Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I'm developing a big project to monitor a remote machine's performance parameters like CPU, memory, disk space, and etc. through C# WMI. I want to use the minimum possible credentials to connect the remote machines since I don't want to bother my client to ask for the superuser credentials. While it is true that if I disabled the firewall, and used an account with Administrator privileges, WMI would work fine. However, this would greatly increase my threat profile.

So, my main question is what is the minimum system vulnerabilities that we can expose for the remote machine for such monitoring?

share|improve this question
I cleaned up some of the language so that it hopefully reads better. Your question is still a little unclear to me though. Are you looking for the set of rights a user account must have in order to query the parameters you describe, the firewall ruleset necessary to poll, both, or something else entirely? – Scott Pack Sep 24 '11 at 3:57

1 Answer

up vote 2 down vote accepted

WMI sits on top of DCOM which sits on top of RPC. So you'll have to expose the Windows RPC ports, which is a non-starter if you're trying to monitor servers across the Internet -- nobody should expose those.

But assuming you're monitoring across a LAN, then you'll need whatever DCOM rights are necessary on that machine, and then enable WMI for remote queries (which I think can be any account). As far as I know though, remote WMI queries are disabled by default, so your users will have to get their hands dirty. There is a little FAQ about that here: http://www.poweradmin.com/help/enableWMI.aspx

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.