From various documentation it appears that to change WMI access you need to use WMI to access the running service and modify specific parts of the tree.

Its kind of annoying changing 150,000 hosts using the UI.
And then having to include such changes in the process of adding new hosts.

Could write a script to do the same, but that needs to either connect to all those machines live, or be distributed for later update say in an startup/install script. And then you have to mess around with copying binary SD data from an example access control.

I've also found you can change the wbem/*.mof file to include an SDDL but I'm really vague on how that all works at the moment.

Am I just missing some point of simple administration?