Requirements for Remote WMI Access

Purpose This article documents supported and recommended Windows credential permissions for monitoring Windows Servers with WhatsUp Gold using WMI-based Active, Performance, and Passive (Event Log) monitors. The goal is to enable least‑privilege monitoring where possible, while clearly stating when local administrator rights are still required.

Jun 18, 2021
Knowledge

Title

URL Name

Requirements-for-Remote-WMI-Access

Article Number

000189825

Environment

Product: WhatsUp Gold Version: All supported versions OS: Windows Server

Question/Problem Description

View the Solution section of this article for information on the requirements for remote WMI access.

What rights are needed for Windows credentials?

Rights for windows service account?

Looking for the documentation for setting up the least permission possible monitoring for Windows Servers since Microsoft deprecated SNMP?

We are using an account in the Domain BUILTIN\Administrator group in order to monitor services on our Domain Controllers, what are the minimal permissions to get access and best practices.

Steps to Reproduce

Clarifying Information

Important scope note

Windows Management Instrumentation (WMI), DCOM, and Windows security hardening are Microsoft-owned technologies. Progress Technical Support validates WhatsUp Gold behavior with supported configurations, but cannot guarantee or maintain exhaustive Microsoft security guidance. For the most current hardening and delegation guidance, always defer to Microsoft documentation.

Background

Microsoft has deprecated SNMP for many Windows monitoring use cases. As a result, WhatsUp Gold relies primarily on WMI + RPC/DCOM for Windows service status, performance counters, and event log collection. By default, these operations require elevated privileges on the target system.

Many customers—especially those monitoring Domain Controllers—want to avoid using BUILTIN\\Administrator or full Domain Admin credentials. This article explains what is required, what can be delegated, and where hard limits exist.

Credential Options (Supported)

Depending on the target system and environment, provide one of the following credentials in the WhatsUp Gold Credentials Library:

Domain‑Joined Systems

Domain account
Either:
- Member of the local Administrators group on the target system (fully supported), or
- A non‑administrator domain account with explicitly delegated WMI, DCOM, and Service Control permissions (see Least‑Privilege Configuration below)

Workgroup Systems

Local user account on the target system
Must be a local Administrator unless remote UAC filtering is disabled

Error Message

Defect Number

Enhancement Number

Cause

Resolution

What Requires Administrator Rights

The following monitoring functions require administrative access and cannot be fully delegated using standard Windows security controls:

Windows Service status and control (Win32_Service)
Some event log channels (Security, Service Control Manager)
Certain WMI providers used by legacy NT Service monitors

If these monitors are required, Progress recommends:

A dedicated monitoring service account
Scoped to local Administrators only (not Domain Admin)
Explicitly documented and approved by security teams

Least‑Privilege Configuration (When Non‑Admin Is Required)

A non‑administrator account can be used for many WMI‑based performance and inventory monitors if all required permissions are delegated explicitly.

Open Component Services

Log on to the target Windows system.
Open Component Services by running dcomcnfg.
Navigate to:
Component Services → Computers → My Computer
Right‑click My Computer, select Properties, then open the COM Security tab.

Edit DCOM Security on the target system and grant the monitoring account:

Default Permissions
- These permissions allow the monitoring account to initiate a DCOM session.
  1. Under Launch and Activation Permissions, select Edit Default.
  2. If the monitoring account is not listed, add it.
  3. Grant the following permissions:
    - Local Launch
    - Remote Launch
  These permissions are required for WMI‑based monitoring initiated from the WhatsUp Gold server.

Limits Permissions
- These settings define the maximum (ceiling) permissions allowed by DCOM.
  1. Still on the COM Security tab, under Launch and Activation Permissions, select Edit Limits.
  2. Ensure the monitoring account is listed.
  3. Grant the following permissions:
    - Local Activation
    - Remote Activation
  Limits permissions override Default permissions. Even if the account is correctly configured under Edit Default, missing permissions here will prevent successful WMI access.

These permissions allow WhatsUp Gold to establish the initial RPC/DCOM session used by WMI.

WMI Namespace Permissions (Required)

Grant permissions on the following namespace:

root\\CIMV2

Steps:

Log on to the target system using an administrator account
Open Computer Management → Services and Applications → WMI Control
Right‑click WMI Control → Properties → Security tab
Expand Root → select CIMV2 → click Security
Add the monitoring account and grant:
- Enable Account
- Remote Enable
Click Advanced → apply to This namespace and subnamespaces
Restart the Windows Management Instrumentation service

Windows Firewall (Required)

Ensure WMI traffic is allowed through the Windows Firewall:

Enable the built‑in rule:
- Windows Management Instrumentation (WMI)
Required ports include:
- TCP 135 (RPC Endpoint Mapper)
- Dynamic RPC ports (default modern range: 49152–65535)

User Account Control (Workgroup Only)

When monitoring workgroup systems, remote UAC filtering blocks non‑admin credentials by default.

To disable remote UAC filtering (workgroup only):

⚠️ Security warning: This change is not recommended for domain systems and should be approved by security teams.

Registry path:

HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System

DWORD value:
- LocalAccountTokenFilterPolicy = 1

A reboot is required.

Domain Controllers – Best Practice Guidance

For Domain Controllers, Progress recommends:

Use a dedicated domain service account
Avoid using BUILTIN\\Administrator or Domain Admins
Document the business justification for elevated rights

Where security policy prohibits administrator access, limit monitoring to:

WMI Performance counters
Availability and basic inventory

Service‑level monitoring may not be possible without elevated privileges.

Summary

Area	Requirement
WMI Performance Monitoring	Delegated permissions possible
Service Monitoring	Requires admin or SCM modification
Event Log Monitoring	Often requires admin
Domain Controllers	Dedicated service account recommended
Least‑Privilege	Supported with explicit delegation

Disclaimer

This article reflects validated configurations for WhatsUp Gold. Microsoft may change WMI, DCOM, RPC, or Windows security behavior without notice. For authoritative hardening and delegation guidance, consult Microsoft documentation.

Workaround

Notes

Keyword Phrase

Last Modified Date

8/12/2026 3:47 PM