Windows Script Monitor - Automatic Services - Cross Forest & Domain with No Trust

If there is no trust between the domains then you are unable to connect/authenticate against the remote computer due to Kerberos authentication. This is a limitation of Windows operating system security. You can test this yourself by attempting to map a drive from the Orion server to the remote host using that account.

If you're interested in monitoring the service state on a remote host where no domain trust exists I recommend using SNMP with SAM's "Service Status - SNMP" monitor instead of WMI or RPC.

I can obviously connect to the other nodes in the domains fine through windows authentication, since it will prompt for the destination credentials to use. If you supply these, then it will connect fine with no error. I can use normal WMI templates to monitor the services through solarwinds, the credentials solarwinds uses is the destination credentials; the issue is with running scripts against the destination server through solarwinds.

Is there a way to use powershell scripts through solarwinds that would work properly?

The template I used appears to be a VB script in some fashion.

Ryan

Yes, SAM's PowerShell Script Monitor supports remote execution and impersonation. Note: WinRM will need to be configured on the Orion server and remote host the script will execute against.

Is there any way to get the VB script through solarwinds to work properly with impersonation?

If there were templates that were in Solarwinds to check this type of functionality, I would certainly use it. The only ones are end user generated and grab performance data as well, which isn't what I'm after.

WinRM won't work since we have legacy servers as well and WinRM doesn't work as well with the older systems.

SNMP, which requires another thing to be installed, similar to legacy WinRM isn't desirable.

Ryan

VBScript, unlike PowerShell has no built-in mechanism for supporting impersonation. Impersonation must instead be incorporated into the script itself. The link below provides a few examples of how this is done.

• Setting the Default Process Security Level Using VBScript (Windows)

I'm looking into what I need to do to revamp the script.

Is there a way to use local accounts on the nodes?

Let's say I have a monitor account, named monitor and this account exists local to all of my servers. Is there a way in Solarwinds SAM to specify the .\ method of authenticating locally? (e.g. .\monitor)

I tried this on a pre-existing node, which has the new account and i get an immediate failure.

Thanks,

Ryan

SAM will pass the ".\" as part of the credentials, but your script will need to handle them appropriately. Is there any reason why SAM's "Service Status - SNMP" monitor does not satisfy your requirements? As an aside, we're currently working on a Agent for SAM that can be installed on a machine where no domain trust exists to allow you to monitor all aspects of that host as you normally would agentlessly. VBscripts would also be executed locally on the server where the agent is installed.

I'm keeping SNMP as a last resort option right now, since it will require installing SNMP across a large quantity of servers in our environment to take advantage of the service monitor.

The agent based design would solve a few of our problems actually and we look forward to the next release.

Is there any statics yet on how many resources the agent use when they're deployed under typical templates?

Thank You,

Ryan

One number I will share now is that the agent installer itself is a mere 16MB in size. It's been designed from the ground up to be very lightweight and efficient.

With VBscript or Powershell you can specify and use credentials. I mean, most of the service stuff is just using WMI on the backend as the native cmdlets [for PSH] don't support all the attributes that you need to get full data for this script. If you don't want creds in your scripts [I wouldn't] you should be able to specify a cred profile in SAM. See screenshot below.

As long as you pass it valid credentials for the remote domain it will auth fine. It's not a limitation of Windows persay aLTeReGo, it's as-designed.    Honestly the trust and forest part is mostly out of the question here. Since you can access remote shares, etc from the SAM server to those hosts, the necessary fw ports and whatnot have also been validated.

I've messed with the template you are using and you're correct, it is vbscript. You could do the same with PSH as it is mostly doing a Get-WMIObject and parsing data.