WMI Agentless monitoring services

Overview

To use Opsview Monitor’s agentless Windows checks, you need a user account set up on the remote Windows server that has access to Windows Management Instrumentation (WMI) data counters. To set this up, follow these steps:

1. Create a standard Administrator account.
2. Configure a restricted user that is only allowed access to standard user functions and WMI performance counters.

Using an Administrator account for monitoring purposes can be a security risk, so the following instructions on how to create a more appropriate privileged user on the remote Windows server are provided below.

Configuration

This guide will complete three essential steps to set up the account:

• Grant the account access to Distributed Component Object Model (DCOM), which is used to run WMI queries.
• Give the account access to the WMI tree, with at least the root/CIMv2 branch permission.
• Add the user to the Performance Monitor Users group to enable performance monitoring.

It is recommended to create a user and adding them to the following Windows groups:

• Distributed COM Users — this group has default rights to access DCOM remotely.
• Performance Monitor Users — this group has default read-only rights to WMI performance counters.

Create a read-only monitoring account

1. Create a normal user with standard privileges.
2. Add the user to the following groups: Distributed COM Users and Performance Monitor Users.
3. Open the Windows Management Instrumentation control panel, and click Start > Run > wmimgmt.msc.
4. Right-click WMI Control (local) and select Properties.
5. Navigate to the Security tab.
6. Select the root namespace and click Security.
7. Add the group Performance Monitor Users to this account.
8. Select the following permissions for Performance Monitor Users:
   • Execute Methods: Allow
   • Enable Account: Allow
   • Remote Enable: Allow
   • Read Security: Allow
9. Once completed, select Performance Monitor Users in the list.
10. Click Advanced in the Security for Root dialog box.
11. Under Permissions, click Performance Monitor Users.
12. Select Edit and ensure This namespace and subnamespaces is selected under the apply to object.

Windows Firewall

If the Windows Firewall is enabled on the monitored host, you must change some settings to allow WMI requests.

1. Ensure that the Windows Firewall is started and operating correctly.
2. Navigate to Control Panel and open the Windows Firewall window.
3. On the left hand side, select Allow a program or feature through Windows Firewall.
4. Scroll down to the entry and select Windows Management Instrumentation (WMI).
5. Enable Private (Home/Work) and Public access, if required.

Configure DCOM Permissions

1. Open the Component Services window and click Start > Run > dcomcnfg.exe.
2. Expand Component Services > Computers > My Computer.
3. Right-click My Computer and select Properties.
4. Go to the COM Security tab.
5. Under Launch and Access Permissions, select Edit Limits.
6. Ensure that the group Distributed COM Users has the following permissions applied:
   • Local Launch
   • Remote Launch
   • Local Activation
   • Remote Activation
7. Save the changes.

You can now use this account to monitor your Windows server from Opsview Monitor.

Opsview Monitor configuration

Opsview Monitor makes it easy to add and start monitoring Windows servers using WMI, Microsoft’s tool for agentless monitoring.

1. Log in to the Opsview Monitor.

2. Navigate to Configuration > Hosts, and then click Add New.

3. Enter the details of the host, such as hostname/IP, description, and Host Group. If you have more than one Monitoring Cluster, the option to choose which one is monitoring the host will be present as well.

   

4. Select which Opsview Host Templates you want to use when monitoring Windows servers via WMI:

   • OS - Windows WMI - Base Agentless — monitor basics such as CPU, memory, and disk,. There is a variable named WINPROCESS that must be added if you want to monitor per process CPU or memory usage. You can add multiple attributes to spawn multiple checks, for example, 4 WMIPROCESS variables will add 8 service checks, 2 for each.
   • OS - Windows WMI - DNS Agentless — DNS service checks for A and CNAME records.
   • OS - Windows WMI - IIS Server Agentless — IIS Server service checks, such as transfer stats, user stats, and web server connections.
   • OS - Windows WMI - Terminal Services Agentless — Terminal services checks, such as number of sessions active.

5. Choose from these Host Templates using the selector, and then click the right arrow to add them to your host.

6. When adding a host, you can also select additional options such as SNMP or notifications (what you want to be notified about for this host). The most important part of this process is the Variables tab.

7. On the Variables tab, click Add New.

8. Type WINCREDENTIALS in the Name field or select it from the dropdown menu. Give a name or description in its corresponding Value field.

9. Once you click Save, you will see a list of checkboxes for the arguments that can be assigned to the variable.

10. Select the boxes next to the overrides for username and password, and then enter their respective values to allow Opsview Monitor to connect to your host:

    • Override Username — enter your username, for example, Administrator.
    • Override Password — enter your password.

    

11. Click Submit Changes to complete the process of adding a new host.

    Now Apply Changes to reload the Opsview Monitor configuration and begin monitoring the host.

12. After the reload, navigate to Configuration > Host Groups, Hosts and Services. Then expand the Host Group for the host you created, and then check the checkbox.

Now you can start adding more Windows hosts via WMI, create dashboards to visualize the collected data, and schedule reports to track SLA performance.