topic Re: WMI/WBEM server discovery - cached credentials in Server Management - Systems Insight Manager

WMI/WBEM server discovery - cached credentials

TrevorT — Fri, 03 May 2013 01:07:20 GMT

How can I setup a server to be monitored by SIM and have it use a service account and not use an individual account?

Whenever I do a discovery, I need to put in credentials. I can't use the service account credentials during discovery - the service account isn't a domain admin.

After discovery, I use SIM to setup the service account to be able to do WMI queries (give it permissions).

Sadly, the account that did the discovery gets linked to the server. When the normal server discovery is run, that account is used, not the service account.

How can I set the service account to be the account used? I need to totally delink the account use d during discovery.

Alternatively, can I give the service account permissions ahead of time? How would I do that?

Finally - when doing discovery, can I set it to use the global credentails, and put the service account in the global credentials? Worst case, I could make the service account domain admin, but I very much want to avoid that.

Our current system just uses SNMP, but we're working to remove SNMP. SNMP removes the authorization mess I'm in now.

Re: WMI/WBEM server discovery - cached credentials

Casper42 — Tue, 07 May 2013 16:43:53 GMT

Go to the System page for the server in question, or put a check mark next to it in your list.

Go upper right to Options, Security, System Credentials.
That is where you store/manage the credentials used to communicate with that server.

Re: WMI/WBEM server discovery - cached credentials

TrevorT — Thu, 09 May 2013 00:35:58 GMT

That's true.

However, when doing the 'system discovery' task, which is run 2 or 3 times a week I beleive, it doen't use that credential. It uses the credentials that were set when the server was discovered initially.

So, I have a problem. I have a service account that is NOT domain admin. I have to run the discovery job with an account that is domain admin, and then run a 2nd job to give the service account permissions to do WMI queries.

1) how do I then force SIM to use the system account?

2) I do not want to give the service account password out. I would prefer to just enter it in the system as the global account, and have SIM use it, after I give that account WMI permissions on the computers. Is that possible? I've been trying to get that to work, and have had nothing but problems.