Configuring normal (non-administrative) accounts for WMI remote access

03/26/2020 12 11120

DESCRIPTION:

The SonicWall Directory Services Connector and the Single Sign-On Agent are used to identify users who are logged in to the Windows domain. In previous releases, the SSO Agent could be configured to use either WMI or NetAPI to communicate with user workstations for user identification, by using the Domain administrator account. A new Query Source option to use the Domain Controller Security Log is available, which does not require use of the Domain administrator account. This option still requires read access to the security log, but this can be accomplished for a non-admin account by using the method described in this article.

RESOLUTION:

The best configuration procedure is to create/allow a user, and then add the user to the DCOM Users and Performance Monitor Users groups. The DCOM Users group already has remote access rights to the DCOM and the Performance Monitor Users group already has rights to read the performance counts. To configure non- administrator accounts for WMI remote access, perform the steps in the following sections:

Configuring the Domain Controller
Perform the following steps on the Domain Controller:

NOTE: This configuration example uses “TestDomainUser” as the username.

1. Create a normal (non-administrative) user.
   
   
   
2. Add the user to the Performance Monitor Users and DCOM Users groups.
   
   
   
   
   
3. Open the wmimgmt.msc window.
4. Select WMI Control (Local) from the left.
5. Select the Properties.
   
   
   
6. In the Properties window, select the Security tab.
7. Select the Root file, then click the Security button.
   
   
   
8. In the Enter the Object Names panel, enter the Performance Monitor Users group.
   
   
   
9. In the Security for Root window, enable the Executive Methods, Enable Account, and Remote Enable checkboxes.
   
   
   
10. Click the Advanced button
11. Select the Performance Monitor Users group, then click the Edit button.
    
    
    
12. In the Apply Onto: field, click the drop-down list and select This namespace and subnamespaces. This allows read-only access to the whole WMI tree.
    

Configuring the Windows Firewall
If the firewall blocks the remote WMI access, perform the following configuration steps on the Windows Firewall:

1. Navigate to the Windows Control Panel.
2. Click the Windows Firewall link.
3. In the left panel, select the Allow a program or feature through Windows Firewall option.
   
   
   
4. Navigate to Component Services | Computers | My Computer, then select Properties.
5. Select the Windows Management Instrumentation checkbox, then select the Domain and Home/Work (Private) checkboxes.
   

Configuring the DCOM Access
If the predefined DCOM Users group is not used, perform the following configuration steps for DCOM access:

1. Start the dcomcnfg.exe.
2. Open Component Services | Computers | My Computer.
3. Select the Properties.
   
4. Click the COM Security tab.
5. In the Launch and Activate Permissions panel, click the Edit Limits button.
   
6. In the Group or User Names panel select Distributed COM Users.
7. In the Permissions for Distributed COM Users panel, select all the Allow checkboxes.
   

Updating Registry Settings for Windows 2003 and 2008
To read the Security Event Log you need to update the registry settings for Windows. Perform the following configuration steps to update your registry settings:

CAUTION: Be very careful when changing the registry settings on your Domain Controller. Be sure to make a backup copy of the registry before making any changes.

•  Windows 2003
  
  1. Locate the Security Event Log Key:
     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security
  2. Locate the original value of the CustomSD:
     O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0005;;;SY)(A;;0x5;;;BA)
  3. Insert the new value into the CustomSD:
     O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;AU)
• Windows 2008
  
  1. Configure WMI remote access (if not already completed in the previous sections).
  2. Add the Event Log Readers group to the user account.
  3. Add the TestDomainUser to the Event Log Readers group.