Insight Manager 7 privileges - minimum requirements

[Celx]

Can someone confirm what the minimum permissions are required for Insight Manager Server and Agent to communicate in an NT / AD domain. Surely giving the Insight Manager service account Domain Admins is overkill?

Thanks for any replies.

[Chris Turnbull]

Hi Celx,

When you talk about the IM 'service account' - does this mean you are running the Agent services on your servers with a specified domain account? If so, you are probably better off running them as the local system account on each box - there is no need for a domain account to be used. The same goes for your Insight Manager services.

Provided you then specify a suitable IP discovery range in Insight Manager, and define an SNMP community for your agents to use which is specified on the IM server, everything should talk quite happily.

[David Claypool · Accepted solution]

Celx -

Find the information you need in the 'Security Architecture' whitepaper on page 10 of the doc at ftp://ftp.compaq.com/pub/products/servers/management/cim7/cim7-security.pdf

Chris -

The question is not related to the agents; it is about what privileges the IM7 service needs to have and what account to associate it with.

[Celx]

Cheers Chris / David

One of our decentralised IT bod is running IM7 and is using a domain wide IM user account with Domain Admins privileges and is looking for similar accounts in other domains they manage.
This sounds unnecessary as I've read that it used SNMP community strings / traps to monitor / communicate between agent and console any problems discovered. At a push, perhaps Server Operators would suffice?
Thanks for the PDF url, documentation is precious.

Thanks again.

[Jon Ward]

The account used has to have local administrator user group or equivalent permissions. Furthermore, if using Windows Authentication for the SQL/MSDE database, the user will have to match.

[Celx]

Thanks to everyone who replied.

Cheers!