Disable ad_pdh and ad_wmi tasks when the collector is installed with the local system account. | Archive

Joe_Tran · 2015-09-17T09:56:21Z

We install our Windows Collectors with the Local System account (our environment unfortunately contains multiple domains without transitive trusts) and rarely define WMI credentials unless we need that information. The Active Discovery tasks that use PERFMON or WMI (ad_pdh & ad_wmi) are still trying to beat against our monitored Windows Servers with said Local System account and it's causing my Windows Server admins to complain to me that their security logs are filling up. I've taken the extreme measure of going through all of our isWindows() datasources/eventsources and updating them to not apply unless wmi.pass is explicitly defined or the collector is installed (wmi.pass || hasCategory("Collector")). The collector software should be able to programmatically differentiate between Local System vs any other account and when installed with Local System not to perform those Active Discovery tasks unless the device has wmi.pass.

Discussions

Disable ad_pdh and ad_wmi tasks when the collector is installed with the local system account. | Archive | LogicMonitor Community