檢查計算機上的第三方防火牆

Question

我正在檢查防火牆。下面的代碼很容易檢查默認的Windows防火牆的狀態：

INetFwMgr manager = GetFireWallManager(); 
    bool isFirewallEnabled = manager.LocalPolicy.CurrentProfile.FirewallEnabled; 
    if (isFirewallEnabled == false) 
    { 
     Console.WriteLine("Firewall is not enabled."); 
    } 
    else 
    { 
     Consoe.WriteLine("Firewall is enabled."); 
    } 
    Console.ReadLine(); 

    private static INetFwMgr GetFireWallManager() 
    { 
    Type objectType = Type.GetTypeFromCLSID(new Guid(firewallGuid)); 
    return Activator.CreateInstance(objectType) as INetFwMgr; 
    } 

，問題就變成了：如何找到一個非Windows防火牆的狀態？ 如果防火牆已正確集成，上述檢查工作是否會一樣，還是有更好的方法來做到這一點？ 我已經檢查了這個帖子：C# Windows Security Center Settings和這個帖子：C# - How to chceck if external firewall is enabled?但都證明相對無益。

我一直在研究WMI API，但它到目前爲止很困惑，而且通過MSDN的文檔並不是太有前途。 我也試過用SelectQuery搞亂，但到目前爲止我一直沒有成功。 任何人都可以在新的起點幫助我，或者我可以在哪裏找到更好的有關第三方防火牆的文檔/說明？

編輯：目前我正在進一步探索WMI，特別是如職位建議FirewallProduct類。

更新2：我一直在測試下面的代碼片段：

string wmiNameSpace = "SecurityCenter2"; 
    ManagementScope scope; 
    scope = new ManagementScope(String.Format("\\\\{0}\\root\\{1}", "localhost", wmiNameSpace), null); 
    scope.Connect(); 
    ObjectQuery query = new ObjectQuery("SELECT * FROM FirewallProduct"); 
    ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, query); 

但經營這將導致以下錯誤： Exception Invalid namespace並指向39行（scope.Connect()）。如果我只是錯過了一個參數或者不正確地格式化了一些東西，我不會感到驚訝，我只是不知道它是什麼。

UPDATE 3從SecurityCenter2到SecurityCenter開關仍然產生相同的invalid namespace錯誤。

更新4我將控制檯應用程序移到了另一個不同的盒子（win7不是winserver08r2），並且它按照預期正確回報。所以這可能是我目前正在測試的虛擬機的一個問題。下一步是解析出活動/非活動狀態

UPDATE 5它在另一個Server08盒子上進行了測試，並且出現相同的invalid namespace錯誤。使用SecurityCenter而不是SecurityCenter2不能解決問題。 Windows Server操作系統是否有一些基礎安全功能用於防止篡改防火牆，或者服務器操作系統沒有配備特定的WMI功能鍵集？

Answer 1

According to Microsoft Q: How does Windows Security Center detect third-party products and their status?

A: Windows Security Center uses a two-tiered approach for detection status. One tier is manual, and the other tier is automatic through Windows Management Instrumentation (WMI). In manual detection mode, Windows Security Center searches for registry keys and files that are provided to Microsoft by independent software manufacturers. These registry keys and files let Windows Security Center detect the status of independent software. In WMI mode, software manufacturers determine their own product status and report that status back to Windows Security Center through a WMI provider. In both modes, Windows Security Center tries to determine whether the following is true:

• An antivirus program is present.
• The antivirus signatures are up-to-date.
• Real-time scanning or on-access scanning is turned on for antivirus programs.
• For firewalls, Windows Security Center detects whether a third-party firewall is installed and whether the firewall is turned on or not.

所以，你可以使用WMI來確定是否安裝了第三方防火牆，使用FirewallProduct類，有時前，我寫這個話題解釋如何獲取使用WMI此信息的文章。

• Getting the installed Antivirus, AntiSpyware and Firewall software using Delphi and the WMI。

嘗試此示例C＃以獲取當前安裝的第三方防火牆名稱和狀態。

using System; 
using System.Collections.Generic; 
using System.Management; 
using System.Text; 

namespace GetWMI_Info 
{ 
    class Program 
    { 

     static void Main(string[] args) 
     { 
      try 
      { 
       //select the proper wmi namespace depending of the windows version 
       string WMINameSpace = System.Environment.OSVersion.Version.Major > 5 ? "SecurityCenter2" : "SecurityCenter"; 

       ManagementScope Scope; 
       Scope = new ManagementScope(String.Format("\\\\{0}\\root\\{1}", "localhost", WMINameSpace), null); 

       Scope.Connect(); 
       ObjectQuery Query = new ObjectQuery("SELECT * FROM FirewallProduct"); 
       ManagementObjectSearcher Searcher = new ManagementObjectSearcher(Scope, Query); 

       foreach (ManagementObject WmiObject in Searcher.Get()) 
       { 

        Console.WriteLine("{0,-35} {1,-40}","Firewall Name",WmiObject["displayName"]);      
        if (System.Environment.OSVersion.Version.Major < 6) //is XP ? 
        { 
        Console.WriteLine("{0,-35} {1,-40}","Enabled",WmiObject["enabled"]);  
        } 
        else 
        { 
         Console.WriteLine("{0,-35} {1,-40}","State",WmiObject["productState"]); 
        } 
       } 
      } 
      catch (Exception e) 
      { 
       Console.WriteLine(String.Format("Exception {0} Trace {1}",e.Message,e.StackTrace)); 
      } 
      Console.WriteLine("Press Enter to exit"); 
      Console.Read(); 
     } 
    } 
}