Hi cgibbons,
I'm working with Florian on this as well, and I did as you suggested withthe MS KB but that hasn't worked unfortunately. Do you need to put in a \\ in the zproperties user field? We have windows server 2003SP2 and a few 2008 servers
I have read your other posts on wmi security here
http://forums.zenoss.com/viewtopic.php?t=8745

Here what has been done so far, any info you have to let me know what went wrong or what still needs to be done is greatly appreciated.

 

 

These are the errors.
component zeneventlog
message Could not read the Windows event log (ExecNotificationQuery (WBEM_E_ACCESS_DENIED)). Check your username/password settings and verify network connectivity.

component zeneventlog
message Could not read the Windows event log (int() argument must be a string or a number). Check your username/password settings and verify network connectivity.

component zenwin
message Could not read the status of Windows services (int argument required). Check your username/password settings and verify network connectivity.

component zenwin
message Could not read the status of Windows services (NT_STATUS_ACCESS_DENIED). Check your username/password settings and verify network connectivity.

NO firewall enabled.

domain user added to local group distributed com users, performance log&monitor users group

In the security of WMI control properties, added to root and subnamespaces distributed com users group with allow execute method, Provider Write, Enable Account Remote Enabled

Modified the GPO view and then added the domain user SSID permission full access A;; 0x7;;;S-1-5-21-etc to Application, security & system event logs

dcom security
for DCOM remote launch and activation permissions for a user,
added Remote Launch select Remote Activation for domain user even though local distributed COM group has those permissions

for DCOM remote access permissions,
selected ANONYMOUS LOGON selected Remote Access, also added my domain user and local distributed COM group already had remote access

changed the access for the Service control manager to include my domain user with the following command
sc sdset SCMANAGER D:(A;;CCLCRPRC;;;AU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
D:(A;;CC;;;AU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPRC;;;S-1-5-21-etc)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

I also just added the SSID on some different servers to check this difference between this and the AU setting to see if this works
D:(A;;CC;;;AU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPRC;;;S-1-5-21-etc)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

Does http://support.microsoft.com/default.aspx?scid=kb;en-us;164018
need to be applied as its for NT351, NT4.0 and 2000?


I'm getting tired... it's not funny I have to do all this just to get wmi to work, can't wait for your KB...
Many thanks
Alex

You don't want to use a double blackslash in the zProperties.

You don't need it for zenwin & zeneventlog, but there is at least one community ZenPack that adds Windows performance monitoring (I forget which one) that in turn calls wmic commands. It doesn't properly escape the backslash either, so a lot of people just use a forward slash. If you want to know it works, just use that for now.

Setting up a non-Administrative user for remote Windows management is a real hassle, but it makes sense - you're effectively trying to do Administrative functionality with something that isn't intended to do it, so it's not like they (Microsoft) have made it easy.

We do have a knowledge base article written on how to do it fully, but it's within our enterprise support portal; we don't yet have a process for getting these KB articles published to the community yet, but we are working on it.

If you're already an experienced Windows administrator, you can do a lot of this automatically with the Group Policy Editor, so that helps a lot.

Quick question,

Does my domain user need to be in any Local groups for remote wmi request to work after I've made all these changes as specified above.

Distributed COM users
Performance log user
Performance monitor users

thanks again
Alex

thanks again for that KB, I had naturally read it in your last post, but decided to check it out again and apply the section on editing the rights locally on a sever outside of the GPO.

I have figured out the following after lots of trial and error. It is a logical process, almost like walking through one security door after another to get to the windows Eventlog. The only question I now have is what is ZenEventlog trying to read? (app, sys, security, dns, file) as the KB you posted only deals with rights to the Application and System log, do I need to add rights to the other logs as well?

component       zenwin
message   Could not read the status of Windows services (NT_STATUS_ACCESS_DENIED). Check your username/password settings and verify network connectivity.

component       zeneventlog
message   Could not read the Windows event log (NT_STATUS_ACCESS_DENIED). Check your username/password settings and verify network connectivity.

This is error is resolved by implementing
http://msdn.microsoft.com/en-us/library/aa393266.aspx

component       zeneventlog
message      Could not read the Windows event log (NT code 0xc0041003). Check your username/password settings and verify network connectivity.

component       zenwin
message      Could not read the status of Windows services (NT code 0xc0041003). Check your username/password settings and verify network connectivity.

This is error is resolved by implementing
http://technet.microsoft.com/en-us/library/cc787533.aspx

component       zenwin
message      Could not read the status of Windows services (Retrieve Result Data DOS 0xc00001001). Check your username/password settings and verify network connectivity.

This is error is resolved by implementing
http://support.microsoft.com/kb/907460
once this is done you get a cleared zenwin wmi connection is up message

component       zeneventlog
message      Could not read the Windows event log (ExecNotificationQuery (WBEM_E_ACCESS_DENIED)). Check your username/password settings and verify network connectivity.

This is error is resolved by implementing
http://support.microsoft.com/kb/323076
once this is done you get a cleared zeneventlog wmi connection is up message

I also got these two, do you know what int argument the error is referring to?

component       zeneventlog
message      Could not read the Windows event log (int() argument must be a string or a number). Check your username/password settings and verify network connectivity.
component       zenwin
message      Could not read the status of Windows services (int argument required). Check your username/password settings and verify network connectivity.

again any help you can provide is greatly appreciated.

I'd love it if one of the Zenoss Community Managers would be able to help out with this response...

Many thanks

I'm not sure what you're looking for here? cgibbions offered advice, but
yes, you're trying to do something non supported by core. Their docs
state that core needs an admin account. If you want to use some other
configuration, then in this case you need to pay for support or figure
it out yourself, or wait for the community to work it out.

I can personally attest that in the supported configuration using an
Admin account on the servers you're monitoring, Core WMI works out of
the box at least through 2.3.3.
--
James Pulver
Information Technology Area Supervisor
LEPP Computer Group
Cornell University



buzzle74 wrote, On 8/3/2009 9:37 PM:

 

 

So judging by the complete lack of response from the community managers evaluating Zenoss is a complete waste of time. If a guy who obviously has busted a gut trying to get something so fundamental as wmi to work doesnt get a response then there is no point in any of us admins investing time into this software. Obviously unless your a paying customer you will get no support. Its absurd that you guys cannot resolve this fundamental problem.







_______________________________________________
zenoss-windows mailing list
zenoss-windows@zenoss.org
http://lists.zenoss.org/mailman/listinfo/zenoss-windows

_______________________________________________
zenoss-windows mailing list
zenoss-windows@zenoss.org
http://lists.zenoss.org/mailman/listinfo/zenoss-windows

alzoo,

I'm on my support rotation starting next week, so if you'd like we can do a little bit of troubleshooting on IRC and maybe figure out what's going on.

At this point you have dug deeper than I have on getting this to work, so I'm not quite sure what you're running into that's preventing it from working.