Configuring User Accounts for WMI access

Windows will only allow members of the Administrators or Domain Admin groups to read WMI class information by default. However, you can also configure the servers to allow non-admin accounts for WMI access.

Using Administrator Accounts

1. Use a local administrator account.

   Make sure that the user account used for Traverse WMI queries is a local administrator account on the remote Windows system that you want to monitor. Alternatively, you can use a domain administrator with WMI access.

   • If the user account used by Traverse is not an administrator on target server, but the user account has Remote Enable permission on target server, then you must also enable DCOM Remote Launch and Remote Activation permissions by executing Dcomcnfg.exe at the command prompt. For more information, go to http://msdn.microsoft.com/en-us/library/aa393266%28v=vs.85%29.aspx.
2. Enable remote administration on the target server. You can use either:
   • The Group Policy editor (Gpedit.msc)
   • A script to enable the Windows Firewall: Allow remote Administration exception
   • A netsh firewall command at the command prompt to allow for remote administration on target server.

   The following command enables this feature:

   netsh firewall set service RemoteAdmin enable

   If you want to use the Group Policy editor rather than the netsh commands, do the following steps in the Group Policy editor (Gpedit.msc) to enable Allow Remote Administration on Computer B.

   1. Under the Local Computer Policy heading, navigate to Computer Configuration > Administrative Templates > Network > Network Connections > Windows Firewall.
   2. If the computer is in the domain, then open the Domain Profile folder; otherwise, open the Standard Profile folder.
   3. Click Windows Firewall: Allow remote Administration exception.
   4. On the Action menu, select Properties.
   5. Click Enable, and then click OK.

Configuring a Non-Admin User Account for WMI

However, you can configure a regular windows user to access WMI information by adding the regular user account to the Distributed COM Users and the Performance Monitor Users group using lusrmgr.msc, and then configuring the DCOM security settings to allow the groups to access the system remotely (using dcomcnfg).

Steps for Windows 2003 R2 SP2 Server & Windows 2008 R2 Datacenter

1. Click Start > Run..., type lusrmgr.msc and click OK.
2. In the Users folder, right click the user to bring up the menu, and select Properties.
3. Click over to the Member Of tab, and click Add...
4. Under Enter the object names to select, add the Distributed COM Users group, click Check Names, then click OK.
5. Click Add...
6. Repeat step 4 for the Performance Monitor Users group.

   Next, configure the DCOM Security Settings to allow the groups to access the system remotely.

7. Click Start > Run..., type dcomcnfg and click OK.
8. Drill down into the Component Services tree until you get to My Computer. Right-click "My Computer" to bring up the menu, and click Properties.
9. Click the COM Security tab, then click Edit Limits under the Launch and Activation Permissions section.
10. Click Add...
11. Under Enter the object names to select, type Distributed COM Users, click Check Names, then click OK.
12. Click Add...
13. Under Enter the object names to select, type Performance Monitor Users, click Check Names, then click OK.
14. Check Allow for each of the permissions (Local Launch, Remote Launch, Local Activation, Remote Activation) for each of these groups, and click OK.
    
    Finally, set the WMI Control security settings to be applied to all namespaces.
15. Click Start > Run..., type wmimgmt.msc and click OK
16. Right-click WMI Control (Local) to bring up the menu, and click Properties.
17. Click over to the Security tab, then click Root, and click the Security button.
18. Click Add...
19. Under Enter the object names to select, type Distributed COM Users, click Check Names, then click OK.
20. Click Advanced.
21. Highlight the row with Distributed COM Users in it and click Edit...
22. From the drop-down list, select This namespace and subnamespaces
23. Under the Allow column check Execute Methods, Enable Account, and Remote Enable.
24. Repeat steps 12-17 for the Performance Monitor Users group.
25. Click OK to close all windows.

    If you are using Windows Server 2003 SP1 or later, you will have to run the following steps to access the Win32_Service class due to a known issue (http://support.microsoft.com/kb/907460):

26. Click Start > Run..., type cmd and click OK.
27. Type the following command at the command prompt and then press Enter:

    sc sdset SCMANAGER
    D:(A;;CCLCRPRC;;;AU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

    You should now be able to perform WMI monitoring on this windows host with a regular user account instead of an admin account.