Configuração de USER exclusivo para monitorização PRTG

Data: 14/11/2025

Versão:1.1

Autor: Pedro Delgado

Revisão: Diogo Goulão


Configuração de USER exclusivo para monitorização PRTG

O procedimento seguinte indica como configurar um user exclusivo para monitorização PRTG sem ser Domain admin.

  • Criação de um domain user ou local user dedicado para WMI, para uso exclusivo do PRTG por exemplo Domain Users em Vm´s de domínio e local users apenas em Vm´s sem domínio.
  • Adicionar o user aow grupos :
    • Performance Log Users
    • Distributed COM Users
    • Event Log Readers
    • Nota: Para monitorização dos Dc´s o user também vai necessitar destas permissões.
  • Criação de GPO ( no vcaso de Vm´s de domínio) ou política local par as vm´s fora do domínio, para configuração as permissões DCOM.
  • A política tem como objetivo configurar as permissões DCOM e WMI.

No procedimento indicado, o user tem a designação wmiuser apenas para fins de documentação .

Configuração de Política GPO DCOM:

  • Go to: Computer Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options
  • Select Properties at: DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax
  • Check the Define this policy setting
  • Select Edit Security …
  • Click Add …
  • Under Enter the object names to select: Enter wmiuser and click Check Names. The user is now filled in automatically
  • Click OK
  • Select wmiuser (wmiuser@exampledomain.local)
  • Under Permissions: Tick Allow on both Local Access and Remote
  • Access Click OK
  • Select "Certificate Service DCOM Access@exampledomain.local"
  • Under Permissions: Tick Allow on both Local Access and Remote
  • Click OK
  • Select Properties under: DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax
  • Check Define this policy setting
  • Select Edit Security …
  • Click Add …
  • Under Enter the object names to select: Enter wmiuser and click Check Names. The user is now filled in automatically
  • Click OK
  • Select wmiuser (wmiuser@exampledomain.local)
  • Under Permissions: Tick Allow at Local Launch, Remote Launch, Local Activation and Remote Activation
  • Click OK
  • Select "Certificate Service DCOM Access@exampledomain.local"
  • Under Permissions: Tick Allow on both Local Access and Remote
  • Click OK

WMI:

Note: These settings can not be done with a regular GPO.

  • Write wmimgmt.msc in command prompt
  • Right-click WMI Control, and select Properties
  • Select the Security tab
  • Select Root of the tree and click on Security
  • Click Add …
  • Under Enter the object names to select: Enter wmiuser and click Check Names. The user is now filled in automatically
  • Click OK
  • Select wmiuser (wmiuser@exampledomain.local)
  • Select Allow for Execute Methods, Enable Account, Remote Enable and Read Security under Permissions for wmiuser
  • Mark wmiuser and click Advanced Under the Permission tab: Select wmiuser
  • Click Edit Under Applies To-list: Choose This namespace and all subnamespaces.

It is very important that the rights are applied recursively down the entire tree!

  • Click OK
  • Click OK
  • Click OK
  • Click OK

Não tenho informação se na última versão ( AD 2016) se já existem policies nativas de configuração WMI.

No entanto deixo 2 exemplos via script Bach e outra via powersheell.

Em ambos os casos devem ser ajustados á vossa realidade.

Exemplo 1:

https://learn.microsoft.com/pt-pt/archive/blogs/spatdsg/set-wmi-namespace-security-via-gpo-script

Exemplo 2:

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/delegate-wmi-access-to-domain-controllers/ba-p/259535


Exemplo de um script para configuração do user PRTG aos eventlogs de um servidor

########EVENT VIEWER##############

#Powershell script acesso Security Event Viewer

$acl = Get-Acl 'HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security'

$idRef = "wmiuser@exampledomain.local"

$regRights = "ReadKey"

$inhFlags = "ContainerInherit"

$prFlags = "None"

$acType = "Allow"

$rule = New-Object System.Security.AccessControl.RegistryAccessRule ($idRef, $regRights, $inhFlags, $prFlags, $acType)

$acl.AddAccessRule($rule)

$acl | Set-Acl -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security'



Exemplo de um script para configuração do user PRTG a serviços de um servidor.


######SERVICES###########

#Acesso remoto para controlar serviços - Necessário reiniciar servidor

reg add HKLM\SYSTEM\CurrentControlSet\Control /v RemoteAccessExemption /t REG_DWORD /d 1 /f

#Powershell script acesso listagem de serviços

$sid = [Security.Principal.NTAccount]::new('wmiuser@exampledomain.local').Translate(

[Security.Principal.SecurityIdentifier])

$sddl = ((sc.exe sdshow scmanager) -join "").Trim()

$sd = ConvertFrom-SddlString -Sddl $sddl

$sd.RawDescriptor.DiscretionaryAcl.AddAccess(

[Security.AccessControl.AccessControlType]::Allow,

$sid,

0x00020015, # SC_MANAGER_CONNECT | GENERIC_READ

[Security.AccessControl.InheritanceFlags]::None,

[Security.AccessControl.PropagationFlags]::None

)

$newSddl = $sd.RawDescriptor.GetSDDLForm('All')

Write-Host "Changing SDDL From:`n$sddl`nTo:`n$newSddl"

sc.exe sdset scmanager $newSddl

#Powershell script para ter controlo sobre o serviço IIS

$sid = [Security.Principal.NTAccount]::new('wmiuser@exampledomain.local').Translate(

[Security.Principal.SecurityIdentifier])

$sddl = ((sc.exe sdshow W3SVC) -join "").Trim()

$sd = ConvertFrom-SddlString -Sddl $sddl

$sd.RawDescriptor.DiscretionaryAcl.AddAccess(

[Security.AccessControl.AccessControlType]::Allow,

$sid,

0xF01FF, #SERVICE_ALL_ACCESS

[Security.AccessControl.InheritanceFlags]::None,

[Security.AccessControl.PropagationFlags]::None

)

$newSddl = $sd.RawDescriptor.GetSDDLForm('All')

Write-Host "Changing SDDL From:`n$sddl`nTo:`n$newSddl"

sc.exe sdset W3SVC $newSddl

#Powershell script para ter controlo sobre o serviço ProxyBiometric

$sid = [Security.Principal.NTAccount]::new('wmiuser@exampledomain.local').Translate(

[Security.Principal.SecurityIdentifier])

$sddl = ((sc.exe sdshow ProxyBiometric) -join "").Trim()

$sd = ConvertFrom-SddlString -Sddl $sddl

$sd.RawDescriptor.DiscretionaryAcl.AddAccess(

[Security.AccessControl.AccessControlType]::Allow,

$sid,

0xF01FF, #SERVICE_ALL_ACCESS

[Security.AccessControl.InheritanceFlags]::None,

[Security.AccessControl.PropagationFlags]::None

)

$newSddl = $sd.RawDescriptor.GetSDDLForm('All')

Write-Host "Changing SDDL From:`n$sddl`nTo:`n$newSddl"

sc.exe sdset ProxyBiometric $newSddl

#Powershell script para ter controlo sobre o serviço ProxyVC

$sid = [Security.Principal.NTAccount]::new('wmiuser@exampledomain.local').Translate(

[Security.Principal.SecurityIdentifier])

$sddl = ((sc.exe sdshow ProxyVC) -join "").Trim()

$sd = ConvertFrom-SddlString -Sddl $sddl

$sd.RawDescriptor.DiscretionaryAcl.AddAccess(

[Security.AccessControl.AccessControlType]::Allow,

$sid,

0xF01FF, #SERVICE_ALL_ACCESS

[Security.AccessControl.InheritanceFlags]::None,

[Security.AccessControl.PropagationFlags]::None

)

$newSddl = $sd.RawDescriptor.GetSDDLForm('All')

Write-Host "Changing SDDL From:`n$sddl`nTo:`n$newSddl"

sc.exe sdset ProxyVC $newSddl


Exemplo de um script para configuração do user PRTG a instancias de SQL.


#Powershell script para verificar as instâncias SQL existentes e alterar permissões dos respetivos serviços

# Specify the Registry path where you want to retrieve all string values

$registryPath = "HKLM:\Software\Microsoft\Microsoft SQL Server\Instance Names\SQL"

# Use Get-ItemProperty to retrieve all properties

$registryProperties = Get-ItemProperty -Path $registryPath

# Filter and select only the string values and exclude PSChildName, PSParentPath, and PSPath

$registryStringValues = $registryProperties.PSObject.Properties | Where-Object { $_.Value -is [String] -and $_.Name -notin 'PSChildName', 'PSParentPath', 'PSPath' }

# Display the retrieved string values

foreach ($property in $registryStringValues) {

$valueName = $property.Name

$sid = [Security.Principal.NTAccount]::new('wmiuser@exampledomain.local').Translate(

[Security.Principal.SecurityIdentifier])

$sddl = ((sc.exe sdshow $valueName) -join "").Trim()

$sd = ConvertFrom-SddlString -Sddl $sddl

$sd.RawDescriptor.DiscretionaryAcl.AddAccess(

[Security.AccessControl.AccessControlType]::Allow,

$sid,

0xF01FF, #SERVICE_ALL_ACCESS

[Security.AccessControl.InheritanceFlags]::None,

[Security.AccessControl.PropagationFlags]::None

)

$newSddl = $sd.RawDescriptor.GetSDDLForm('All')

Write-Host "Changing SDDL From:`n$sddl`nTo:`n$newSddl"

sc.exe sdset $valueName $newSddl

}



Exemplo de configuração DCOM:

Copy96e47059d9f9.pngCopy84aa339b69b7.png



A Equipa Syscrum

Back to Home

Contact us

  • +351 214 913 229