NPM permissons for Windows Domain Controller

Is this for UDT User tracking?  If so, then it needs full access to the Security Event Logs on the DC.  If this is for WMI monitoring in NPM, the account has to be an administrative account per Microsoft's WMI requirements.

Regards,

Matthew Harvey

Senior Sales Engineer

Loop 1 Systems

http://www.loop1systems.com

Putting Knowledge Into Motion

To expand on mharvey's comments, you CAN accomplish WMI monitoring without an admin account - if you follow aLTeReGo's comprehensive "Portocalyps" document: https://thwack.solarwinds.com/community/solarwinds-community/product-blog/blog/2013/01/08/wmi-portapocalypse.

However, in IT we recognize the difference between technically-possible answers and the answers which are implementable by mere mortals. This would be one of those cases where mharvey's answer is correct, because it's the one you'll be able to explain within your organization.

Yes, yes. I know that giving an account local admin on a controller means it's a domain admin. Just make sure it uses a really REALLY strong password.

At CardinalHealth, the AD group was able to limit the permissions of our (domain admin) account so it had more limited priviledges on the domain controllers themselves. But when I asked what they did specifically, they were very tight-lipped about it.

Thanks guys.  This is for WMI and I think to accomplish what we need will have to go the local admin route bc I'm hesitant to change any domain admin privileges.  Appreciate all the help!

You won't be able to have local admin rights on a DC.  The local users and groups is removed due to the DC role being added.

Yup, that's what i meant to type

Thanks!

Leon,

With S/W now using agents will the agent identified in SAM 6.2 Beta - Because Sometimes You Feel Like A Nut - Part 2 work with NPM to eliminate the need for a domain admin account to monitor the DC via WMI or will the agent only work with SAM and application monitors?

File that under "things I haven't been able to get to during my period of transition". Let me see if I can get an answer for you though while I come up to speed.

I spoke to the guys who are involved with 6.2. They say you are correct - the new agent architecture will mean that you can monitor "sensitive" systems such as DC's or outside-the-DMZ boxes without constantly hitting it with a service account. The agent will send the relevant data BACK to the SolarWinds infrastructure.

Thanks Leon. I can't wait for the GA.

Hey, I want to clarify two things about my "yes you can" statement from the other day -

First and foremost - any comment made about future functionality has to be taken with a grain of salt. Any comment made by me about future functionality should be taken with a really big grain of salt. As with all development, Sh...tuff happens. For the official caveat, you should always refer to the "What Are We Working On" page (main page is here: What We Are Working On, SAM specific is here: Server & Application Monitor - What We're Working on Beyond v6.1).

Now that legal is happy...

I don't believe I was wrong in stating that the proposed agents will allow you to perform monitoring on a DC without the need to add a service account to the "local" administrators group - thus making it a domain admin.

HOWEVER... the specific use case that mharvey raises - collecting Windows eventlog data to correlate AD users to specific machines for UDT (user device tracking) is only supported agentlessly at this time and is not one of the expected upcoming features.

I just didn't want anyone running out an buying $1million of SAM because "Leon said it would polish my dog and make me a better dancer."