Forum Discussion

jfmhfa01's avatar
jfmhfa01
2 years ago

Using a Dedicated Collector for each Windows Domain Controller?

We ran into trouble monitoring our Windows Domain Controllers because we want to use least privilege and we were only receiving ping and Host Status data. It showed “No data” for CPU, disks, etc. We...
collector
monitoring
windows server
  • tswisdom's avatar
    tswisdom
    2 years ago

    Good morning @jfmhfa01,

    As Mike mentioned, if we’re looking to monitor domain controllers without leveraging a Domain Administrator, we can install a Collector to each DC running as LocalSystem, which would only provide the Collector sufficient permissions to monitor the DC itself.

    For monitoring external servers in this scenario, wmi.pass and wmi.user properties pertaining to relevant credentials for the server would be need to be assigned to these resources, which will be used to authenticate instead of the LocalSystem account.
    https://www.logicmonitor.com/support/getting-started/advanced-logicmonitor-setup/credentials-for-accessing-remote-windows-computers

Cole_McDonald's avatar
Cole_McDonald
Icon for Professor rankProfessor
2 years ago

Mirroring TSWisdom,

We have a few instances where we have a client domain that has some resources registered to the domain, and some not… in those cases, we use local accounts for the unregistered devices and use the device level wmi.user and wmi.pass properties with a <hostname>\<username>  for each device.  It’s a bit more manual management, but gets the job done.  With the RestAPI, you can push that data in for a server when you set it up and have it generate a big secure password and store it in your password vault at the same time so that it’s auto-documenting and that you can give the higher risk devices on your network their own hardcore passwords.  At that point, you could technically even give them randomized usernames :)  How strong is your paranoia?