Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Service account for APM Credentials

I would like to create a service account to use with APM. Currently I am uisng my domain account for testing which isn't good practice. What kind of rights do you need to give the account. I have found that some things do not seem to work unless I use my domain admin account. We are currently under a lot of pressure to reduce the number of domain admins. Is there documentation or guidelines anywhere on what rights are needed to get WMI and other queries APM uses? I have also noticed that if a local profile doesn't exist for the account you are using then it will not work until you have logged onto the server using that account (thereby creating a local profile). Is this by design? That seems cumbersome to me.

Find more posts tagged with

Accepted answers

dayley

We were shooting for an easy way to use a domain service account that wasn't a local administrator to monitor servers. We decided to use a domain account that was a local admin anyway, rather than modify the WMI settings on all the monitored servers.

Our domain admin's didn't like the idea of a service account having local admin access on domain controllers, so we figured out a way to work around this by splitting up the ownership of portions of the account password. This requires people on different teams to work together to configure a credential (each one supplies part of the password), but once the credential is in place, it can be used on DC's. It's not the ideal solution, but at least it prevents individuals from misusing the account for other purposes.

All comments

FormerMember

Take a look at this.

pguenther

All I am getting out of that document is that the user must be a member of the administrators group on the server. The service account that I am using (on the domain) is part of the local admin group but does not work when using the remote WMI testing. However, my domain admin account does. Why?

FormerMember

All I am getting out of that document is that the user must be a member of the administrators group on the server. The service account that I am using (on the domain) is part of the local admin group but does not work when using the remote WMI testing. However, my domain admin account does. Why?

I don't have enough info to answer your question. Please open a ticket and reference this thread.

dayley

So what was the final result of this query? We're experiencing a similar situation.

dayley

I contacted pguenther directly on this and received the reply:

"Unfortunately I did not ever get this to work. We have shelved the APM module for now and are focusing on redesigning the rest of the system with EOC."

It seems to me that unless this issue has already been addressed in recent versions of APM, our ability to use the product in a secure manner could be crippled.

FormerMember

dayley,

What exactly are you trying to do?

dayley