Anyone using MBAM 2.5?

Content Authoring
1

We are looking to pull MBAM related data from endpoints using relevance. The source of the data is WMI (despite the perils of using WMI, this is the only source we are aware of for the data we require), namely the root\Microsoft\MBAM namespace which is created when the MBAM agent is installed. I’m wondering if anyone else out there has used Bigfix in conjunction with MBAM with any success as to me it appears that trying to query the mbam_Volume or mbam_Machine classes from the namespace is not possible from any 32 bit process. From the FixletDebugger in both local and client evaluator modes

Q: exists wmi "root\Microsoft\MBAM"
A: True
T: 1.985 ms
I: singular boolean

Q: selects "* from mbam_Volume" of wmi "root\Microsoft\MBAM"
E: The expression could not be evaluated: Windows Error 0x80041013: Provider load failure

From PowerShell (x86)

Get-WmiObject -Class mbam_volume -Namespace root\microsoft\mbam | select DriveLetter
Get-WmiObject : Provider load failure
At line:1 char:1

  • Get-WmiObject -Class mbam_volume -Namespace root\microsoft\mbam | sel …
  •   + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
  + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

From PowerShell 64 bit

Get-WmiObject -Class mbam_volume -Namespace root\microsoft\mbam | select DriveLetter

DriveLetter
D:
C:

First time I’ve encountered WMI data not being accessible due to the process architecture and as its not limited to just Bigfix process it doesn’t strike me as a client/debugger bug.

2

You cannot query a 64bit provider from a 32bit application. Please check:

https://msdn.microsoft.com/en-us/library/aa393067(v=vs.85).aspx
https://msdn.microsoft.com/en-us/library/aa390789(v=vs.85).aspx

3

Sounds like based on the first link someone should file an RFE to do this:

On a 64-bit system that has side-by-side versions of a provider, a 
32-bit application or script automatically receives data from the 32-bit
 provider, unless these flags are supplied and indicate that the 64-bit 
provider data should be returned.

This would be something we could do by adding something like the 32/64 bit Registry inspectors that we have. The default would remain the 32 bit way but it would add the capability desired.

4

Thank you all for your replies. I have submitted and RFE for this. https://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=99935

5

I voted for that one!

1 Like