Windows Hardware Monitoring - How do I configure a non-admin user account for WMI?

[Anka.Thanneeru]

An admin user can configure a regular Windows user to access Windows Management Instrumentation (WMI) information by adding the regular user account to the Distributed COM Users and the Performance Monitor Users group (using lusrmgr.msc), and then configure the DCOM security settings to allow the groups to access the system remotely (using dcomcnfg).

Steps for Windows 2003 R2 SP2 Server & Windows 2008 R2 Datacenter:

1. Click Start > Run..., type lusrmgr.msc and click OK.
2. In the Users folder, right click the user to bring up the menu, and select Properties.
3. Click on the Member Of tab, and click Add...
4. Under "Enter the object names to select", add the Distributed COM Users group, click Check Names, and then click OK.
5. Click Add...
6. Repeat step 4 for the Performance Monitor Users group. Next, configure the DCOM Security Settings to allow the groups to access the system remotely.
7. Click Start > Run..., type dcomcnfg and click OK.
8. Drill down into the Component Services tree until you get to My Computer. Right-click "My Computer" to bring up the menu, and click Properties.
9. Click the COM Security tab, then click Edit Limits under the Launch and Activation Permissions section.
10. Click Add...
11. Under Enter the object names to select, type Distributed COM Users, click Check Names, then click OK.
12. Click Add...
13. Under Enter the object names to select, type Performance Monitor Users, click Check Names, then click OK.
14. Check Allow for each of the permissions (Local Launch, Remote Launch, Local Activation, Remote Activation) for each of these groups, and click OK.
15. Finally, set the WMI Control security settings to be applied to all namespaces.
16. Click Start > Run..., type wmimgmt.msc and click OK
17. Right-click WMI Control (Local) to bring up the menu, and click Properties.
18. Click over to the Security tab, then click Root, and click the Security button.
19. Click Add...
20. Under Enter the object names to select, type Distributed COM Users, click Check Names, then click OK.
21. Click Advanced.
22. Highlight the row with Distributed COM Users in it and click Edit...
23. From the drop-down list, select "This namespace and sub namespaces"
24. Under the Allow column check Execute Methods, Enable Account, and Remote Enable.
25. Repeat steps 12-17 for the Performance Monitor Users group.
26. Click OK to close all windows.
    • NOTE: If you are using Windows Server 2003 SP1 or later, you will have to run the following steps to access the Win32_Service class due to a known issue (http://support.microsoft.com/kb/907460).
27. Click Start > Run..., type cmd and click OK.
28. Type the following command at the command prompt and then press Enter:
    

    sc sdset SCMANAGER
    D:(A;;CCLCRPRC;;;AU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

    
    You can now perform WMI monitoring on this Windows host with a regular user account instead of an admin account.

Alternatively, in simple words:

• Administrative Tools > Component Services > Computers > My Computer > Properties > COM Security
• Access Permissions > Edit Limits > add user + Local Access + Remote Access
• Launch and Activation Permissions > Edit Limits > add user + Local Access + Remote Access
• wmimgmt.msc
• On the Security tab, highlight Root/CIMV2, click Security > add user and enable the options: Execute Methods, Enable Account and Remote Enable.

The above permissions work for Windows 2012 as well.

Verify WMI connectivity:

Once the user is able to connect using the WMI test, the DB agent can connect and monitor the data.