Forum Discussion

agonzalez's avatar
agonzalez
Icon for Neophyte rankNeophyte
2 years ago

Issues with Switching Non-Admin Domain Account on a Windows Collector

I have configured a non-admin domain user that I would like to use as my collector account and am receiving an error once running the command ".\Windows_NonAdmin_Config -add -UserName domain\domainUser". 

The response: GetSecurityDescriptor failed:
At C:\Program Files\LogicMonitor\Agent\bin\Windows_NonAdmin_Config.ps1:571 char:13
+             throw "GetSecurityDescriptor failed: $($output.ReturnValu ...
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (GetSecurityDescriptor failed: :String) [], RuntimeException
    + FullyQualifiedErrorId : GetSecurityDescriptor failed:

The log files are below: Set-WmiNamespaceSecurity call with add operation
ERROR - GetSecurityDescriptor failed: 

I have previously ran the Non-admin file Windows_NonAdmin_Config.ps1 from C:\Program Files\Logicmonitor\agent\bin\ from the DC and it only ran through the first 3 phases before completing w/o errors. I added WMI permissioned from WMI Control (Windows Server Monitoring and Principle of Least Privilege | LogicMonitor) on the DC and the Windows device running the collector. I would appreciate guidance on the necessary settings for a domain user to replace the current system account on the collector, enabling it to serve as a WMI data collection account for the domain.

collector

1 Reply

  • Virgil_Soulie's avatar
    Virgil_Soulie
    Icon for Neophyte rankNeophyte
    4 months ago

    I stumbled upon this issue recently.

    The script had already run successfully on Windows Server and was monitored with a non-admin domain account.
    After an update, one service couldn't be queried and the non-admin script would fail with the following message:

    Error occurred: Unexpected error
Error occurred in GetSecurityDescriptor step. Kindly retry or do the setup manually.

    In our case, a simple WMI repository reset did the trick: 

    Stop-Service Winmgmt -Force
winmgmt /resetrepository
Start-Service Winmgmt

    Upon rebuilding the repository, the script ran without issues