Subscribe to WBEM Events for Domain Controllers

[NJK-Work]

Does anyone know how to get WBEM indications working for domain controllers?  Prior to the DC promo I subscribed to the WBEM indications on the servers and they worked.  Now that they are domain controllers, the WBEM alerts no longer get sent to SIM.  I tried to re-subscribe to them but the subscription task fails.  Our domain account used with the WBEM providers is in the Builtin local group (I believe these were formerly called  "domain local" groups) called "Distributed COM Users" - which I believe is the group used by domain controllers (in the "BuiltIn" folder in AD).

Adding to the account to "Domain Admins" is not an option...

Thanks

NK

[n0kia · Accepted solution]

Hello,

Try going through forum post and it should help out.

http://h30499.www3.hp.com/t5/ITRC-HP-Systems-Insight-Manager/Subscribing-to-WBEM-events-as-Non-Administrative-user-HP-SIM/td-p/5515781#.U_-5J_ldX14

[NJK-Work]

Thanks for the tip.

After reading it, all I can say is "Arrrggg!".  Looks like I will need to make the WBEM account a Domain Admin while I add the subscriptions and then remove it.  Not the worst thing in the world - but just silly how they design these things.

NK

[Andrew_Haak]

Hello there,

An other option is to go for the SNMP agents, this way you only need SNMP read rights. Write csn be handy for clearing logs but not needed as you can clear logs from logviewers on the server itself. Now config the trap to your SIM server and you will receive events.

If you want to use WBEM try the following:

You can also give the account remote dcom rights, read rights in all of the WMI tree exept for the wbem subscription part you would need wmi right rights.

[NJK-Work]

Yes - that worked.  I had to give the account READ access in WMI security.

[Andrew_Haak]

Perhaps an even easier way to do that is to run a repair and choose the option to set WBEM access to a non admin account, this way you need an admin account to fix the rights but then a non admin is set to be used to access the server. So the admin account is not saved in SIM but just used to set the non admin to be able to access the server.

This probably only works on member servers not DC's