//---------------------------------------------------------------------------- // // Copyright (c) Intel Corporation, 2011 - 2015 All Rights Reserved. // // File: AgentPresenceApi.cs // // Contents: Sample code for an Intel (R) Active Management Technology (Intel® AMT) // AgentPresence Sample. // // Notes: This file demonstrates the usage of Intel® AMT Agent Presence // using WS-Management interface. // Agent Presence includes the ability for the Management Sub-System // to monitor the presence of SW-based agents (e.g. Anti-Virus, etc.) // running in the context of the OS, and take specific action, if a // SW-based agent is no longer present. // //---------------------------------------------------------------------------- using System; using System.Security; using Connection; using Intel.Management.Wsman; using Utils; namespace AgentPresence { public class AgentPresence_Api : Connection_setup { #region CONSTANTS private const string WIRED_PORT = "Wired"; private string DEFAULT_DEVICE_ID = "U0FNUExFX0FHRU5UAAAAAA=="; private const uint DEFAULT_BLOCKING_PRECEDENCE = 9; private const ushort DEFAULT_TIMEOUT_INTERVAL = 20; private const ushort DEFAULT_STARTUP_INTERVAL = 60; private const string DEFAULT_BLOCKING_NAME = "BLOCKING_POLICY"; private const string DEFAULT_AGENT_DESCRIPTION = "SAMPLE_AGENT"; private const string IP_HEADER_FILTER_NAME = "MyIPFilter"; private const string HDR8021_FILTER_NAME = "MyEthernetFilter"; public string CREATED_POLICY_NAME = "APPolicy"; private const ushort WATCHDOG_STATE_NOT_STARTED = 1; private const ushort WATCHDOG_STATE_STOPPED = 2; private const ushort WATCHDOG_STATE_RUNNING = 4; public static ushort WATCHDOG_STATE_EXPIRED = 8; private const ushort WATCHDOG_STATE_SUSPENDED = 16; private const ushort WATCHDOG_STATE_ANY = 255; private const ushort ACTIVATE_CB_POLICY = 0; private const ushort DEACTIVATE_CB_POLICY = 1; private const int MIN_NUM_OF_CL_PARAMETERS = 2; #endregion #region DATA MEMBERS public static CmdLineArguments Params = new CmdLineArguments(); private string NOT_EXIST_EXCEPTION = "No route can be determined to reach the destination role defined by the WSAddressing To."; #endregion #region CONSTRUCTORS // Creating the connection to the WSman Client. //Inheriting Connection details from Connection_setup class. public AgentPresence_Api(string ip, string username, SecureString pwd, bool krb, MpsManager proxy, bool acceptSelfSignedCertificate = false) : base(ip, username, pwd, krb, proxy, acceptSelfSignedCertificate) { } public AgentPresence_Api(string ip, string username, SecureString pwd, string clientCert, bool krb, MpsManager proxy, bool acceptSelfSignedCertificate = false) : base(ip, username, pwd, clientCert, krb, proxy, acceptSelfSignedCertificate) { } #endregion CONSTRUCTORS #region FUNCTIONS /// /// Returns a string representation for the given state. /// private static string GetAgentStateString(ushort state) { bool temp = false; string stateStr = ""; if (state == WATCHDOG_STATE_ANY) { return "any"; } if ((state & WATCHDOG_STATE_NOT_STARTED) != 0) { temp = true; stateStr = "not started"; } if ((state & WATCHDOG_STATE_STOPPED) != 0) { if (temp) { stateStr += " / "; } temp = true; stateStr += "stopped"; } if ((state & WATCHDOG_STATE_RUNNING) != 0) { if (temp) { stateStr += " / "; } temp = true; stateStr += "running"; } if ((state & WATCHDOG_STATE_EXPIRED) != 0) { if (temp) { stateStr += " / "; } temp = true; stateStr += "expired"; } if ((state & WATCHDOG_STATE_SUSPENDED) != 0) { if (temp) { stateStr += " / "; } temp = true; stateStr += "suspended"; } if (!temp) { stateStr += "unknown error"; } return stateStr; } /// /// Display the AMT_AgentPresenceWatchdog entry. /// /// verbose flag public void DisplayAgents(bool verbose) { Console.WriteLine("\nDisplay Agent Presence Watchdogs properties... "); //The ID of the agent watchdog in Base64 format, provided by the caller when the AMT_AgentPresenceWatchdog was created. //Currently the default value is being used. string deviceID = DEFAULT_DEVICE_ID; // Create a reference to AMT_AgentPresenceWatchdog instance. IManagedReference agentPresenceWatchdogRef = wsmanClient.NewReference("SELECT * FROM AMT_AgentPresenceWatchdog WHERE DeviceID='" + deviceID + "'"); IManagedInstance agentPresenceWatchdogInstance = agentPresenceWatchdogRef.Get(); // Display the Agent Details... Console.WriteLine("\tAgent's Name : {0}", agentPresenceWatchdogInstance.GetProperty("ElementName").ToString()); Console.WriteLine("\tCurrent State : {0}", GetAgentStateString(ushort.Parse(agentPresenceWatchdogInstance.GetProperty("CurrentState").ToString()))); Console.WriteLine("\tStartup Interval : {0}", agentPresenceWatchdogInstance.GetProperty("StartupInterval").ToString()); Console.WriteLine("\tTimer Resolution : {0}", agentPresenceWatchdogInstance.GetProperty("TimerResolution").ToString()); Console.WriteLine("\tTimeout Interval : {0}", agentPresenceWatchdogInstance.GetProperty("TimeoutInterval")); //Display the State Transition Conditions linked to AgentPresenceWatchdog Instance //and the agent presentWatchdogAction linked to the transition. //Get all instances linked to AgentPresenceWatchdog. IManagedReference concreteDependencyRef = wsmanClient.NewReference("CIM_ConcreteDependency"); concreteDependencyRef.AddSelector("Antecedent", agentPresenceWatchdogRef); // Error in this line, hence not working correctly. // Traverse to the CIM_ConcreteDependency instances that are connected to the AMT_AgentPresenceWatchdog instance. foreach (IWsmanItem concreteDependencyItem in concreteDependencyRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null)) { //For each instance, check if it is associated to the AMT_StateTransitionCondition instance. if (!concreteDependencyItem.Object.GetProperty("Dependent").IsA("AMT_StateTransitionCondition")) continue; //AMT_StateTransitionCondition specifies the condition that causes an action to occur. IManagedReference stateTransitionConditionRef = concreteDependencyItem.Object.GetProperty("Dependent").Ref; IManagedInstance stateTransitionConditionInstance = stateTransitionConditionRef.Get(); IWsmanItem oldState = stateTransitionConditionInstance.GetProperty("OldState"); IWsmanItem newState = stateTransitionConditionInstance.GetProperty("NewState"); Console.WriteLine("\tOld State : {0}", oldState.ToString()); Console.WriteLine("\tNew State : {0}", newState.ToString()); // AMT_AgentPresenceWatchdogAction represents the action that occurs when the transition condition is true. concreteDependencyRef = wsmanClient.NewReference("CIM_ConcreteDependency"); concreteDependencyRef.AddSelector("Antecedent", stateTransitionConditionRef); // Traverse to the CIM_ConcreteDependency instances that are connected to the AMT_StateTransitionCondition instance. foreach (IWsmanItem concreteDependencyItem1 in concreteDependencyRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null)) { // For each instance, check if it is associated to the AMT_AgentPresenceWatchdogAction instance. if (!concreteDependencyItem1.Object.GetProperty("Dependent").IsA("AMT_AgentPresenceWatchdogAction")) continue; // Get the AMT_AgentPresenceWatchdogAction object using its EPR. IManagedReference agentPresenceWatchdogActionRef1 = concreteDependencyItem1.Object.GetProperty("Dependent").Ref; IManagedInstance agentPresenceWatchdogActionInstance1 = agentPresenceWatchdogActionRef1.Get(); IWsmanItem eventOnTransition = agentPresenceWatchdogActionInstance1.GetProperty("EventOnTransition"); IWsmanItem actionSd = agentPresenceWatchdogActionInstance1.GetProperty("ActionSd"); Console.WriteLine("\tEvent on Transition :{0}", eventOnTransition.ToString()); if (actionSd != null) { Console.Write("\tAction Type : "); switch (Convert.ToUInt16(actionSd.ToString())) { case DEACTIVATE_CB_POLICY: Console.WriteLine("Deactivate policy"); break; case ACTIVATE_CB_POLICY: Console.WriteLine("Activate policy"); break; default: Console.WriteLine("Unknown error"); break; } } string fwVersion = UtilitiesMethods.GetCoreVersion(wsmanClient); if (UtilitiesMethods.CompareVersions(fwVersion, "18.0") >= 0) continue; IManagedInstance inputObject = agentPresenceWatchdogActionRef1.CreateMethodInput("GetActionEac"); IManagedInstance outputObject = agentPresenceWatchdogActionRef1.InvokeMethod(inputObject); IWsmanItem returnValue = outputObject.GetProperty("ReturnValue"); if (returnValue.ToString().CompareTo("0") != 0) continue; IWsmanItem actionEac = outputObject.GetProperty("ActionEac"); Console.WriteLine("\tAction Eac : {0}", actionEac.ToString()); } } } /// /// Queries and display the Intel(R) AMT device Console Watchdog capabilities /// /// boolean value for verbose mode public IManagedInstance QueryAgentPresenceCapabilities(bool verbose) { Console.Write("\nQuerying Agent Presence Capabilities... "); IManagedReference agentPresenceCapabilitiesRef = wsmanClient.NewReference("SELECT * FROM AMT_AgentPresenceCapabilities WHERE InstanceID='Intel(r) AMT Agent Presence Capabilities'"); IManagedInstance agentPresenceCapabilitiesInstance = agentPresenceCapabilitiesRef.Get(); IWsmanItem maxTotalAgents = agentPresenceCapabilitiesInstance.GetProperty("MaxTotalAgents"); IWsmanItem maxTotalActions = agentPresenceCapabilitiesInstance.GetProperty("MaxTotalActions"); IWsmanItem minGuaranteedActionListSize = agentPresenceCapabilitiesInstance.GetProperty("MinGuaranteedActionListSize"); string fwVersion = UtilitiesMethods.GetCoreVersion(wsmanClient); if (UtilitiesMethods.CompareVersions(fwVersion, "4.0") >= 0) { IWsmanItem maxEacAgents = agentPresenceCapabilitiesInstance.GetProperty("MaxEacAgents"); if (verbose) Console.WriteLine("\n\tMax Agents Registered and configured with EAC = {0}", maxEacAgents.ToString()); } if (verbose) { Console.WriteLine("\tMaximum Total Agents = {0}", maxTotalAgents.ToString()); Console.WriteLine("\tMaximum Total Actions = {0}", maxTotalActions.ToString()); Console.WriteLine("\tMinimum Guaranteed Action List Size = {0}", minGuaranteedActionListSize.ToString()); } else { Params.MessageDisplay_Color("Success.", ConsoleColor.Green); } return agentPresenceCapabilitiesInstance; } /// /// Creates an entry for an application that will be monitored by Agent Presence module. /// /// Reference URI of the created agent public IManagedInstance CreateAgentWatchdog() { Console.Write("\nCreating an Agent Presence Watchdog instance... "); IManagedInstance agentPresenceWatchdogInstance = wsmanClient.NewInstance("AMT_AgentPresenceWatchdog"); agentPresenceWatchdogInstance.SetProperty("CreationClassName", "AMT_AgentPresenceWatchdog"); agentPresenceWatchdogInstance.SetProperty("StartupInterval", "60"); agentPresenceWatchdogInstance.SetProperty("SystemCreationClassName", "CIM_ComputerSystem"); agentPresenceWatchdogInstance.SetProperty("SystemName", "Intel(r) AMT"); agentPresenceWatchdogInstance.SetProperty("TimeoutInterval", "120"); agentPresenceWatchdogInstance.SetProperty("DeviceID", DEFAULT_DEVICE_ID);//deviceID is in Base 64 Format of the GUID. agentPresenceWatchdogInstance.SetProperty("MonitoredEntityDescription", DEFAULT_AGENT_DESCRIPTION); agentPresenceWatchdogInstance.Create(); Params.MessageDisplay_Color("Success.", ConsoleColor.Green); return agentPresenceWatchdogInstance; } /// /// Sets an action state transition table for a defined watchdog entry. /// public void SetActions() { Console.Write("\nSets an action state transition... "); string fwVersion = UtilitiesMethods.GetCoreVersion(wsmanClient); IManagedReference agentPresenceWatchdogRef = wsmanClient.NewReference("SELECT * FROM AMT_AgentPresenceWatchdog WHERE DeviceID='" + DEFAULT_DEVICE_ID + "'"); IManagedInstance inputObject = agentPresenceWatchdogRef.CreateMethodInput("AddAction"); inputObject.SetProperty("OldState", "31");// Any state inputObject.SetProperty("NewState", WATCHDOG_STATE_EXPIRED.ToString());// Expired state inputObject.SetProperty("EventOnTransition", "true"); inputObject.SetProperty("ActionSd", Convert.ToString(ACTIVATE_CB_POLICY)); // "0"; if (UtilitiesMethods.CompareVersions(fwVersion, "4.0") >= 0) { inputObject.SetProperty("ActionEac", "true"); } IManagedInstance outputObject = agentPresenceWatchdogRef.InvokeMethod(inputObject); IWsmanItem returnValue = outputObject.GetProperty("ReturnValue"); if (returnValue.ToString().CompareTo("0") != 0) { throw new Exception("Failed to invoke AddAction to AgentPresenceWatchdog. PT_STATUS = " + returnValue); } Params.MessageDisplay_Color("Success.", ConsoleColor.Green); } /// /// Creates a System Defense Policy. /// /// EndpointReference of the created policy public IManagedReference CreateSystemDefensePolicy(bool verbose) { Console.Write("\nCreating a System Defense Policy... "); //create IP Filter if (verbose) { Console.WriteLine("\nCreating IPHeaderFilters..."); } // Create the IpHeadersFilter Filter. IManagedInstance ipHeadersFilterInstance = wsmanClient.NewInstance("AMT_IPHeadersFilter"); ipHeadersFilterInstance.SetProperty("InstanceID", "0"); ipHeadersFilterInstance.SetProperty("Name", IP_HEADER_FILTER_NAME); ipHeadersFilterInstance.SetProperty("CreationClassName", "n/a"); ipHeadersFilterInstance.SetProperty("SystemName", "n/a"); ipHeadersFilterInstance.SetProperty("SystemCreationClassName", "n/a"); ipHeadersFilterInstance.SetProperty("FilterProfile", "1"); ipHeadersFilterInstance.SetProperty("FilterDirection", "0"); ipHeadersFilterInstance.SetProperty("ActionEventOnMatch", "true"); ipHeadersFilterInstance.SetProperty("HdrIPVersion", "4"); // The ipHeadersFilterRef is an EPR to the new AMT_IPHeadersFilter object. IManagedReference ipHeadersFilterRef = ipHeadersFilterInstance.Create(); // Get IpHeadersFilter filter after the creation, in order to know which instanceID the filter has. ipHeadersFilterInstance = ipHeadersFilterRef.Get(); IWsmanItem ipFilterInstanceID = ipHeadersFilterInstance.GetProperty("InstanceID"); if (verbose) { Console.WriteLine("Creating Hdr8021Filter..."); } //Create Ethernet Filter. IManagedInstance hdr8021FilterInstance = wsmanClient.NewInstance("AMT_Hdr8021Filter"); hdr8021FilterInstance.SetProperty("InstanceID", "0"); hdr8021FilterInstance.SetProperty("Name", HDR8021_FILTER_NAME); hdr8021FilterInstance.SetProperty("CreationClassName", "n/a"); hdr8021FilterInstance.SetProperty("SystemName", "n/a"); hdr8021FilterInstance.SetProperty("SystemCreationClassName", "n/a"); hdr8021FilterInstance.SetProperty("HdrProtocolID8021", "33024"); hdr8021FilterInstance.SetProperty("FilterProfile", "3"); hdr8021FilterInstance.SetProperty("FilterDirection", "1"); hdr8021FilterInstance.SetProperty("ActionEventOnMatch", "false"); //The hdr8021FilterRef is an EPR to the new AMT_Hdr8021Filter object. IManagedReference hdr8021FilterRef = hdr8021FilterInstance.Create(); // Get IpHeadersFilter filter after the creation, in order to know which instanceID the filter has. hdr8021FilterInstance = hdr8021FilterRef.Get(); IWsmanItem ethernetFilterInstanceID = hdr8021FilterInstance.GetProperty("InstanceID"); IManagedInstance systemDefensePolicyInstance = wsmanClient.NewInstance("AMT_SystemDefensePolicy"); systemDefensePolicyInstance.SetProperty("InstanceID", "n/a"); systemDefensePolicyInstance.SetProperty("PolicyName", CREATED_POLICY_NAME); systemDefensePolicyInstance.SetProperty("PolicyPrecedence", "30"); systemDefensePolicyInstance.SetProperty("TxDefaultCount", "false"); systemDefensePolicyInstance.SetProperty("TxDefaultDrop", "false"); systemDefensePolicyInstance.SetProperty("TxDefaultMatchEvent", "false"); systemDefensePolicyInstance.SetProperty("RxDefaultCount", "false"); systemDefensePolicyInstance.SetProperty("RxDefaultDrop", "false"); systemDefensePolicyInstance.SetProperty("RxDefaultMatchEvent", "false"); systemDefensePolicyInstance.SetProperty("FilterCreationHandles", ipFilterInstanceID.ToString()); systemDefensePolicyInstance.AddProperty("FilterCreationHandles", ethernetFilterInstanceID.ToString()); // The systemDefensePolicyRef is an EPR to the new AMT_SystemDefensePolicy object. IManagedReference systemDefensePolicyRef = systemDefensePolicyInstance.Create(); Params.MessageDisplay_Color("Success.", ConsoleColor.Green); return systemDefensePolicyRef; } /// /// Creates an instance of AMT_AgentPresenceInterfacePolicy. This corresponds to adding the policy to /// the list of System Defense policies that can be activated by Agent Presence. /// This function is performed by default in the wired interface. /// /// /// /// true- for performing the operation in the wireless. else- false /// Reference of the new Interface Policy public IManagedReference SetInterfacePolicy(bool verbose, IManagedReference systemDefensePolicyRef, bool isWireless) { IManagedReference agentPresenceInterfacePolicyRef = wsmanClient.NewReference($"SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID='Intel(r) AMT Ethernet Port Settings {(isWireless ? "1":"0")}'"); try { agentPresenceInterfacePolicyRef.Get(); } catch (WsmanUnreachableException e) { if (e.Message.Contains(NOT_EXIST_EXCEPTION) && !isWireless) { Console.WriteLine( "\nCannot set an instance policy in a LAN-less machine...\n\tTo use wireless please add the 'wireless' argument"); return null; } } Console.Write("\nSetting an Agent Watchdog’s System Defense Policy..."); //Get a reference to the Relevant Instance Wired/Wireless Ethernet Port IManagedReference ethernetPortRef = wsmanClient.NewReference( "SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port " + (isWireless ? "1'" : "0'")); /* DeviceID -- “Intel(r) AMT Ethernet Port 0” – wired port -- “Intel(r) AMT Ethernet Port 1” – wireless port */ IManagedInstance agentPresenceInterfacePolicyInstance = wsmanClient.NewInstance("AMT_AgentPresenceInterfacePolicy"); agentPresenceInterfacePolicyInstance.SetProperty("Antecedent", ethernetPortRef); agentPresenceInterfacePolicyInstance.SetProperty("Dependent", systemDefensePolicyRef); agentPresenceInterfacePolicyRef = agentPresenceInterfacePolicyInstance.Create(); Params.MessageDisplay_Color("Success.", ConsoleColor.Green); return agentPresenceInterfacePolicyRef; } public IManagedReference SetInterfacePolicy(bool verbose, IManagedReference systemDefensePolicyRef) { return SetInterfacePolicy(verbose, systemDefensePolicyRef, false); } /// /// Removes an Agent Presence watchdog. /// /// The CimBase class to delete public void DeleteAgent() { Console.Write("\nRemove an Agent Presence watchdog... "); IManagedReference agentPresenceWatchdogRef = wsmanClient.NewReference("SELECT * FROM AMT_AgentPresenceWatchdog WHERE DeviceID='" + DEFAULT_DEVICE_ID + "'"); IManagedInstance inputObject = agentPresenceWatchdogRef.CreateMethodInput("DeleteAllActions"); IManagedInstance outputObject = agentPresenceWatchdogRef.InvokeMethod(inputObject); IWsmanItem returnValue = outputObject.GetProperty("ReturnValue"); if (returnValue.ToString().CompareTo("0") != 0) { throw new Exception("Failed to invoke DeleteAllActions to AgentPresenceWatchdog. PT_STATUS = " + returnValue); } agentPresenceWatchdogRef.Delete(); Params.MessageDisplay_Color("Success.", ConsoleColor.Green); } /// /// Delete System Defense policy. /// public void DeletePolicy() { Console.Write("\nRemove a System Defense Policy... "); IManagedReference systemDefensePolicyRef = wsmanClient.NewReference("SELECT * FROM AMT_SystemDefensePolicy");// WHERE InstanceID='Intel(r) AMT:Handle:x' IWsmanEnumeration systemDefensePolicyInstances = systemDefensePolicyRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null); foreach (IWsmanItem systemDefensePolicyItem in systemDefensePolicyInstances) { systemDefensePolicyRef = systemDefensePolicyItem.Object.ToReference("InstanceID"); IManagedInstance systemDefensePolicyInstance = systemDefensePolicyRef.Get(); if (systemDefensePolicyInstance.GetProperty("PolicyName").ToString().CompareTo(CREATED_POLICY_NAME) == 0) systemDefensePolicyRef.Delete(); } Params.MessageDisplay_Color("Success.", ConsoleColor.Green); } /// /// Get agents count. /// /// int, agents count. public int GetAgentsCount() { int count = 0; // Create a reference to AMT_AgentPresenceWatchdog instance. IManagedReference agentPresenceWatchdogRef = wsmanClient.NewReference("SELECT * FROM AMT_AgentPresenceWatchdog"); try { foreach (IWsmanItem agentPresenceWatchdogItem in agentPresenceWatchdogRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null)) { count++; } } catch (Exception e) { if (e.Message.CompareTo("No route can be determined to reach the destination role defined by the WSAddressing To.") == 0)// there are no agents. return 0; throw e; } return count; } /// /// Remove an Agent Watchdog’s System Defense Policy. /// public void RemoveAgentPresencePolicy(bool isWireless) { Console.Write("\nRemove an Agent Watchdog’s System Defense Policy... "); IManagedReference systemDefensePolicyRef = wsmanClient.NewReference("SELECT * FROM AMT_SystemDefensePolicy");// WHERE InstanceID='Intel(r) AMT:Handle:x' IWsmanEnumeration systemDefensePolicyInstances = systemDefensePolicyRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null); string instanceID = string.Empty; foreach (IWsmanItem systemDefensePolicyItem in systemDefensePolicyInstances) { systemDefensePolicyRef = systemDefensePolicyItem.Object.ToReference("InstanceID"); IManagedInstance systemDefensePolicyInstance = systemDefensePolicyRef.Get(); if (systemDefensePolicyInstance.GetProperty("PolicyName").ToString().CompareTo(CREATED_POLICY_NAME) == 0) { // The ID of the Agent Presence's System Defense policy. instanceID = systemDefensePolicyInstance.GetProperty("InstanceID").ToString(); } } // Select the wired interface. IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port " + (isWireless ? "1'" : "0'")); IManagedReference agentPresenceInterfacePolicyRef = wsmanClient.NewReference("AMT_AgentPresenceInterfacePolicy"); agentPresenceInterfacePolicyRef.AddSelector("Antecedent", ethernetPortRef); // Traverse to the AMT_AgentPresenceInterfacePolicy instances that are connected to the CIM_EthernetPort instance. foreach (IWsmanItem agentPresenceInterfacePolicyItem in agentPresenceInterfacePolicyRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null)) { //For each instance, check if it is associated to the AMT_SystemDefensePolicy instance // and then check if the instance has the instanceID of Agent Presence's System Defence we found above. if (agentPresenceInterfacePolicyItem.Object.GetProperty("Dependent").IsA("AMT_SystemDefensePolicy")) { // Get the AMT_SystemDefensePolicy object using its EPR. IManagedInstance systemDefensePolicyInstance = agentPresenceInterfacePolicyItem.Object.GetProperty("Dependent").Ref.Get(); if (systemDefensePolicyInstance.GetProperty("InstanceID").ToString().CompareTo(instanceID) == 0) { agentPresenceInterfacePolicyRef = agentPresenceInterfacePolicyItem.Object.ToReference("Antecedent"); agentPresenceInterfacePolicyRef.Delete(); } } } Params.MessageDisplay_Color("Success.", ConsoleColor.Green); } public void RemoveAgentPresencePolicy() { RemoveAgentPresencePolicy(false); } #endregion } }