Issues with Switching Non-Admin Domain Account on a Windows Collector
I have configured a non-admin domain user that I would like to use as my collector account and am receiving an error once running the command ".\Windows_NonAdmin_Config -add -UserName domain\domainUser".
The response: GetSecurityDescriptor failed:
At C:\Program Files\LogicMonitor\Agent\bin\Windows_NonAdmin_Config.ps1:571 char:13
+ throw "GetSecurityDescriptor failed: $($output.ReturnValu ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (GetSecurityDescriptor failed: :String) [], RuntimeException
+ FullyQualifiedErrorId : GetSecurityDescriptor failed:
The log files are below: Set-WmiNamespaceSecurity call with add operation
ERROR - GetSecurityDescriptor failed:
I have previously ran the Non-admin file Windows_NonAdmin_Config.ps1 from C:\Program Files\Logicmonitor\agent\bin\ from the DC and it only ran through the first 3 phases before completing w/o errors. I added WMI permissioned from WMI Control (Windows Server Monitoring and Principle of Least Privilege | LogicMonitor) on the DC and the Windows device running the collector. I would appreciate guidance on the necessary settings for a domain user to replace the current system account on the collector, enabling it to serve as a WMI data collection account for the domain.
Virgil_Soulie
·1 year agoI stumbled upon this issue recently.
The script had already run successfully on Windows Server and was monitored with a non-admin domain account.
After an update, one service couldn't be queried and the non-admin script would fail with the following message:
In our case, a simple WMI repository reset did the trick:
Upon rebuilding the repository, the script ran without issues