Setup non-admin user to query Domain Controller event log for Windows2003 INTRODUCTION In Userfw AD integration solution, SRX queries the Domain Controller event log to get the user-to-ip mapping. The easiest way would be to configure the SRX to query the Domain Controller, is using a user who is part of the Domain Administrator group. This is restrictive and potentially risky to administrators and we need to provide a way for the firewall to query the Domain Controller via a user with nonadmin privileges. SRX uses Windows Management Instrumentation (WMI) to query Active Directory Domain Controllers for the Security Event logs. To handle the remote call to DC, we also use Distributed COM (DCOM) technology. To allow SRX to use a non-admin account for DC connectivity,it should have event log reading permission. For a non-admin user, it should have the following permissions to query DC DCOM Permission WMI Permission Event log reading permission To minimize the permission of this non-admin user the following permission will be denied: Interactive Logon Note: Using this non-admin user account to access the domain devices for other purpose may fail due to the permission restriction. To allow PC-Probe feature, please use an account in domain administrators group, as Windows requires the administrator privileges to return the logged on users info in a Windows client PC. Juniper Networks, Inc. 1
INSTRUCTIONS Step 1: Create a domain user Open up Active Direcotry Users and Computers Start à Administrative Tools à Active Directory Users and Computers Add new user Right Click Usersà New àuser Fill in required fields to Create user Step2: Grant user DCOM permission Start à Run, or in command line console, input dcomcnfg Juniper Networks, Inc. 2
Click on to Console Root à Component Services à Computers, right-click My Computer à select Properties. Then a new window opens. Then click on the COM Security tab. In the Launch and Activation Permissions area click Edit Limits button. In the new window, Click ADD. Enter in the User name created in Step 1 in to the lower box and click on Check Names. Click OK. Juniper Networks, Inc. 3
Grant the user the Remote Activation permission by clicking on user and then selecting the check box. Remove Local Launch permission by clicking on checkmark to remove. Then click OK to exit. Click OK and close out of Component Services window. Juniper Networks, Inc. 4
Step 3: Grant user WMI permission Open Windows Management Instrumentation (WMI) console: Start à Run, or in command line console, input wmimgmt.msc Right-click WMI Control and select Properties. Select the Security tab and expand "Root". Select CIMV2 and click Security. Juniper Networks, Inc. 5
Click ADD. Enter in the User name created in Step 1 in to the lower box and click on Check Names. Click OK. Grant the user Remote Enable permissions by clicking on user and then selecting the check box. Remove Enable Account permission by clicking on Check Mark box. Then click OK to exit. Juniper Networks, Inc. 6
Click OK to WMI Properties screen and close wmimgmt window. Step 4: Grant the user Event Log access permissions Open up Groups Policy Management Start à All Programs à Administrative Tools à Domain Controller Security Policy Juniper Networks, Inc. 7
Expand the Local Policies tree to locate User Rights Assignments and double click On right side of window locate Manage auditing and security log and double click In the new window click the Add User or Group button and select Browse. Juniper Networks, Inc. 8
Enter in the User name created in Step 1 in to the lower box and click on Check Names. Click OK. Click OK twice Step 5: Deny Interactive Logon ability for the user Open up Default Domain Controller Security Settings window, if closed from previous step 4. Start à All Programs à Administrative Tools à Domain Controller Security Policy Expand the Local Policies tree to locate User Rights Assignments and double click Juniper Networks, Inc. 9
In the right part of the Default Domain Controller Security Settings window, locate and double-click Deny log on locally. In the new window click the Add User or Group button and select Browse. Juniper Networks, Inc. 10
Enter in the User name created in Step 1 in to the lower box and click on Check Names. Click OK. Click OK twice In the right part of the Group Policy Management Editor window, locate and doubleclick Deny log on through Terminal Services. Repeat steps to add User name created in Step 1 to list and click OK twice. Close Default Domain Controller Security Settings window Step 5: Restart WMI Service Open Windows Management Instrumentation (WMI) console: Start à Run, or in command line console, input services.msc Locate the Windows Management Instrumentation service and restart it by right clicking the service and clicking on the Restart option. Juniper Networks, Inc. 11
Step6: Configure the non-domain user in SRX #set services user-identification active-directory-access domain SRXTEST03 user <user from step 1> (in this example non_admin ) #set services user-identification active-directory-access domain SRXTEST03 user password <password entered as part of step 1> Juniper Networks, Inc. 12