Monitoring Active Directory without Domain Admin account?

cole

I was curious if anyone has been successful in using another account that is not a Domain Administrator to monitor their Domain Controllers with a service account. We have a policy, which is out of my hands to change, that domain administrator account passwords must be changed every 60 days - thus causing a lot of breakage in my environment when someone forgets to change it in Solarwinds.

Anyone have any luck with this that can offer some guidance?

aLTeReGo

The simplest method would be to use SNMP instead of WMI/RPC for monitoring your domain controllers. In SAM you can monitor things like processes, services, hardware health, asset inventory, etc. using SNMP. You can also use TCP Port Monitors and the LDAP User Experience Monitor to ensure domain functions are working properly. None of these methods require domain admin privileges. If you do however need to collect information that's only available via WMI, this information too can be queried via SNMP using something like SNMP Informant. Lastly, you could create a least privilege user account for monitoring your domain controllers via WMI/RPC, but I'm not sure if those too would be impacted by your password change policies. 

It's also important to note that we are currently working on an optional Agent for SAM that could be installed on your domain controller (or any Windows host) and does not require any user credentials for monitoring.