WBEM user privs.

[Lars Nielsen_4]

Dear fellows,
regarding SIM 4.10 on Microsoft OS:

Since the Windows WBEM user should contain Domain/Username, is it adviseable to use an AD user, and in this case what would the permission be. I am not very keen on administrative rights on a user with static password.
What is best practise?
Where to create this user?

Yours faithfully.

[Brian Harrison · Accepted solution]

Lars,

Using a domain/AD user will simplify your environment, as a single account can then be used for each managed system. Unfortunately by default the only users that have remote access to WMI are domain admin users, so that is the easiest account to use.

Note that the password for this user does not have to be static; however you will need to update the password stored by SIM when the password is changed.

You can use a different user if you do not wish to have such a powerful account used by SIM. This will require a change on each managed system. You can either add the domain account to the 'administrators' group on the managed system, or modify the WMI settings if you don't want to do this. To modify the settings:
- Bring up the 'Computer Management' console, expand 'services' and select 'WMI Control'
- Right-click on WMI Control and select 'Properties'
- Click the 'security' tab
- Select the 'root' namespace and click 'Security'
- Add the new user with appropriate access rights - at least 'Enable Account' and 'Remote Enable'

Cheers,
Brian.