WMI Question

SecurityGuy1173

Hey all,

I am not a Solarwinds guy however I work at an agency that uses it. I'm in the Security Operations area and noticed that Solarwinds was making WMI calls to all of our Domain Controllers. This concerned me because I'm not sure why Solarwinds would need to perform WMI queries against a DC. Does anyone know why Solarwinds would require this connectivity and if there are alternative means to gather the same information by Solarwinds. Thank you for any assistance you can provide.

SecurityGuy1173

KMSigma.SWI

I'm moving this question to the Orion Platform forum for visibility, but my brief answer is below.

It depends on what's being monitored (applications, drivers, CPU, etc.) and which products are doing the monitoring (Network Performance Monitor, Server & Application Monitor, etc.).  The Orion Platform products get details from most devices via SNMP (everything else) or WMI (Windows).  You can edit the "WMI" devices to now poll over WinRM (as below).  This is the 'default' for newer installs, but I don't remember the version where this was changed.  You can have your Orion admin edit the DC in the web console and look for the below.

The obvious choice as an alternative is to use the Agent, which (I'm pretty sure still) makes WMI calls, but it makes them against the local host.  In many organizations (including my previous company) no software was allowed to be installed on the Domain Controllers, so agents on DC's was not happening.

There is also a huge number of documents on the Support Site about the various polling details.