UNC Path ability to impersonate specific user
Hello,
As an MSP we've the need to monitor a lot of directories/shares for the same client.
Some of those shares are accessible with the collector user, however, we've some clients that restrict their share to specific users (not the ones running the collector service).
I've tried to create a datasource that's a simple runas where we can pass the user/passwd as a parameter, however, that isn't possible to run from the collector level (confirmed by LM staff in a case that I've raised).
Can this be implemented? This feature would be very important (since we monitor +100 clients).
Vitor_Santos
Posted 6 years ago·Last reply 6 years ago
4 comments
Vitor_Santos
OP6 years agoHello @Michael Rodrigues, thanks for sharing this!
If possible, please advise once that gets published.
In the meanwhile I've used this code (tweaked it a little bit) & created a DataSource for what we want.
Downside here is, from what I tested it only works if the LM collector service is running as user (not as local system) but, I guess this does the trick (since we force that service to run as an admin account).
Thank you!
Michael Rodrigues
·6 years ago@Vitor Santos, @Mike Moniz, thanks for the discussion. I did some digging in JIRA, as this has come up before. I think I found a DataSource that solves this, it just never found its way into core. I'll get this into a sprint for review so we can see about giving it a proper release. Code looks like this:
Vitor_Santos
OP6 years agoThanks for the feedback @Mike Moniz
Totally got your point & makes sense!
The share modify is an option, however, we've some picky clients that would consider that a security concern since some shares contain very sensitive information to the company & our service accounts are available for multiple people within our organization.
Store the user credentials in LM would be more secure (from a manage point of view) because only a small number of engineers have permission to access the features that could retrieve those stored credentials.
I'll explore the 'New-PSDrive' thing & see if it's possible to do what we want (which is essentially what UNC Path already does but, with a different user). I didn't thought on that, thanks for the suggestion!
Mike Moniz
·6 years ago(not to discount the feature request)
Tried looking at using PowerShell script with New-PSDrive to temp map the UNC path with a different credentials? I generally would request the shares be modified to include the monitoring account rather then store user credentials in LM and dealing with these users changing their passwords.