Applications Systems

Set up AppInsight for Active Directory monitoring under the context of a "Least Privileges" account

This article describes how to configure AppInsight™ for Active Directory monitoring with the principle of least privileges. It assumes that you're using SAM 2020.2.6 or later and created a dedicated account without local admin permissions that will be used to monitor Active Directory only.

First published date

12/6/2021 8:08 PM

Last published date

1/30/2025 5:51 PM

Overview

To configure AppInsight™ for Active Directory monitoring with the principle of least privileges, start by creating a dedicated account called monitoring-ad in SAM 2020.2.6 or later. 

Note the following details:

  • Admin credentials are required to set up AppInsight, but are not required for monitoring later.
  • There is no automated configuration (also called "Zero Config") performed by the SolarWinds Platform, like in other AppInsight versions such as AppInsight for IIS.

 

Product section

Server Application Monitor

Resolution

AppInsight for Active Directory relies on following protocols for monitoring:

The following figure shows some of the component monitors included in the AppInsight for Active Directory template.

AppInsightAD.png


Protocol communication

This figure illustrates how various protocols are used by AppInsight for Active Directory:
AAD protocols.png


Setup LDAP Monitor

AppInsight for Active Directory requires read-only access to Active Directory via the LDAP Protocol, which can be accomplished by creating a domain account as a member of the “domain users“ group.

AppInsight polls Active Directory via LDAP exposed on default 389 port, along with trust data for domain controllers configured as Global Catalog (GC) servers via port 3268. LDAPS communication occurs over port TCP 636. LDAPS communication to a GC server occurs over TCP 3269.
 

Set up WMI-based polling

To support queries by Windows Performance Counters and Windows Event Logs, configure WMI for both WinRM- and DCOM-based polling that is enabled for remote polling. WMI configuration is also required to support Discovery jobs that check node availability and support the List Resources functionality.

WMI Classes used

  • Windows Services are queried with Win32_Service and Win32_Process classes from the root\cimv2 namespace.

Performance Counters


Set up WMI (DCOM)

To learn about setting up WMI (DCOM), see:

Following steps has to be taken:

  1. Make sure the "Windows Management Instrumentation" service is running.
  2. Grant DCOM permissions:
    • Start DCOM Configuration Console running: DCOMCNFG
    • Click "Properties" on "Component Services" > "Computers" > "My Computer" > NS NAVIGATE TO "COM Security" tab.
    • Under Launch and Activate Permissions, select the monitoring-ad and grant Remote Launch and Remote Activation permissions.
    • Under Permissions, select monitoring-ad and grant Remote Access permissions.
  3. Set WMI Namespace security for an account. See Setting Namespace Security with the WMI Control.
    • Open "Control Panel" > "Administrative Tools" > "Computer Management"
    • Under "Services and Applications" > "WMI Control" click Properties and under "Security" section browse tree of WMI namespaces.
    • Select the CIMv2 namespace.
    • Add monitoring-ad account to Security List of CIMV2 namespace.
    • Click advanced on added user.
    • Edit Permissions and grant "Remote Enabled" and Apply it to "This namespace and subnamespaces"
  4. Add the monitoring-ad user account to the Performance Monitor Users group.
  5. Set up Windows firewall for Remote WMI (DCOM) access. See Windows Firewall Settings.
    • Open DCOM port 135. This is the RPC endpoint that redirects clients to the WMI port.
    • Open a WMI Port. WMI uses the default dynamic port range, from 49152 to 65535. SolarWinds recommends running WMI on a fixed port. See Setting Up a Fixed Port for WMI. 
    • Open the ports range for syncs and callback handling.
    • Allow outgoing WMI Connections.


Set up WMI (WinRM)

For optimal performance, configure WinRM as the default transport method to be used for Windows Service Monitor components.
For reference, see:

WinRM configuration steps:

  • Start WinRM service.
  • Setup a WinRM HTTP or HTTP(S) listener with proper authentication and authorization.
  • Setup WS-Management Trusted Hosts list, if necessary (Kerberos can’t authenticate). This has to be configured on an Orion machine (client).
  • Setup firewall rules for ports:
    • 5985 for HTTP transport
    • 5986 for HTTPS.
  • Add monitoring-ad user or a dedicated user account to "Remote Management Users" group. 
  • Configure Orion to work with WinRM (this is configured by default).


Additional configuration for Windows Services Monitoring

Setup Services Access

 

To query Windows Services status with WMI by non-administrator accounts, additional configuration is needed that affects DCOM and WinRM on target monitored machines. 
For reference, see:

  1. Get the Security Identifier (SID) of the user to be used for monitoring, such as monitoring-ad. 
    • Run the following command with Admin privileges: 
      wmic useraccount where name="monitoring-ad" get sid
    • Result should get the SID in format below: S-1-5-21-4038477840-973917639-3687600978-1140 
      S-1-5-21-4038477840-973917639-3687600978-1140
  2. Assign permissions to a dedicated user with a given SID. You can also assign them to a built-in user group  like Authenticated User (AU) .
    • Retrieve the current access control list for the Service Control Manager with the following command:  
      sc.exe sdshow scmanager
    • Output will look similar to this example:  
      D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
  3. Extend the access control list with additional permissions:  
    (A;;CCLCRPRC;;;<paste-user-sid-here>)
    • Following permissions has to be granted:
      • CC (Create Child)
      • LC (SERVICE_QUERY_STATUS, List Children)
      • RP (Read Property)
      • RC (Read Control) 
  4. Execute the following command line with elevated privileges, as shown in the example below. Make sure to append the new section to the "D:" prefix section:  
    sc.exe sdset scmanager <paste list queries in previous step>(A;;LCCC;;;<paste-user-sid-here>)

# Example: sc.exe sdset scmanager D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPRC;;;S-1-5-21-4038477840-973917639-3687600978-1140)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
  5. Not All services can be queried with your limited user. You have to extend ACL for following services:
    1. NTDS
    2.  ADW
    3. DFSR
    4. DNS
    5. IsmServ
    6. Netlogon
    7. LanManServer
    8. W32Time
    9. LanManWorkstation
  6. Execute following steps for every service: (Repeat access control steps for every service)
    • Get ACL for service:  
      sc.exe sdshow <service-name>
    • Update ACL for service:  
      sc.exe sdset scmanager <paste-updated-acl-list>



Learn more


Note: 

Scripts are not supported under any SolarWinds support program or service. Scripts are provided AS IS without warranty of any kind. SolarWinds further disclaims all warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The risk arising out of the use or performance of the scripts and documentation stays with you. In no event shall SolarWinds or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the scripts or documentation.