Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

WMI Security

I see a lot of posts re SNMP vs WMI and we have a handful of Windows servers I'd like to make sure are being monitored in a uniform fashion. I am using WMI on some, but I started questioning the security of this. You have to have an administrative account to utilize this, so how do you make sure this is secure? I really don't want to use a domain admin account, but concerned about the overhead of individual accounts.

How are you monitoring with WMI securely?

Find more posts tagged with

Accepted answers

jm_sysadmin

This is a topic of conversation for many of us. Microsoft and windows doesn't include a read only/ auditor type role that we might want.

First lets talk about those Domain Admins rights. Nobody wants those to get out. If SNMP gives you what you need on Domain Controllers, then sticking with it isn't bad. If you need more, and many of us do, then think about using the Agents, maybe that gets you both the access you need and reduces the need of a domain admin. Straight WMI can be used, but you won't want to use those accounts for non-Domain Controllers. You can roll your own group and delegate out WMI access as you see fit also, but it can be a struggle. If I find a link about it I will post it.

Then there is all your other servers, and again the Agent is an option, but if you decide to go WMI, and you want to use the admin group (not build your own WMI access role) then that user would ideally be unique to each server. Clearly that can be painful, especially since Orion doesn't have an API to go pull an account from an external system. So if its the same admin user (in the local group, not the domain admins) on machines, consider breaking it up between risk groups, say by OS version, and then you retire the account with the servers as they age out. Also, the admin to monitor your servers, maybe its not an admin on Orion. If that account used on your oldest and likely most vulnerable) server get compromised, it would be great if that account couldn't take down everything else, and getting back into Orion is a target for gathering more credentials.

Also, lets assume that you rotate your passwords. Consider having 2 users for the same purpose. One user is active, the other not. Change the inactive user, and swap it in the credential manager. Then in a bit, the originally active user won't be and it can be put aside for the next change. If you have a busy Orion environment you can lock out that password very quickly on change, and this helps with that.

All comments

jm_sysadmin

This is a topic of conversation for many of us. Microsoft and windows doesn't include a read only/ auditor type role that we might want.

kendali

Wonderful response on this - you noted a number of things we have discussed as well. Thank you.

jm_sysadmin

If you are using SAM or SCM think about WinRM at the same time