Configuring normal (non-administrative) accounts for WMI remote access
03/26/2020 15 People found this article helpful 398,193 Views
Description
The SonicWall Directory Services Connector and the Single Sign-On Agent are used to identify users who are logged in to the Windows domain. In previous releases, the SSO Agent could be configured to use either WMI or NetAPI to communicate with user workstations for user identification, by using the Domain administrator account. A new Query Source option to use the Domain Controller Security Log is available, which does not require use of the Domain administrator account. This option still requires read access to the security log, but this can be accomplished for a non-admin account by using the method described in this article.
Resolution
The best configuration procedure is to create/allow a user, and then add the user to the DCOM Users and Performance Monitor Users groups. The DCOM Users group already has remote access rights to the DCOM and the Performance Monitor Users group already has rights to read the performance counts. To configure non- administrator accounts for WMI remote access, perform the steps in the following sections:
Configuring the Domain Controller
Perform the following steps on the Domain Controller:
NOTE: This configuration example uses “TestDomainUser” as the username.
- Create a normal (non-administrative) user.
- Add the user to the Performance Monitor Users and DCOM Users groups.
- Open the wmimgmt.msc window.
- Select WMI Control (Local) from the left.
- Select the Properties.
- In the Enter the Object Names panel, enter the Performance Monitor Users group.
- Click the Advanced button
- Select the Performance Monitor Users group, then click the Edit button.
Configuring the Windows Firewall
If the firewall blocks the remote WMI access, perform the following configuration steps on the Windows Firewall:
- Navigate to the Windows Control Panel.
- Click the Windows Firewall link.
- In the left panel, select the Allow a program or feature through Windows Firewall option.
Configuring the DCOM Access
If the predefined DCOM Users group is not used, perform the following configuration steps for DCOM access:
- Start the dcomcnfg.exe.
- Open Component Services | Computers | My Computer.
- Select the Properties.
- In the Group or User Names panel select Distributed COM Users.
- In the Permissions for Distributed COM Users panel, select all the Allow checkboxes.
CAUTION: Be very careful when changing the registry settings on your Domain Controller. Be sure to make a backup copy of the registry before making any changes. - Windows 2003
- Locate the Security Event Log Key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security - Locate the original value of the CustomSD:
O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0005;;;SY)(A;;0x5;;;BA) - Insert the new value into the CustomSD:
O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;AU)
- Windows 2008
- Configure WMI remote access (if not already completed in the previous sections).
- Add the Event Log Readers group to the user account.
- Add the TestDomainUser to the Event Log Readers group.
Related Articles
Categories
Was This Article Helpful?
YESNO