To set user security rights for a Microsoft System Center Configuration Manager 2007 object instance by using the managed SMS Provider, you create an instance of an SMS_UserInstancePermissions object. You must provide the required security rights, the key value for the object instance, the object instance type, and the user that the rights are being set for.

For more information about Configuration Manager 2007 object rights, see Classes and Instances for Object Security in Configuration Manager (

For more information about setting rights for a class Configuration Manager 2007 objects, see How to Set User Security Rights for a Class of Configuration Manager Objects.

To set user security rights for a Configuration Manager object

  1. Set up a connection to the SMS Provider. For more information, see About the SMS Provider in Configuration Manager.

  2. Using the connection object you obtain in step 1, create an SMS_UserInstancePermissions object.

  3. With the SMS_UserInstancePermissions object, set the UserName property to the user name that you want to set permissions for.

  4. Set the ObjectKey property to the object type that you want to set permissions for. For more information, see SMS_UserInstancePermissions.

  5. Set the InstanceKey property to the key identifier of the object you want to set permissions for.

  6. Set the InstancePermissions property to the required permissions using the UserClassPermissions enumeration.

  7. Commit the SMS_UserInstancePermissions object.


The following example sets the instance permissions for a specific collection, identified by its collection identifier, for a supplied user.

For information about calling the sample code, see Calling Configuration Manager Code Snippets.

Visual Basic Script  Copy Code
Sub SetSecurityForCollectionInstance(connection, userName, collectionID)

	Dim permissions
	dim collections

	set permissions = connection.Get("SMS_UserInstancePermissions").SpawnInstance_()
	If Err.Number<>0 Then
		Wscript.Echo "Couldn't get instance permissions object"
		Exit Sub
	End If

	Set collections = _
		connection.ExecQuery("Select * From SMS_Collection where CollectionID = '" + collectionID + "'")

	If collections.Count = 0 Then
		WScript.Echo "Collection " + collectionID + " does not exist"
		Exit Sub
	End If
	permissions.UserName = userName
	permissions.ObjectKey = 1 'Collections
	permissions.InstanceKey = collectionID
	permissions.InstancePermissions = 3 ' Read and modify
	If Err.Number<>0 Then
		Wscript.Echo "Couldn't commit instance permissions"
		Exit Sub
	End If

	WScript.Echo "Instance permissions added"
C#  Copy Code
public void SetSecurityForCollectionInstance(WqlConnectionManager connection, string userName, string collectionID)
		IResultObject permissions = connection.CreateInstance("SMS_UserInstancePermissions");
		permissions["UserName"].StringValue = userName;
		permissions["ObjectKey"].IntegerValue = 1; //Collections
		permissions["InstanceKey"].StringValue = collectionID;
		permissions["InstancePermissions"].IntegerValue = (int)UserClassPermissions.Modify;
	catch (SmsException ex)
		Console.WriteLine("Failed to set permissions. Error: " + ex.Message);

This example method has the following parameters:

Parameter Type Description


Managed: WqlConnectionManager

VBScript: SWbemServices

A valid connection to the SMS Provider.


Managed: String

VBScript: String

The user name the right is applied to.


Managed: String

VBScript: String

The collection identifier. This can be obtained from the SMS_Collection class CollectionID property.

Compiling the Code

The C# example has the following requirements:










Robust Programming

See Also

Send comments about this topic to Microsoft.