Tips for creating a non-administrator user for SAM application monitor polling to aid in troubleshooting by SolarWinds Support

For troubleshooting purposes, SolarWinds Support may ask you to temporarily use a local or domain administrator account for SAM application monitor polling to eliminate possible permission-related issues as the cause of polling errors related to SAM component monitors.

Important: This technique is intended for temporary use while SolarWinds assists with troubleshooting. Long-term use of this permission scheme may make your deployment vulnerable to unauthorized access. 

Note: SolarWinds Support cannot assist with the creation of least-privileged Windows user accounts, nor the assignment of permissions to user accounts. For assistance configuring Microsoft Windows’ user account permissions, contact Microsoft Technical Support.

Note: The following steps pertain to WMI-based component monitors. A related topic is User permissions for Windows Performance Counters over RPC.  

Services and command lines involved in the following steps include:


To temporarily use a local or domain administrator account for SAM polling of WMI-based component monitors, SolarWinds recommends the following steps: 

1. Create a regular user on the target machine (for example, SAMuser).
2. Add this user to the Performance Monitor Users and Distributed COM Users groups.
3. In the WMI management console, give this user the following permissions:
   • Add the user to the Authenticated Users off of Root (compmgmt.msc > WMI Control>Properties>Security tab > Root > Security > add user here).
   • Allow Enable Account and Remote Enable permissions.
   • From the 'Applies to' drop-down list, select 'This namespace and subnamespaces'.
4. Start the DCOM configuration console, right-click My Computer, and select Properties. Switch to the COM Security tab and grant the following permissions:
   • Under Launch and Activate Permissions, select the SAMuser and grant Remote Launch and Remote Activation permissions. (If the SAMuser is missing, add this user.)
   • Under Access Permissions, select the SAMuser and grant Remote Access permissions. (If the SAMuser is missing, add this user.)
5. Repeat the previous steps for each service included in the table above.
6. To allow the user created in step 1 (for example, SAMuser) to access the Win32_Service object remotely, grant additional permissions to the authenticated user:
   1. In a command window, type: 

      Sc sdshow scmanager

      The output should look like this:
      D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
   2. Change the first section from (A;;CC;;;AU) to (A;;CCLCRPRC;;;AU). This change adds the following permissions to the authenticated user:
      • LC = ADS_RIGHT_ACTRL_DS_LIST
      • RP = ADS_RIGHT_DS_READ_PROP
      • RC = READ_CONTROL
   3. Set the security permission:

      Sc sdset scmanager D:(A;;CCLCRPRC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

      Note: This applies to both machine access and launch and activation.
7. Verify that you started the Remote Registry service. (At this point, you should have a non-admin user that  is allowed to monitor most of the services, but not all of them.)
8. Not all services are accessible by authenticated users through remote connection. The last step to enable non-administrator user to be able monitor them is to adapt the non-admin user's security permissions on the remote machine. To do so:
   1. Log in to the monitored domain controller as an administrator.
   2. In the command window, type: 

      Sc sdshow <servicename/>

   3. The output should look like this:
      D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;CR;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
   4. To have more control over this, copy this string into a text editor, such as Notepad.
   5. In the command window, type:

      whoami /USER /FO LIST

      User information is returned, including the user name and SID.
   6. In a text editor, use this SID to construct a new permission section (where x = the SID):
      (A;;LC;;;S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxx)
   7. Add it to the service permission string you copied earlier into D: section:
      D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;CR;;;AU)(A;;LC;;;S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxx)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
9. Enter the following into the command window. See the service name table above for reference:

   Sc sdset  <servicename> D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;CR;;;AU)(A;;LC;;;S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxx)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

   Note: The proper syntax is sc sdset <service> <security> and you should run this command for each service that is not affected by the previous steps.

For more information, refer to this THWACK post: Active Directory Monitoring Credentials.

THWACK is a community space where users may post any content as a suggestion or recommendations to you for your internal use. The information set forth may come from third-party websites or customers. SolarWinds is not liable for any downtime or any issue that may occur if you perform the following suggestions on the link provided. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.