WMI Permissions and Security

When monitoring CPU information on a Windows based machine with AppDynamics for Databases, either the OS collector part of the database collector, or the Server collector, Windows Management Instrumentation (WMI) is used to remotely gather the metrics. WMI is often frustrating to troubleshoot. This article explains some potential problems and pitfalls.

Minimum Security Requirements When Using WMI

WMI makes use of RPC. RPC listens on a well-known port (135) but then allocates a dynamic port for subsequent communication. Therefore, you need to configure your firewall to allow 135 (always) and follow the dynamic RPC ports. It can be done - you do not need to restrict the port range, and there are several articles already on the internet that explain this, just ask Google!

To delegate permissions for WMI Control, run wmimgmt.msc. If you don't have a shortcut to the program, then simple click the Start Menu, and then search for the executable.

Now step through the following instructions to confirm you will have the correct permissions:

1. Right click the WMI Control icon on the left and click Properties.
2. Click the Security tab.
3. Click the Root node of the tree, and click Properties.
4. For the named user account you would like to run AppDynamics for Databases as you will need to ensure that it has the relevant permissions. The minimum permissions that your remote Windows account needs for AppDynamics for Databases are:

• Execute Methods
• Enable Account
• Remote Enable

If you miss any one of the three then you end up with one of:

Error=800706BA The RPC server is unavailable.  SWbemLocator

or

Error=80070005 Access is denied.  SWbemLocator

Preventing Unauthorized Remote Access to WMI

For Windows 2003 R2 SP2

You can also setup extra security in the WIndows Distributed Component Object Model (DCOM) to prevent unauthorized users from accessing WMI remotely. The following prevents users other than those configured as follows from remotely accessing the WMI. You can configure the named user account under which you would like to run AppDynamics for Databases as follows:

1. Add the user to the Performance Monitor Users group
2. In Services and Applications, bring up the properties dialog of WMI Control. On the Security tab, highlight Root/CIMV2, click Security->add Performance Monitor Users and enable the options: Enable Account and Remote Enable.
3. Run dcomcnfg. Click Component Services->Computers->My Computer->Properties->COM Security, and then click Edit Limits for both Access Permissions and Launch and Activation Permissions. Add Performance Monitor Users and allow remote access, remote launch, and remote activation permissions.
4. In Component Services->Computers->My Computer->DCOM Config->Windows Management Instrumentation, give Remote Launch and Remote Activation privileges to the Performance Users Group.