Network Security Read Domain Security Logs Contents Overview... 1 System or Network Requirements... 1 Deployment Considerations... 1 Configuring Non-Administrator Accounts for WMI Remote Access... 2 Glossary of Terms... 11 Overview The SonicWALL Directory Services Connector and the Single Sign-On Agent are used to identify users who are logged in to the Windows domain. In previous releases, the SSO Agent could be configured to use either WMI or NetAPI to communicate with user workstations for user identification, by using the Domain administrator account. In SonicWALL Directory Services Connector 3.4.55, a new Query Source option to use the Domain Controller Security Log is available, which does not require use of the Domain administrator account. This option still requires read access to the security log, but this can be accomplished for a non-admin account by using the method described in this technote. System or Network Requirements The following is a list of system or network requirements: Microsoft Windows Server 2003 or 2008 Deployment Considerations Consider the following when configuring non-administrator accounts for WMI remote access: Try the following configuration scenarios first, before configuring a non-administrator account for WMI remote access: o o If you are using a Single Sign-On (SSO) solution with the Query Source as a Domain Controller Security Log, you need to configure the Domain Admin or equivalent account with SSO. If the Domain Admin account is not available, configure a Domain User that has local admin privileges on the configured Domain Controller machine. A normal account can be used for WMI remote access and restricted with no login access, but needs certain read only rights to access the WMI repository remotely. The Distributed Component Object Model (DCOM) is used to execute the WMI queries. The Performance Monitor Users group has permissions for monitoring the Windows Security Event Logs on the Domain Controller (DC).
Configuring Non-Administrator Accounts for WMI Remote Access The best configuration procedure is to create/allow a user, and then add the user to the DCOM Users and Performance Monitor Users groups. The DCOM Users group already has remote access rights to the DCOM and the Performance Monitor Users group already has rights to read the performance counts. To configure nonadministrator accounts for WMI remote access, perform the steps in the following sections: Configuring the Domain Controller... 2 Configuring Windows Firewall... 7 Configuring the DCOM Access... 8 Updating Registry Settings for Windows 2003 and 2008... 10 Configuring the Domain Controller Perform the following steps on the Domain Controller: Note: This configuration example uses TestDomainUser as the username. 1. Create a normal (non-administrative) user. 2
2. Add the user to the Performance Monitor Users and DCOM Users groups. 3. Open the wmimgmt.msc window. 4. Select WMI Control (Local) from the left panel. 5. Select the Properties. 3
6. In the Properties window, select the Security tab. 7. Select the Root file, then click the Security button. 8. In the Enter the Object Names panel, enter the Performance Monitor Users group. 4
9. In the Security for Root window, enable the Executive Methods, Enable Account, and Remote Enable checkboxes. 10. Click the Advanced button. 11. Select the Performance Monitor Users group, then click the Edit button. 5
12. In the Apply Onto: field, click the drop-down list and select This namespace and subnamespaces. This allows read-only access to the whole WMI tree. 6
Configuring the Windows Firewall If the firewall blocks the remote WMI access, perform the following configuration steps on the Windows Firewall: 1. Navigate to the Windows Control Panel. 2. Click the Windows Firewall link. 3. In the left panel, select the Allow a program or feature through Windows Firewall option. 4. Navigate to Component Services > Computers > My Computer, then select Properties. 5. Select the Windows Management Instrumentation checkbox, then select the Domain and Home/Work (Private) checkboxes. 7
Configuring the DCOM Access If the predefined DCOM Users group is not used, perform the following configuration steps for DCOM access: 1. Start the dcomcnfg.exe. 2. Open Component Services > Computers > My Computer. 3. Select the Properties. 4. Click the COM Security tab. 5. In the Launch and Activate Permissions panel, click the Edit Limits button. 8
6. In the Group or User Names panel select Distributed COM Users. 7. In the Permissions for Distributed COM Users panel, select all the Allow checkboxes. 9
Updating Registry Settings for Windows 2003 and 2008 To read the Security Event Log you need to update the registry settings for Windows. Perform the following configuration steps to update your registry settings: Caution: Be very careful when changing the registry settings on your Domain Controller. Be sure to make a backup copy of the registry before making any changes. Windows 2003 1. Locate the Security Event Log Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security 2. Locate the original value of the CustomSD: O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0005;;;SY)(A;;0x5;;;BA) 3. Insert the new value into the CustomSD: O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;AU) Windows 2008 1. Configure WMI remote access (if not already completed in the previous sections). 2. Add the Event Log Readers group to the user account. 3. Add the TestDomainUser to the Event Log Readers group. 10
Glossary of Terms DCOM Distributed Component Object Model DC Domain Controller SSO Single Sign-On WMI Windows Management Instrumentation Last updated: 1/20/2012 11