AppInsight for Active Directory requirements and permissions Question

Question

Hi, I'm new to windows DC server environment. I don't know how to setup read/write access. In Active Directory Users and Computers, it has builtin folder, that's where I add domain service account as a member in the security groups (e.g. event log readers, performance log users and etc), but I don't see how I setup read/write access permission. Any advice would be appreciated! Thank you.

Permissions

Provide domain credentials for an account that SAM can use to log in to AD to collect data.

*                                                 
* The account must be in the same domain as the DC, with read/write access to monitored AD instances and services. 
*                                                 
* Local admin privileges are required to assign AppInsight to nodes, but they are not needed for monitoring after setup.
*

jeremymayfield · Answer

The "read/write access" language in the SAM AppInsight for Active Directory requirements does not mean you need to grant broad AD write permissions to the monitoring account. It refers specifically to the account having sufficient read access to AD objects, services, and event logs for data collection, with write access limited to WMI and performance counter namespaces. A properly delegated, least-privilege domain service account is the correct and secure approach.

Did you create a Service account?  If not, start there.  Add it to the Built-in Security Groups.  Grant WMI Namespace Permissions, then configure DCOM.