Audit Failure event when IWbemServices::Release() - events

Question

I have this WMI client's code. It connects well and works correctly. But...
const wchar_t server[] = L"MyServer";
const wchar_t login[] = L"User";
const wchar_t password[] = L"Password";
const wchar_t domain[] = L"";
HRESULT hr = NULL;
// COM
hr = CoInitializeEx(0, COINIT_MULTITHREADED);
if (FAILED(hr))
{
cout << "Failed to initialize COM library. "
<< "Error code = 0x"
<< hex << hr << endl;
return;
}
// Security
SEC_WINNT_AUTH_IDENTITY_W authIdentity;
SecureZeroMemory(&authIdentity, sizeof(authIdentity));
authIdentity.User = (USHORT*)login;
authIdentity.UserLength = wcslen(login);
authIdentity.Password = (USHORT*)password;
authIdentity.PasswordLength = wcslen(password);
authIdentity.Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;
SOLE_AUTHENTICATION_INFO authninfo[1];
SecureZeroMemory(authninfo, sizeof(SOLE_AUTHENTICATION_INFO));
// NTLM Settings
authninfo[0].dwAuthnSvc = RPC_C_AUTHN_WINNT;
authninfo[0].dwAuthzSvc = RPC_C_AUTHZ_NONE;
authninfo[0].pAuthInfo = &authIdentity;
SOLE_AUTHENTICATION_LIST authentlist;
authentlist.cAuthInfo = sizeof(authninfo) / sizeof(SOLE_AUTHENTICATION_INFO);
authentlist.aAuthInfo = authninfo;
hr = CoInitializeSecurity(
NULL,
-1,
NULL,
NULL,
RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
RPC_C_IMP_LEVEL_IMPERSONATE,
&authentlist,
EOAC_NONE,
NULL);
if (FAILED(hr))
{
cout << "Failed to initialize security. Error code = 0x"
<< hex << hr << endl;
CoUninitialize();
return;
}
// Locator
IWbemLocator *locator = NULL;
hr = CoCreateInstance(
CLSID_WbemLocator,
0,
CLSCTX_INPROC_SERVER,
IID_IWbemLocator, (LPVOID *)&locator);
if (FAILED(hr))
{
cout << "Failed to create IWbemLocator object. "
<< "Error code = 0x"
<< hex << hr << endl;
CoUninitialize();
return;
}
// Service
std::wstring networkResource = L"\\\\" + std::wstring(server) + L"\\root\\cimv2";
IWbemServices* service;
hr = locator->ConnectServer(
_bstr_t(networkResource.c_str()),
_bstr_t(login),
_bstr_t(password),
_bstr_t(L"MS_409"),
WBEM_FLAG_CONNECT_USE_MAX_WAIT,
_bstr_t(domain),
NULL,
&service);
if (FAILED(hr))
{
cout << "Could not connect. Error code = 0x"
<< hex << hr << endl;
locator->Release();
CoUninitialize();
return;
}
hr = CoSetProxyBlanket(
service,
RPC_C_AUTHN_WINNT,
RPC_C_AUTHZ_NONE,
COLE_DEFAULT_PRINCIPAL,
RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
RPC_C_IMP_LEVEL_IMPERSONATE,
reinterpret_cast<RPC_AUTH_IDENTITY_HANDLE>(&authIdentity),
EOAC_NONE
);
if (FAILED(hr))
{
cout << "Could not set proxy blanket. Error code = 0x"
<< hex << hr << endl;
service->Release();
locator->Release();
CoUninitialize();
return;
}
// Do something...
The problem occurs on disconnect: on service->Release() call the 2 Audit Failure events occur in the Security event log on target machine. It looks like an attempt to login but using the local account, not remote.
service->Release();
locator->Release();
CoUninitialize();
Here is the description of error (0xC0000064)
How to solve this and what's the reason? I've spent a lot of time but have no idea...
Thanks in advance!

Answer 1

I've found the answer through the comments on MSDN:
Comments of CoSetProxyBlanket function description
And here is the complete description:
Setting Security on a Remote IUnknown Interface
You have to create IUnknown interface from you IWbemServices instance and set security to it:
IUnknown* pUnk = NULL;
service->QueryInterface(IID_IUnknown, (void**) &pUnk);
hr = CoSetProxyBlanket(
pUnk,
RPC_C_AUTHN_WINNT,
RPC_C_AUTHZ_NONE,
COLE_DEFAULT_PRINCIPAL,
RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
RPC_C_IMP_LEVEL_IMPERSONATE,
reinterpret_cast<RPC_AUTH_IDENTITY_HANDLE>(&authIdentity),
EOAC_NONE
);
if (FAILED(hr))
{
cout << "Count not set proxy blanket. Error code = 0x"
<< hex << hr << endl;
pUnk->Release();
service->Release();
locator->Release();
CoUninitialize();
return;
}
// Now you can do what you want...