Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

SolarWinds Agent for monitoring AppInsight for AD

I recently deployed the Solarwinds agent to a couple of Domain Controllers in hopes that we could eliminate the need for a Domain Admin account to monitor the AppInsight for AD monitor. After removing the service account from Domain Admins, the AppInsight monitor is no longer gathering Windows Event log, PerfMon, and Windows service data. It was my understanding that the Orion agent would locally poll WMI for the data.

Has anyone been able to successfully run an AppInsight for AD monitor via the agent and opening up the needed LDAP and Global Catalog ports?

Find more posts tagged with

Accepted answers

All comments

sturdyerde

I just tested one of my domain controllers with an agent and the following configuration:

Node polling method: Windows Agent (was previously using WMI)
WinRM Settings: EnableWinRM

The AppInsight for Active Directory is configured as:

Active Directory Credentials: Inherit credential from node
LDAP Port Number: 636
Global Catalog Port Number: 3269
Encryption Method: SSL
Authentication Method: Negotiate

Note: Of course, the node must first be configured and agent deployed using domain admin credentials. Please use different WMI monitoring credentials for your member servers than your domain controllers to reduce the spread of domain admin privilege exposure.

LatteLarry

Security aside, is there any benefit to using the Agent for Domain Controller and AD AppInsight monitoring vs WMI\WinRM?

sturdyerde

No significant benefits other than security, really. Assuming that you've already enabled WinRM for that node instead of relying on the legacy WMI over DCOM/RPC transport: in addition to being more secure, this change requires far fewer ports to be opened and is less resource intensive.