nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
- SolarWinds Academy
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Least-Privilege Monitoring Account

SteveK

SolarWinds really needs a supported option for least-privilege monitoring on Windows servers. I'm surprised with the direction the IT industry is going, SolarWinds still only supports a full administrator account for monitoring. I have several different environments where I would like to use a centralized SolarWinds environment, but due to the permissions needed, it opens up additional attack vectors from one domain to another. EOC with additional SW implementations is a solution, but that gets costly if you have to procure additional SQL licenses to keep everything seperate. As well as the additional overhead for more SolarWinds infrastructure (Primaries, APE, etc…).

I think an easier solution to get around some of the compliance concerns would be to have a SolarWinds monitoring account that has read-only access to the targetted nodes. Being able to automate service starts, process kills, etc… is nice, but sometimes an environment just needs monitoring. In those situations why use a full fledged administrator account.

GMSA are also a step in the right direction, but even those don't support some of the items like Hyper-V.

Find more posts tagged with

Active

sam

orion

npm

Status: Active

Comments

rcbarr

Hmm, maybe I am not following you but is it a SolarWinds challenge or a OS challenge. For example, what rights (lowest privilege) do I need to create a sub-directory on a Windows Server (lower privilege can work here), or create a user account (lower privilege can not be used here)?

Maybe the happy place is like the Linux Agent, you need root just long enough to perform the installation, create the sub's, create the user (with targeted permissions only) and never need root again. I just think for Windows it is much less flexible.

I one hundred percent agree with you though on all the IT hardening going on, I am facing an issue with a High Availability configuration as I type this because of hardening efforts.

Good question !!

SteveK

I agree that it is kind of both. WMI/WinRM by nature seems like the path of least resistance to run queries is a Microsoft issue and giving it Admin Rights is easiest. So you could argue its a Microsoft deal.

SolarWinds Support and documentation is quick to say if you need to do this to reach out to Microsoft support. Which implies that it can be done. I'm kind of surprised that SW doesn't either have this item sorted out in a general "Here is the general process but due to your internal hardening it may not work and additional support from Microsoft could be needed" type approach.

I would love a read only agent, even if I have to provide temporary access to it for updates. My only concern is it would need to be able to do VMAN items as well (which unfortunately to fully monitor Hyper-V if you have to use WinRM/WMI)