Others Having Challenges with Least Privilege (POLP)? | LM Exchange

MWW · 2025-04-17T09:45:02.260000Z

Hi all. Just wanted to reach out to the community to see if others are running into the same challenges deploying the LM least-privilege service accounts as we are.This is what we've identified so far:LM can't retrieve metrics for disks where NTFS permissions don't include read access for the service account. I've scripted a PowerShell permissions check for disks in our environment, but I feel like this isn't a scalable solution.LM can't retrieve metrics for HyperV clusters. The workaround would be similar to the above.There doesn't appear to be a scalable way to confirm monitoring works across all instances/datasources after migration. I've written a script that retrieves all monitoring data for all resources from the LM API, puts it into a SQLite database, for later before/after comparison.The onboarding/migration script only sets SDDL permissions on currently installed services. If a service is newly-installed, or updated, LM can no longer monitor the service. I was considering scheduling the script to run on a regular basis, but read in this forum that it can exceed the max security descriptor length because it writes duplicate permissions.I've reach out to support on all of these issues and been told everything is 'working as expected', and that their devs 'can't anticipate every scenario'. Which is true! But none of what I described is due to an exotic configuration or niche software. Given that switching to a least-privilege model was portrayed as a 'mandate' a few months ago, I feel like remarkably little thought has gone into how this would impact customer environments, but I digress.Has anyone encountered similar issues? What's the consensus on whether the LM least-privilege model actually makes sense in the real world?

MoreDiscussions

Others Having Challenges with Least Privilege (POLP)? | LM Exchange | LogicMonitor Community