Archived community.zenoss.org | full text search
Skip navigation
Up to Discussions in zenoss-windows
6804 Views 2 Replies Latest reply: Jul 26, 2013 11:05 AM by Kevin Smith RSS
Kevin Smith Newbie
Kevin Smith
2 posts since
Jul 23, 2013
Currently Being Moderated

Jul 24, 2013 11:29 AM

WMI Non-Admin user not seeing all services

Hi,

 

I have gone through all the steps to set up a non-admin user for monitoring (DCOM, WMI, enable ntlm2 etc). All LOOKS good, except the zenoss user does not see all the services. I have not found any solutions out there:

Non Admin User:

wmic -U <domain>/zenoss --password='<PW>' //<server> "Select caption From Win32_Service" -d 1Caption|Name
Application Management|AppMgmt
DCOM Server Process Launcher|DcomLaunch
DHCP Client|Dhcp
DNS Client|Dnscache
Windows Event Log|EventLog
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Windows CardSpace|idsvc
KtmRm for Distributed Transaction Coordinator|KtmRm
Distributed Transaction Coordinator|MSDTC
Network Access Protection Agent|napagent
Net.Msmq Listener Adapter|NetMsmqActivator
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Net.Pipe Listener Adapter|NetPipeActivator
Net.Tcp Listener Adapter|NetTcpActivator
Net.Tcp Port Sharing Service|NetTcpPortSharing
Office Source Engine|ose
BranchCache|PeerDistSvc
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Performance Logs & Alerts|pla
Remote Access Auto Connection Manager|RasAuto
Remote Access Connection Manager|RasMan
Routing and Remote Access|RemoteAccess
Remote Procedure Call (RPC)|RpcSs
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Resultant Set of Policy Provider|RSoPProv
Security Accounts Manager|SamSs
Task Scheduler|Schedule
System Event Notification Service|SENS
Print Spooler|Spooler
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Secure Socket Tunneling Protocol Service|SstpSvc
Virtual Disk|vds
Windows Color System|WcsPlugInService
WinHTTP Web Proxy Auto-Discovery Service|WinHttpAutoProxySvc
Windows Update|wuauserv
[wmi/wmic.c:212:main()] OK   : Retrieve result data.

Admin User:

wmic -U <domain>/administrator --password='<PW>' //<server> "Select caption From Win32_Service" -d 1Caption|Name

Caption|Name
Application Experience|AeLookupSvc
Application Layer Gateway Service|ALG
Application Information|Appinfo
Application Management|AppMgmt
ASP.NET State Service|aspnet_state
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Windows Audio Endpoint Builder|AudioEndpointBuilder
Windows Audio|Audiosrv
Backup Exec Remote Agent for Windows Systems|BackupExecAgentAccelerator
Base Filtering Engine|BFE
Background Intelligent Transfer Service|BITS
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Computer Browser|Browser
Symantec Event Manager|ccEvtMgr
Symantec Settings Manager|ccSetMgr
Certificate Propagation|CertPropSvc
Microsoft .NET Framework NGEN v2.0.50727_X86|clr_optimization_v2.0.50727_32
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Microsoft .NET Framework NGEN v4.0.30319_X86|clr_optimization_v4.0.30319_32
COM+ System Application|COMSysApp
Cryptographic Services|CryptSvc
Offline Files|CscService
DCOM Server Process Launcher|DcomLaunch
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
DHCP Client|Dhcp
DNS Client|Dnscache
Wired AutoConfig|dot3svc
Diagnostic Policy Service|DPS
Extensible Authentication Protocol|EapHost
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Windows Event Log|EventLog
COM+ Event System|EventSystem
Microsoft Fibre Channel Platform Registration Service|FCRegSvc
Function Discovery Provider Host|fdPHost
Function Discovery Resource Publication|FDResPub
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Windows Font Cache Service|FontCache
Windows Presentation Foundation Font Cache 3.0.0.0|FontCache3.0.0.0
Group Policy Client|gpsvc
Human Interface Device Access|hidserv
Health Key and Certificate Management|hkmsvc
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Windows CardSpace|idsvc
IKE and AuthIP IPsec Keying Modules|IKEEXT
PnP-X IP Bus Enumerator|IPBusEnum
IP Helper|iphlpsvc
CNG Key Isolation|KeyIso
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
KtmRm for Distributed Transaction Coordinator|KtmRm
Server|LanmanServer
Workstation|LanmanWorkstation
LiveUpdate|LiveUpdate
Link-Layer Topology Discovery Mapper|lltdsvc
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
TCP/IP NetBIOS Helper|lmhosts
Multimedia Class Scheduler|MMCSS
Windows Firewall|MpsSvc
Distributed Transaction Coordinator|MSDTC
SQL Server FullText Search (MSSQLSERVER)|msftesql
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Microsoft iSCSI Initiator Service|MSiSCSI
Windows Installer|msiserver
SQL Server (MSSQLSERVER)|MSSQLSERVER
SQL Server Active Directory Helper|MSSQLServerADHelper
SQL Server Analysis Services (MSSQLSERVER)|MSSQLServerOLAPService
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Network Access Protection Agent|napagent
Netlogon|Netlogon
Network Connections|Netman
Net.Msmq Listener Adapter|NetMsmqActivator
Net.Pipe Listener Adapter|NetPipeActivator
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Network List Service|netprofm
Net.Tcp Listener Adapter|NetTcpActivator
Net.Tcp Port Sharing Service|NetTcpPortSharing
Network Location Awareness|NlaSvc
Network Store Interface Service|nsi
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Office Source Engine|ose
BranchCache|PeerDistSvc
Performance Logs & Alerts|pla
Plug and Play|PlugPlay
IPsec Policy Agent|PolicyAgent
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
User Profile Service|ProfSvc
Protected Storage|ProtectedStorage
Remote Access Auto Connection Manager|RasAuto
Remote Access Connection Manager|RasMan
Routing and Remote Access|RemoteAccess
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Remote Registry|RemoteRegistry
Remote Procedure Call (RPC) Locator|RpcLocator
Remote Procedure Call (RPC)|RpcSs
Resultant Set of Policy Provider|RSoPProv
Special Administration Console Helper|sacsvr
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Security Accounts Manager|SamSs
Smart Card|SCardSvr
Task Scheduler|Schedule
Smart Card Removal Policy|SCPolicySvc
Secondary Logon|seclogon
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
System Event Notification Service|SENS
Terminal Services Configuration|SessionEnv
Internet Connection Sharing (ICS)|SharedAccess
Shell Hardware Detection|ShellHWDetection
Software Licensing|slsvc
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
SL UI Notification Service|SLUINotify
Symantec Management Client|SmcService
Symantec Network Access Control|SNAC
SNMP Trap|SNMPTRAP
Print Spooler|Spooler
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
SQL Server Browser|SQLBrowser
SQL Server Agent (MSSQLSERVER)|SQLSERVERAGENT
SQL Server VSS Writer|SQLWriter
SSDP Discovery|SSDPSRV
Secure Socket Tunneling Protocol Service|SstpSvc
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Microsoft Software Shadow Copy Provider|swprv
Symantec Endpoint Protection|Symantec AntiVirus
Superfetch|SysMain
Telephony|TapiSrv
TPM Base Services|TBS
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Terminal Services|TermService
Themes|Themes
Thread Ordering Server|THREADORDER
Distributed Link Tracking Client|TrkWks
Windows Modules Installer|TrustedInstaller
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Interactive Services Detection|UI0Detect
Terminal Services UserMode Port Redirector|UmRdpService
UPnP Device Host|upnphost
Desktop Window Manager Session Manager|UxSms
Virtual Disk|vds
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Volume Shadow Copy|VSS
Windows Time|W32Time
Block Level Backup Engine Service|wbengine
Windows Color System|WcsPlugInService
Diagnostic Service Host|WdiServiceHost
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Diagnostic System Host|WdiSystemHost
Windows Event Collector|Wecsvc
Problem Reports and Solutions Control Panel Support|wercplsupport
Windows Error Reporting Service|WerSvc
WinHTTP Web Proxy Auto-Discovery Service|WinHttpAutoProxySvc
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Windows Management Instrumentation|Winmgmt
Windows Remote Management (WS-Management)|WinRM
WMI Performance Adapter|wmiApSrv
Portable Device Enumerator Service|WPDBusEnum
Windows Presentation Foundation Font Cache 4.0.0.0|WPFFontCache_v0400
[wmi/wmic.c:212:main()] OK   : Retrieve result data.
Windows Update|wuauserv
Windows Driver Foundation - User-mode Driver Framework|wudfsvc


  • hydruid Rank: Green Belt
    hydruid
    262 posts since
    Nov 5, 2012
    Currently Being Moderated
    1. Jul 24, 2013 2:26 PM (in response to Kevin Smith)
    Re: WMI Non-Admin user not seeing all services

    Give these a try, found a similiar post with these as the answer:

     


    Set WMI Permissions

    Run "wmimgmt.msc" from Start > Run on the remote device.

    Navigate to Properties > Security tab > Root > Security button

    Click Add and enter the user name that you are going to scan from.

    Click Check Names to verify the info and click OK.

    Now you will need to allow the following permissions:
    * Execute Methods
    * Enable Account
    * Remote Enable
    * Read Security

    Now click Advanced and select the same user in the Permissions list. Then click Edit.
    In the Apply Onto box, click This Namespace and Subnamespaces. Then click OK 3 times.
    2.

    DCOM Settings

    Run "dcomcnfg.exe" from Start > Run on the remote device.

    Select Component Services and then expand it.  Then expand Computers. Right-click My Computer and select Properties then select the COM Security tab.

    In the Access Permissions section, click Edit Limits.

    Click Add. Type the user name you'll be using to scan from Spiceworks.

    Click Check Names to verify your entry or entries, and then click OK.

    In the Permissions for User list, click the Allow check box next to the following permissions:
      * Local Access
      * Remote Access

    Click OK.

    In the Launch and Activation Permissions section, click Edit Limits.

    Click Add. Type the user name you'll be using to scan from Spiceworks.

    Click Check Names to verify your entry or entries, and then click OK.

    In the Permissions for User list, click the Allow check box next to the following permissions:
      * Local Launch
      * Remote Launch
      * Local Activation
      * Remote Activation

    Click OK twice.
    3.

    DCOM Settings Part Deux

    Expand My Computer and expand DCOM Config.

    Right-click Windows Management and Instrumentation and click Properties.

    Click the Security tab.

    In the Access Permissions section, click Edit.

    Click Add. Type the user name you'll be using to scan from Spiceworks.

    Click Check Names to verify your entry or entries, and then click OK.

    In the Permissions for User list, click the Allow check box next to the following permissions:
      * Local Access
      * Remote Access

    Click OK twice.
    4.

    Workgroup Devices Only

    It may be necessary to disable Simple File Sharing on the device if you're on a workgroup rather than a domain:

    Open Windows Explorer and select Tools > View tab.
    In the advanced settings section, uncheck "use simple file sharing (recommended)".
    Click OK/Apply.

  • Kevin Smith Newbie
    Kevin Smith
    2 posts since
    Jul 23, 2013
    Currently Being Moderated
    2. Jul 26, 2013 11:05 AM (in response to hydruid)
    Re: WMI Non-Admin user not seeing all services

    Thanks Hydruid,

     

    Been all over that again and again, rechecked my scmanager SSDL.

     

    If I manually add my user to a specific service it CANNOT see (same as modifying the scmanager SSDL), it works:

    sc sdshow <service>:

    D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

    sc sdset <service>

    D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCRPRC;;;<<User SID>>)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

     

    This is a crude workaround, I can add the above commands for services I know I want to monitor to my SDDL startup script no problem, but would like to know that Zenoss is not missing anything on discovery.

     

    I've been looking at user rights and local security policy, NTLM similar to Samba problems but found nothing yet. There is a middle layer somewhere ... same results Windows 2003 and 2008.

    

More Like This

  • Retrieving data ...

Legend

  • Correct Answers - 4 points
  • Helpful Answers - 2 points