我想使用 WMI 从 UWF 获取所有注册表排除和文件排除。
我已经尝试从 UWF_RegistryFilter 类调用 GetExclusions 方法,但没有成功。
我期待一个有效的示例代码,在此先感谢您的帮助!
我想使用 WMI 从 UWF 获取所有注册表排除和文件排除。
我已经尝试从 UWF_RegistryFilter 类调用 GetExclusions 方法,但没有成功。
我期待一个有效的示例代码,在此先感谢您的帮助!
困难的部分是从方法结果中读取出参数。Microsoft 网站上没有适当的文档,很难猜测如何使用 ManagementBaseObject 来读取输出参数。
为了找到解决方案,我尝试根据其他有据可查的 wmi 示例来了解 WMI 如何利用 out 参数。请使用下面的 C# 代码,希望对您有所帮助:
public static void GetRegistryExclusions()
{
ManagementScope scope = new ManagementScope(@"root\standardcimv2\embedded");
using (ManagementClass mc = new ManagementClass(scope.Path.Path, "UWF_RegistryFilter",
null))
{
ManagementObjectCollection moc = mc.GetInstances();
foreach (ManagementObject mo in moc)
{
ManagementBaseObject[] result = (ManagementBaseObject[])mo.InvokeMethod("GetExclusions", null, null).Properties["ExcludedKeys"].Value;
if (result != null)
{
foreach (var r in result)
{
Console.WriteLine(r.GetPropertyValue("RegistryKey"));
}
}
}
}
}
注意/请求请求具有1500 名声望的人创建和链接以下标签,以便像我这样的人更容易在 stackoverflow 上请求解决方案/回答问题。
只有当我想把我的代码放在 SO 上时,我才从微软论坛上的提示中找到了 Manoj 的答案。因此添加关键字Unified Write Filter 和UWF_Volume(这样工作吗?)。
我使用稍短的语法来访问属性,并按照 OP 的要求返回排除的文件。我试图使它尽可能健壮,因为似乎有一些无效的卷条目。如果有人知道他们是什么,请告诉我。
public static string GetFilterDetail()
{
string details = "";
string detailsCurrent = "";
string detailsNext = "";
try
{
// Get WMI provider for UWF
var scope = new ManagementScope(@"\\localhost\root\StandardCimv2\embedded");
var managementPath = scope.Path.Path;
using (ManagementClass volumeFilterClass = new ManagementClass(managementPath, "UWF_Volume", null))
{
var volumeFilters = volumeFilterClass?.GetInstances();
if (volumeFilters != null && volumeFilters.Count > 0)
{
foreach (ManagementObject volumeFilter in volumeFilters)
{
if (volumeFilter != null)
{
// Now we have access to the Volume's WMI provider class
// First check if this is a valid Volume instance, as from trial and error it seems that is not always the case.
// Some invalid/undocumented instances throw a Not Found ManagementException on the GetExclusions method.
// Some also throw a NullReferenceException on mo.GetPropertyValue("Protected"), but that covers less cases.
bool isInstanceValid = true;
try
{
volumeFilter.InvokeMethod("GetExclusions", null, null);
}
catch (ManagementException ex)
{
if (ex.Message.ToLower().Contains("not found"))
isInstanceValid = false;
else throw ex;
}
if (isInstanceValid)
{
bool currentSession = ((bool)volumeFilter.GetPropertyValue("CurrentSession"));
string driveLetter = (string)volumeFilter.GetPropertyValue("DriveLetter");
bool isProtected = ((bool)volumeFilter.GetPropertyValue("Protected"));
string detail = "Volume " + driveLetter + " is " + (isProtected ? "protected" : "not protected") + ".\n";
detail += "Excluded files:\n";
ManagementBaseObject outParams = volumeFilter.InvokeMethod("GetExclusions", null, null);
if (outParams != null)
{
var excludedItems = (ManagementBaseObject[])outParams["ExcludedFiles"];
if (excludedItems != null)
{
foreach (var excludedItem in excludedItems)
{
detail += " " + driveLetter + excludedItem["FileName"] + "\n";
}
}
else detail += " [No excluded files]\n";
}
if (currentSession)
detailsCurrent += detail;
else
detailsNext += detail;
}
}
}
}
}
using (ManagementClass registryFilterClass = new ManagementClass(managementPath, "UWF_RegistryFilter", null))
{
var registryFilters = registryFilterClass?.GetInstances();
if (registryFilters != null && registryFilters.Count > 0)
{
foreach (ManagementObject registryFilter in registryFilters)
{
if (registryFilter != null)
{
// Now we have access to the RegistryFilter's WMI provider class
bool currentSession = ((bool)registryFilter.GetPropertyValue("CurrentSession"));
string detail = "Excluded registry keys:\n";
ManagementBaseObject outParams = registryFilter.InvokeMethod("GetExclusions", null, null);
if (outParams != null)
{
var excludedItems = (ManagementBaseObject[])outParams["ExcludedKeys"];
if (excludedItems != null)
{
foreach (var excludedItem in excludedItems)
{
detail += " " + excludedItem["RegistryKey"] + "\n";
}
}
else detail += " [No excluded registry keys]\n";
}
if (currentSession)
detailsCurrent += detail;
else
detailsNext += detail;
}
}
}
}
}
catch (Exception ex)
{
details += ex.ToString();
}
details += "\nNOTE: These settings are only active if the Write Filter is Enabled\n"
+ "\nCURRENT SETTINGS:\n" + detailsCurrent
+ "\nNEXT SETTINGS: (after next reboot)\n" + detailsNext;
return details;
}
示例输出: