SolarWinds really needs a supported option for least-privilege monitoring on Windows servers. I'm surprised with the direction the IT industry is going, SolarWinds still only supports a full administrator account for monitoring. I have several different environments where I would like to use a centralized SolarWinds environment, but due to the permissions needed, it opens up additional attack vectors from one domain to another. EOC with additional SW implementations is a solution, but that gets costly if you have to procure additional SQL licenses to keep everything seperate. As well as the additional overhead for more SolarWinds infrastructure (Primaries, APE, etc…).
I think an easier solution to get around some of the compliance concerns would be to have a SolarWinds monitoring account that has read-only access to the targetted nodes. Being able to automate service starts, process kills, etc… is nice, but sometimes an environment just needs monitoring. In those situations why use a full fledged administrator account.
Due to the how complex remote winrm or wmi gets with permissions, a read only agent could be the way to go. Granting an account temporary admin rights or pushing out the agent from a different source like SCCM would be an easier sell to the business. The agent would need to be able to handle all of the various monitoring functions (like VMAN for Hyper-V) to be really effective.
GMSA are also a step in the right direction, but even those don't support some of the items like Hyper-V. It also doesn't get away from requiring administrator rights.
