Has Anybody Ever Gotten WMI to Work without Admin credentials

This is what worked for me after quite a bit of work.  This is the least privilege scenario I could come up with:

• WMI Monitoring
  • Credentials
    • User Account
      • Member of Distributed COM Users
      • Member of Performance Monitor Users
      • Member of Users
        
    • WMI Namespace Security
      • Add user account to CIMV2 namespace
      • Allow Remote Enable
        
      • Allow Read Security
  • Firewall Settings
    • Run the following at cmd
      

      • netsh firewall set service RemoteAdmin enable custom <ip address or cidr>

  • For additional information on WMI
    • msdn.microsoft.com/.../aa394582(VS.85).aspx

This works fine for Performance Counter Monitor but not for Windows Service Monitor.

Any idea how to set account permissions for a non admin account that allows Windows Service Monitor to query services?

The only workaround I'm aware of is defining permissions on a per-service level using the "sc sdset" command

Are you still working on a solution for this credential issue? We wish to monitor windows service status with WMI but we can't have admin rights on the servers. This is not accepted by our security policy. Do you have an easy to deploy workaround. We have about 500 windows servers. The least steps the procedure will have, the better it will be.

We've created the following KB article that outlines the steps necessary to allow a non-Windows administrator to monitor Windows servers.

http://knowledgebase.solarwinds.com/kb/questions/3304/How+to+create+a+non-administrator+user+for+APM+polling.

Solarwinds just reorganized its KB into the "Success Center" and re-wrote all of the article URLs. Do you happen to know the new URL for this article? I've searched and can't find it. Many thanks.

jkuvlesk​ is heading up our KB migration effort. She should be able to answer that question.

Here is the article:https://support.solarwinds.com/?title=Success_Center/Server_%26_Application_Monitor_(SAM)/How_to_create_a_non-administra…

We will work on getting the redirect fixed.

Thanks!

I followed these steps and got it to work.

https://www.infrasightlabs.com/setting-wmi-access-ad-gpo/

You can either do it via the AD by using GPO or on each server individually.