I found a lot online about setting up permissions for Remote WMI and it "mostly" gets you everything, but in the end I found that a lot of services still didn't show properly. http://community.zenoss.org/thread/12048
Using this Excellent post https://msmvps.com/blogs/erikr/archive/2007/09/26/set-permissions-on-a-specific-service-windows.aspx we can begin to understand what the different options mean and run the sc config with the proper permissions (rather than running the Zenoss or MS cmd blindly).
- Open cmd prompt on the server in question
- type sc sdshow scmanager
- Take note of the existing permissions. Notice that they are different for each OS version.
- Windows 2012 = D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
- Windows 2008 R2 = D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
- use pstools to get the SID of the account you want to use
- psgetsid username
- This gives you the SID for your username
- sc sdshow scmanager
- gives you the existing permissions
- Merge the permissions together for your new command (example on 2012 Server). Note that you ALWAYS want to APPEND what already exists.
- sc sdset scmanager D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPRC;;;YOURSIDHERE)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
- Note that this is appended prior to the S: section!
- Now if we test using that user account we see that we get back results, but wait surely I have more than 14 services set to auto... Yes, yes I do.
I don't know why, but this doesn't show all the services by far!
But, I found that adding permissions to the services in particular that you do want to monitor will fix.
For instance, query dfsr and you get the following (Found 0 Services)
So, lets get the permissions for the specific services and modify.
- sc sdshow DFSR
- D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
- Merge in your permissions
- sc sdset dfsr D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCRPRC;;;YOURSIDHERE)S:(AU;FA;CCDCL
CSWRPWPDTLOCRSDRCWDWO;;;WD) - Test :)
Either I'm missing something dumb or this is rediculous imo. I would have never thought that on my journey to setup a non-admin account for remote monitoring that I would be messing with permissions like this.
No comments:
Post a Comment