WMI Credentials

noki42  wrote: Can someone point me in the direction of the specifics for the WMI credentials needed for application monitor please?  My server team is asking for more details and I would like to see if I can send them a concise document on what the account needs.  Thanks.

SAM 6.9.1 System Requirements

Thanks for the response.  To give a little more detail, we have security and server teams that want to make sure they know exactly what rights and privileges the WMI process needs to have to connect and share information with solarwinds.  I had found a detailed list at one point, but now I can't seem to find it again.  Does anyone have information on setting up WMI itself and what permissions it needs to function properly with solarwinds?  Thanks.

The problem is that short of having an admin account the exact permission vary depending on which products you are using and which features you want to use.

For the most basic server monitoring then just being a member of dcom readers and the ability to hit wmi works, but depending on what exactly you need I n addition to basic server stats you tend to need to add permissions from there

https://support.solarwinds.com/SuccessCenter/s/article/WMI-requirements-for-SolarWinds-accounts

Is there an updated link to that article? 

I've opened a ticket and have also called into support --- all I'm told is that "due to the recent security breach...." things have been changed.

That's fine, but that specific bit of information has now become extremely important to my directors all of who are now looking at me for this information.

Hi - I'll do some research and see if that document has updates.   Could you expand on more of what you are looking for? 

Info on the breach in case you don't have them:

• Security FAQ
• Our Plan for a Safer SolarWinds and Customer Community
• New Findings From Our Investigation of SUNBURST

As it stands right now, the account used in Solarwinds to monitor systems is required to be hold full administrative permissions. 

While this is useful as it can provide an account which does everything, it introduces some obvious potential security holes. For my immediate uses, we are just looking to have an account with the least amount of privileges to monitor systems. (Read log files, read events, etc) 

Basically general SAM monitoring. 

Have you considered using the Agent?  I deployed the SAM agent because it uses the computer/servers LOCAL SYSTEM account.   So no admin account needed on all your devices.  

The agent was considered, but after this recent security breach incident (which had a negative view of using the agent) no one in my organization trusts it.