-
Title
What are the minimum requirements needed for WMI? -
Description
What permissions are required to be set on WMI name-spaces and DCOM?
What can be done when you cannot use a user in the Local Admin group of the Monitored Host for the Agent?
-
Resolution
WinRM is the preferred connection mechanism for monitoring Windows servers.
The following items must be in place before attempting to monitor a target application server using WMI.
- For domain-based authentication, a domain account with Administrator permissions for the monitored application server.
- For workgroup authentication, a local user account with Administrator permissions for the monitored application server.
Windows registry changes are often necessary on the monitored Windows server for WMI connections from Linux-based FglAMs to be successful.
Best practices would be to have a local admin user on the monitored host to be used by the agent as its OS user.If the OS user cannot be a member of the local admin group, please set permissions for the remote user on both DCOM and WMI components as described in KB article 102431 or the most recent copy of the Foglight Agent Manager user guide which is available for download from the Supportlink Technical Documentation area here.
DCOM default and limit permissions edited to allow for the following actions:
- Local launch (default permission)
- Remote launch (default permission)
- Local activation (limits permission)
- Remote activation (limits permission)
WMI Namespaces
Modify the SIMV2 security to enable and remote enable the account used to access the server or workstation through WMI. Ensure that the security change applies to the current namespace and subnamepaces.
Windows Firewall
Ensure that WMI traffic can pass through the firewall.
User Account Control
Remote UAC access token filtering must be disabled when monitoring within a workgroup environment.IMPORTANT: A single Linux Foglight Agent Manager can handle up to 75 Windows agents (either SQL Server agent or Infrastructure agents) using WMI. As a result, the number of Linux Foglight Agent Managers (FglAMs) is determined by the number of Windows agents divided by 75; for example, monitoring 300 Windows agents requires at least four (4) Linux Foglight Agent Managers.This limitation does not apply to Windows Agent Managers. Quest R&D has successfully tested up to 2000 agents using WMI (i.e. 1000 database agents + 1000 WindowsAgents) using a single Windows Agent Manager.If you are monitoring more than 75 agents using on a Linux FglAM, the monitored hosts should be configured to use WinRM.Please consult the latest version of the Foglight Agent Manager User Guide for more details on configured WMI and WinRM to monitor Windows hosts. -
Attachments