What is Required to Configure High Availability

Question

We are currently undertaking two key initiatives: (1) upgrading our Active Directory environment from Windows Server 2016 to Windows Server 2022, and (2) strengthening the security posture and governance of our domain controller infrastructure.

The Problem: Our domain runtime account for building and managing the HA Pool (s) ARE in the DNSAdmins group, great.  Initially I thought this would be enough, I was wrong.  You won't see a problem with existing HA Pool(s) until (1) you need to re-create one or (2) You need to create a new one.

Fast Forward: So what is missing?  Through a lot of testing as well as what is documented in the Reference below, answer DCOM/WMI.

So what exactly is the role of DCOM/WMI?

Hypothesis: The runtime account being a DNS Admin and having DCOM/WMI permissions are two different security scopes.

For SolarWinds Observability Self-Hosted HA pools, the runtime account is not only updating DNS records, it also has to remotely manage and validate Microsoft DNS through WMI/DCOM interfaces during HA operations.  SolarWinds specifically documents that HA DNS management requires both DNS administrative rights and remote WMI management access.

Why DNS Admin alone is not enough?

Answer: A member of DNSAdmins can manage DNS zones and records, but the SolarWinds HA service communicates with the Microsoft DNS service through the WMI namespaceroot\MicrosoftDNS, which is exposed via DCOM/WMI.  To access that namespace remotely, Windows requires:

* DCOM Remote Access 
* DCOM Remote Launch 
* DCOM Remote Activation 
* WMI namespace permissions (Remote Enable, Execute Methods, etc.)

These are Windows security permissions separate from DNS role permissions.

My question is have any of you guys run into this and do you agree with my hypothesis?  My thinking is the core uses the WMI namespace to issues the commands to DNS when a failover occurs via the DCOM/WMI namespace.

Reference: https://solarwindscore.my.site.com/SuccessCenter/s/article/Required-DNS-Permissions-to-set-up-a-High-Availability-Pool-and-access-Microsoft-DNS?language=en_US

Summary..

The reason I landed here is b/c our HA solution had been working for years, then our Active Directory team upgrades our domain and it no longer works.  My guess is when they upgraded the domain controllers they stripped the DCOM/WMI  configuration on the target DNS server we were pointing to.  Now I find myself having to prove to our internal team the need for the DCOM/WMI config.

rcbarr · Answer

One last question Mr. Castaneda please.  Because many IT environments are now hardening their Active Directory implementations, do you know of ANYONE using F5 to manage SolarWinds HA Pools?

Appreciate your response and time sir.

mr.castaneda · Answer

For SolarWinds HA with Microsoft DNS, DNSAdmins alone is not enough because HA authenticates to the DNS server over WMI/DCOM and uses the root\MicrosoftDNS namespace to validate and manage DNS during pool setup and failover.

That means the service account needs two separate layers of access:

* DNS rights to create, update, and delete records on the Microsoft DNS server.
* DCOM and WMI rights so HA can remotely connect and execute DNS management calls, including DCOM Remote Access, Remote Launch, Remote Activation, and WMI permissions such as Execute Methods, Provider Write, Enable Account, and Remote Enable on root\MicrosoftDNS.

So if your AD/DC upgrade or hardening changes removed the WMI/DCOM permissions on the target DNS server, that would explain why previously working pools appeared fine until you had to validate, recreate, or create a pool again.

For documentation, these are the clearest references:

* Required DNS Permissions to set up a High Availability Pool and access Microsoft DNS — SolarWinds KB covering DCOM, WMI, root\MicrosoftDNS, and credential requirements.
* Set up a SolarWinds Platform High Availability pool — product documentation noting Microsoft DNS credentials and recommending a local admin with WMI access, or a non-local admin with full DACL and remote WMI management enabled.

I hope this information is useful.