Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Is it possible to configure the solarwinds agent service to run as a different user (for Windows)?

When adding a node (windows server 2016), I'm choosing between WMI and agent polling method.

If I choose "Agent", it appears that the account I input into the credential box will only be used for install and that the local agent will run as "Local System", right?

Is there a way that we can specify the "Log On As" user to be a domain service account instead of "Local System"? (And do this in the solarwinds configuration instead of doing it manually after the install?)

We wanted a little more control over the user that the solarwinds service is running as and we haven't figured out how to configure solarwinds agents to run as a certain user (besides changing it after the install).

Thank you,

Find more posts tagged with

Accepted answers

All comments

tony.johnson

The Agent runs under the local system account by default. This can be changed under the Windows Service Manager to run as any user account you desire with whatever permissions you wish. That could, however, impact what the agent is ultimately able to poll on that endpoint based on the permissions of the user account the Agent is running under. This could also affect updates/upgrades of the Agent, which at a minimum, would need to be done manually to ensure the agent continues to run under that newly created user’s context.

sum_giais

@tony.johnson - thanks for the information.

I have been doing a bit of research on this as well and am trying to discern the appropriate permissions and configuration to achieve. So far, while I believe it's certainly possible... I think the primary focus is to run the agent under a least-privileged domain account for most users so to avoid it having "LOCAL SYSTEM" (e.g. local administrator-like permissions).

I started out my journey here in this article... https://support.solarwinds.com/SuccessCenter/s/article/How-to-create-a-non-administrator-user-for-SAM-polling?language=en_US. This was able to at least speak to the permissions required to poll WMI, DCOM etc. I did some initial testing to understand some of this with just a WMI node etc. The rest though as it relates to running the SolarWinds Agent service in windows, I've been testing with and got it to a point where it starts and then complains about being unable to open the agent certificate. Not sure what that issue may be yet, maybe because the certs are under local machine in the "SolarWinds Agent" certificate store, and the user cannot access... or the user cannot access the private machine key perhaps. I haven't done any triage to that yet...

I'm sure there's additional steps to allow for proper agent functionality and to allow running of a windows service (like allowing Logon as a service)

Ultimately anything I find out (if successful lol) I'll definitely end up sharing for the community at large here and perhaps a new DOC. Provided that's if it's not already documented. I couldn't find anything though.

Any help would be greatly appreciated. Thank you!

petr.krcmarik

Hello,

You are right, the credentials used for deployment are used for deployment only, the agent then runs under Local System account. If you want to change it, then there is indeed no way to do it from the website, only manually change on the target machine. The documentation does not exist for this, because we do not officially support it with the current code base -> you should create a Feature Request.

For the error with the certificate you are facing, it seems that the user does not have access to C:/ProgramData/Microsoft/Crypto/RSA/MachineKeys where the agent certificate used for communication with poller is stored.

Petr

sum_giais

Following up here that this ended up not being a viable solution. The long and short of it is it's not truly supported yet to run in a least-privileged mode.

As a note, it appear to be in the roadmap though now, see below however I did also submit a feature request. Vote on it if interested.

https://thwack.solarwinds.com/product-forums/server-application-monitor-sam/b/news/posts/what-we-re-working-on - "Documentation of least privileges for Orion Platform operation and monitoring including Orion agents"

Feature Request: thwack.solarwinds.com/.../support-running-solarwinds-agent-as-a-least-privileged-account

I'm sharing my results here as informational only. Do note that we did not find a solution to these problems and it's not a fully cooked solution at that...

Problem:

Windows service SolarWindsAgent64 will reset folder permissions and inheritance upon startup on the directory “C:\Program Files (x86)\SolarWinds\Agent” and “C:\ProgramData\SolarWinds\Agent”. This causes problems with functionality like listing resources on the nodes, pulling agent diagnostics etc.. Fixing the permissions post service start these functions work as expected.

GOAL:

Run the Windows SolarWinds Agent under a least-privileged account / context (e.g. NOT using Local System [NT AUTHORITY\SYSTEM] )

Testing proved a couple things.

One) The SolarWinds Agent service can successfully be run as a different account with least-privileges (noting all the problems)
Two) Polling and common monitoring is functional (again noting all the problems.)

The HOW:

Here are the steps we performed to get the Windows SolarWinds Agent Service to run as NT AUTHORITY\LocalService, this account is a native built-in Windows account that has least-privileges already.

1) Install the SolarWinds Agent, allow plugins to install (requires creating node etc.)
2) PowerShell - Provide read access to the SolarWinds Certificate Private Key for the NT AUTHORITY\LocalService account

$CertObj = Get-ChildItem 'Cert:\LocalMachine\SolarWinds Agent' | Where-Object { $_.Subject -match 'SWI-Orion-Agent' }
$rsaCert = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($CertObj)
$fileName = $rsaCert.key.UniqueName
$path = "$env:ALLUSERSPROFILE\Microsoft\Crypto\RSA\MachineKeys\$fileName"
$permissions = Get-Acl -Path $path
$rule = New-Object Security.AccessControl.FileSystemAccessRule "NT AUTHORITY\LocalService", "read", allow
$permissions.AddAccessRule($rule)
Set-Acl -Path $path -AclObject $permissions

3) PowerShell - Provide full access to the SolarWinds Installation directories for the NT AUTHORITY\LocalService account (these commands may be able to be consolidated or improved...)

ICACLS "C:\Program Files (x86)\SolarWinds" /grant 'NT AUTHORITY\LocalService:(OI)(CI)(F)' /T /C /Q /inheritance:e
ICACLS "C:\ProgramData\SolarWinds\" /grant 'NT AUTHORITY\LocalService:(OI)(CI)(F)' /T /C /Q /inheritance:e
ICACLS "C:\Program Files (x86)\SolarWinds\*" /grant 'NT AUTHORITY\LocalService:(OI)(CI)(F)' /T /C /Q /inheritance:e
ICACLS "C:\ProgramData\SolarWinds\*" /grant 'NT AUTHORITY\LocalService:(OI)(CI)(F)' /T /C /Q /inheritance:e

4) Command Prompt - Configure the SolarWindsAgent64 service to run as NT AUTHORITY\LocalService

sc config SolarWindsAgent64 obj="NT AUTHORITY\LocalService" password= ""