Network Management

Grant non-domain administrator account rights for IPAM DNS Monitoring

You may have a scenario where you need to poll the DNS server without an administrator account. The following steps detail how to use a non-domain administrator account.

First published date

11/29/2018 10:39 PM

Last published date

3/10/2022 7:19 PM

Overview

This article describes how to use a non-domain administrator account when you need to poll the DNS server without an administrator account. 

The user needs to be added to the DNSAdmin group. IPAM requires the account to have Read\Write permission for DNS management so that it can write itself to the DNS server as a zone transfer server. The account itself cannot be a domain administrator account in your environment, but the DNS admin is a must for the account within IPAM.

Permissions for the IPAM user within their Orion account settings can be specified if you wish to limit them to have read-only access to the DNS portion of IPAM. Unfortunately, this limitation is based on the user in Orion, and not by the account used to poll the DNS servers, so it is advisable to use a restricted service account for the DNS server and control user rights through IPAM itself.

Product section

IP Address Manager

Resolution

Use a DNS server administrator (account allowed to make changes on the DNS server) based on your network configuration to enable the account for WMI.

In Standalone DNS, it might be a local administrator (which by default is pre-configured for remote WMI access). Administrators are by default configured to make DNS server management tasks.

In an AD+DNS setup, it should be the account that has full DACL to manage the DNS Server, and additionally, it has to have an enabled remote WMI for management according to the steps below.

To configure DCOM Services:

  1. Start the dcomcnfg.
  2. Expand Component Services\Computers, right-click on My Computer, and select Properties.
  3. Click COM Security Tab.
  4. In the Access Permissions group, click Edit Default, add your account, and Enable Local Access and Remote Access Checkboxes.
  5. In the Access permissions group, click Edit Limits, add your account, and enable Local and Remote Access.
  6. In the Launch and Activation Permissions, click Edit Default, add your account, and Allow all checkboxes.
  7. In the Launch And Activation Permissions, click Edit Limits, add your account, and Allow all checkboxes.

To configure access to the WMI Branch:

  1. Start the MMC console and add WMI Control Snap-in.
  2. Right-click snap-in and click Properties.
  3. In the Security tab, select MicrosoftDNS and CIMV2 branch, and then click the Security button.
  4. Add your account, and allow: Execute Methods, Enable Account, Remote Enable.
  5. Verify that the new user you created has DNSAdmin rights on the DNS Security tab.
  6. Start dnsmgmt.msc.
  7. Right-click on Server/Service and view Properties to confirm that all the checkboxes for the new user are checked.
​
(Screenshots property of © 2021 Microsoft)

To test the connection to a DNS Server with specific credentials, use the wbemtest tool and connect to a machine using a namespace like:

\\remote_hostname\root\MicrosoftDNS

For additional information on WBEMTEST, see Unable to Add DNS Server to IPAM .

Note: To restrict the account to limited permissions then remove Full Control.