part, looks like after the scope is connected and first query is executed, second part is blocked by something on server..! Any help on this one is appreciated.. almost 99% of servers works fine and returns desire results, but just 2 or 3 servers fails for second part..
If this is WMI issue on the server it self..? is there any other way to achieve these status..? like IPC or Sockets..? please help..!
Hash.
try
{
agentserviceName = "SQLSERVERAGENT";
serviceName = "MSSQLSERVER";
query = new System.Management.SelectQuery(string.Format("select name, startname, State, StartMode from Win32_Service where name = '{0}'", serviceName));
ManagementScope scope = new ManagementScope("\\\\" + srvName + "\\root\\cimv2");
//ManagementScope scope = new ManagementScope("\\\\ST0176V\\root\\cimv2");
scope.Connect();
System.Management.ManagementObjectSearcher searcher = new System.Management.ManagementObjectSearcher(scope, query);
// MessageBox.Show((String)dgv_ChangeSvcAccount.Rows[i].Cells[1].Value.ToString());
foreach (ManagementObject service in searcher.Get())
{
dgv_ChangeSvcAccount.Rows[i].Cells[4].Value = service["startname"];
dgv_ChangeSvcAccount.Rows[i].Cells[4].Tag = serviceName;
dgv_ChangeSvcAccount.Rows[i].Cells[5].Value = "Currently : " + service["State"] + " - Set As : " + service["StartMode"];
}
if (searcher.Get().Count == 0)
{
dgv_ChangeSvcAccount.Rows[i].Cells[4].Value = "NO SQL Service Found";
}
searcher.Dispose();
ManagementScope scope2 = new ManagementScope("\\\\" + srvName + "\\root\\cimv2");
// ObjectQuery query2 = new ObjectQuery("SELECT * FROM Win32_Service WHERE NAME LIKE '" + serviceName.ToString().ToUpper() + "'");
System.Management.SelectQuery query2 = new System.Management.SelectQuery(string.Format("select name, startname, State, StartMode from Win32_Service where name like '{0}'", agentserviceName));
System.Management.ManagementObjectSearcher searcher1 = new System.Management.ManagementObjectSearcher(scope2, query2);
foreach (ManagementObject service in searcher1.Get()) // <---- this line throws exception for invalid query, and it is always 2 servers which does that, rest of servers returns proper results. the servers which throws this Invlid Query exceptions are Windows 2000 Server with SP4.
{
dgv_ChangeSvcAccount.Rows[i].Cells[6].Value = service["startname"];
dgv_ChangeSvcAccount.Rows[i].Cells[6].Tag = agentserviceName;
dgv_ChangeSvcAccount.Rows[i].Cells[7].Value = "Currently : " + service["State"] + " - Set As : " + service["StartMode"];
}
searcher1.Dispose();
}
catch (System.Exception ex)
{
MessageBox.Show(ex.Message.ToString());
}

Since, as we've been discussing in the comments, we're thinking it might have to do with having multiple active ManagementScope objects, try changing the first half of your code to this:
string agentserviceName = "SQLSERVERAGENT";
string serviceName = "MSSQLSERVER";
// Let the SelectQuery class build our WQL query text...
string className = "Win32_Service";
string condition = string.Format("Name = '{0}'", serviceName);
string[] selectedProperties = new string[] { "Name", "StartName", "State", "StartMode" };
SelectQuery query = new SelectQuery(className, condition, selectedProperties);
using (ManagementObjectSearcher searcher = new ManagementObjectSearcher(query))
{
searcher.Scope = new ManagementScope("\\\\" + srvName + "\\root\\cimv2");
foreach (ManagementObject service in searcher.Get())
{
dgv_ChangeSvcAccount.Rows[i].Cells[4].Value = service["startname"];
dgv_ChangeSvcAccount.Rows[i].Cells[4].Tag = serviceName;
dgv_ChangeSvcAccount.Rows[i].Cells[5].Value = "Currently : " + service["State"] + " - Set As : " + service["StartMode"];
}
if (searcher.Get().Count == 0)
{
dgv_ChangeSvcAccount.Rows[i].Cells[4].Value = "NO SQL Service Found";
}
}
// Second query goes here...
That will dispose the ManagementObjectSearcher for the first query when it's done being used, and also ensure that it holds the only reference to the ManagementScope for the remote server.

User logged into remote machine

Is there a way to determine what all users are logged into remote machine, using WMI and C#

After little research I was able to figure it out, although not sure if this is the best way
public void GetCompDet(string ComputerName)
{
CurrentSystem = ComputerName;
ConnectionOptions options = new ConnectionOptions();
ManagementScope moScope = new ManagementScope(#"\\" + ComputerName + #"\root\cimv2");
try
{
moScope.Connect();
}
catch
{
return;
}
ObjectQuery query = new ObjectQuery("select * from Win32_Process where name='explorer.exe'");
ManagementObjectSearcher searcher = new ManagementObjectSearcher(moScope, query);
ManagementObjectCollection queryCollection = searcher.Get();
foreach (ManagementObject m in queryCollection)
{
ManagementOperationObserver mo = new ManagementOperationObserver();
mo.ObjectReady += new ObjectReadyEventHandler(mo_ObjectReady);
m.InvokeMethod(mo, "GetOwner", null);
}
}
void mo_ObjectReady(object sender, ObjectReadyEventArgs e)
{
ManagementObject m = sender as ManagementObject;
LoggedinUser.Enqueue(CurrentSystem + " - >" + e.NewObject.Properties["user"].Value.ToString());
Console.WriteLine(CurrentSystem + " - >" + e.NewObject.Properties["user"].Value.ToString());
}

query on Win32_NTLogEvent WHERE Logfile = 'Security' works only on remote machine

I've have a problem using the code below to retrieve data from the security log event of my local machine. I tested on various computers: the local machine is a windows xp sp3. The query has no error but it returns 0 record. For remote machines it works perfectly
Anyone can give me a solution?
This is the code:
using System;
using System.Management;
using System.Windows.Forms;
namespace WMISample
{
public class MyWMIQuery
{
public static void Main()
{
try
{
string[] arrComputers = {".","clientN"};
foreach (string strComputer in arrComputers)
{
Console.WriteLine("==========================================");
Console.WriteLine("Computer: " + strComputer);
Console.WriteLine("==========================================");
ManagementObjectSearcher searcher =
new ManagementObjectSearcher(
"\\\\" + strComputer + "\\root\\CIMV2",
"SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Security'");
foreach (ManagementObject queryObj in searcher.Get())
{
Console.WriteLine("-----------------------------------");
Console.WriteLine("Win32_NTLogEvent instance");
Console.WriteLine("-----------------------------------");
Console.WriteLine("RecordNumber: {0}", queryObj["RecordNumber"]);
Console.WriteLine("SourceName: {0}", queryObj["SourceName"]);
Console.WriteLine("TimeGenerated: {0}", queryObj["TimeGenerated"]);
}
}
}
catch(ManagementException err)
{
MessageBox.Show("An error occurred while querying for WMI data: " + err.Message);
}
}
}
}
I understood that using the impersonation level for the wmi query in vbs it works.
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _
& strComputer & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'Security'" )
So I have to translate in c#.

Ok so I close this Question using my code.
the code is:
using System;
using System.Management;
namespace WMISample
{
public class MyWMIQuery
{
public static void Main()
{
try
{
ConnectionOptions oConn = new ConnectionOptions();
oConn.Impersonation = ImpersonationLevel.Impersonate;
oConn.EnablePrivileges = true;
string[] arrComputers = {".","clientN"};
foreach (string strComputer in arrComputers)
{
Console.WriteLine("==========================================");
Console.WriteLine("Computer: " + strComputer);
Console.WriteLine("==========================================");
ManagementObjectSearcher searcher = new ManagementObjectSearcher
(
new ManagementScope("\\\\" + strComputer + "\\root\\CIMV2", oConn),
new ObjectQuery( #"SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Security'")
);
foreach (ManagementObject queryObj in searcher.Get())
{
Console.WriteLine("-----------------------------------");
Console.WriteLine("Win32_NTLogEvent instance");
Console.WriteLine("-----------------------------------");
Console.WriteLine("RecordNumber: {0}", queryObj["RecordNumber"]);
Console.WriteLine("SourceName: {0}", queryObj["SourceName"]);
Console.WriteLine("TimeGenerated: {0}", queryObj["TimeGenerated"]);
}
}
}
catch(ManagementException err)
{
MessageBox.Show("An error occurred while querying for WMI data: " + err.Message);
}
}
}
}

try using the local computername instead of ".". so, instead of
string[] arrComputers = {".","clientN"};
you would have
string[] arrComputers = { Environment.GetEnvironmentVariable("computername"), "clientN" };