This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Powershell permissions for IIS , Active Directory and Exchange monitoring

max348 over 4 years ago

1.) I would like to know what are the least privileges that can be granted for a service account to monitor the SAM templates including IIS, Exchange, Active Directory, etc.,

2.) Is Interactive login permission or local admin required on a service account to monitor IIS and Exchange which runs Powershell queries.

3.) Do i need to give Full Control for the command "Set-PSSessionConfiguration Microsoft.PowerShell -ShowSecurityDescriptorUI -force" or just Read/ Execute permission is sufficient.

I also get below error while configuring IIS.

Credentials test failed.

Detailed error information: Connecting to remote server X.X.X.X failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.

0 HerrDoktor over 4 years ago

Are you thinking about the permissions to run the script itself that is behind the AppInsight or are you thinking about the actual application permissions?
the later ones can be found here:
exchange: Success Center
AD: AppInsight for Active Directory requirements and permissions
IIS: AppInsight for IIS requirements and permissions
Cancel
Vote Up 0 Vote Down

Cancel
0 max348 over 4 years ago in reply to HerrDoktor

Hi HerrDoktor
I have added Applnsight for Exchange, Active Directory and IIS with local admin credentials. Now our security do not want the "service account" to have local admin and interactive login privilege. So i would like to know
1.)    If Interactive login and local admin is required on service account to monitor AppInsight templates.
2.)    If Interactive login and local admin is required on service account to add any new Powershell related monitoring template.
3.)    Does Powershell require full control access on service account on this command "Set-PSSessionConfiguration Microsoft.PowerShell -
        ShowSecurityDescriptorUI -force" or just Read/ Execute permission is sufficient.
Cancel
Vote Up 0 Vote Down

Cancel
0 HerrDoktor over 4 years ago

Have a look here:
Use PowerShell in SAM
on the Orion Server you need local Admin on the node to monitor you need the permission to access the specific application over PowerShell commands.
However i am still not sure if you are talking about the permissions on the Orion Server or the Permissions on the node you want to monitor.
Cancel
Vote Up 0 Vote Down

Cancel
0 max348 over 4 years ago in reply to HerrDoktor

HerrDoktor I want to know permission on the nodes to be monitored like exchange servers, domain controller, web servers
Cancel
Vote Up 0 Vote Down

Cancel
0 mesverrum over 4 years ago in reply to max348

The exact permissions required are spelled out in the admin guide for sam and in those links HerrDoktor sent.
https://documentation.solarwinds.com/en/Success_Center/SAM/Content/SAM-AppInsight-Applications-sw1243.htm
Cancel
Vote Up 0 Vote Down

Cancel