gMSA service account minimum role permission to configure when polling with WinRM and failback to WMI ?

Folks,

To monitor Windows Server components, such as CPU, RAM, Disk Space, Uptime, Task Scheduler, and service status, using the SolarWinds Orion monitoring platform, does the minimum requirement require assigning the Windows Service Account (gMSA) to the Active Directory BUILTIN\Administrators group [https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#administrators]?

Because assigning Domain Admins [https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#domain-admins] is overprivileged and should not be used.

Thank you.

Find more posts tagged with

WinRM

gmsa

service account

Polling

Accepted answers

All comments

Onyxinator

Curious about this as well

itengineer

Yeah, I also haven't found any definitive answer from the SolarWinds KB article, hence I am asking the broader audience here.

mkarak

Hi, we updated requirements on this page: Use gMSA accounts for Windows polling

gMSA account needs to be member of LOCAL Administrators group on both sides (SolarWinds Platform polling engine and as well polled node). There is no requirement for it to be part of Active Directory “Domain Admins” group.

mapujece

No, the gMSA does not need to be added to the domain BUILTIN\Administrators group. It only needs local admin rights or delegated permissions on each monitored server to access WMI, performance counters, and service status. See more about configuring minimal permissions to avoid overprivileged accounts.