www.gsx.com | log in | register

  1. GSX Help Center
  2. Knowledge Base
  3. GSX Gizmo

Last update: . Author: Cyril LEROY .

How to Configure Windows Remote PowerShell Access for Non-Privileged User Accounts

This article lists the necessary steps required to configure Windows servers to allow remote PowerShell access for a non privileged user account. This is particularly useful when configuring GSX Monitor with an account that is not member of the Local Administrators group as the security settings need to be updated for Windows default PowerShell Endpoint, WMI default namespace and Windows Service Configuration Manager.

Remote PowerShell | Windows Server 2003 R2 to 2012 R2 | GSX Monitor 10.7.0 and above...

Instructions

We will go through four procedures:

1 - Allowing the user to access the remote PowerShell Windows Endpoint.
2 - Granting access to WMI Counters.
3 - Allowing Windows Service Configuration Manager Access.
4 - Finally, validating the remote PowerShell connectivity.

  • Since the introduction of version 10.7.0, GSX Monitor uses PowerShell to collect Windows related statistics like performance counters, Windows Services status and disk space for increased stability and reliability.
  • In this article, we concentrate exclusively on adjusting user rights settings.
  • You will still need to comply with the monitored platform standard prerequisites listed in our online help.
  • The changes listed in this article have to be applied on all monitored servers.
  • As a workaround, you can use a Local Administrator account, especially from a “proof of concept” perspective or for testing.

1 - Allowing remote PowerShell Windows Endpoint access

  1. Open a PowerShell session as Administrator.
  2. Execute the following command to open the PowerShell Endpoint security windows:  
    • Set-PSSessionConfiguration -Name Microsoft.PowerShell -ShowSecurityDescriptorUI -Force 
  3. Click Add.
  4. Select the desired user to include to the list.
  5. Enable Read and Execute permissions.
  6. Click OK to apply your change.

See http://blogs.msdn.com/b/powershell/archive/2009/11/23/you-don-t-have-to-be-an-administrator-to-run-remote-powershell-commands.aspx for details.

2 - Allowing WMI counters access

We need to allow the user to access to the WMI counters. First we will be adding the user account to the local group named Performance Log Users:

  1. Open the Computer Management console (compmgmt.msc).
  2. Go to Local Users and Groups.
  3. Expand Groups.
  4. Locate Performance Log Users group:
  5. Double-click on the group name to add the desired user to the Members list.
  6. Click OK to save the configuration.

Then we also need to adjust WMI Control settings to allow the user to have access. 

  1. From the Computer Management console, expand Service and Applications.
  2. Right-click on WMI Control and then click Properties to access to WMI configuration.
  3. Open the Security tab.
  4. Select the \Root\CIMV2 namespace:
  5. Click on Security to choose which user or group will be granted access.
  6. In the Security dialog box, click Add.
  7. In the Select Users, Computers, or Groups dialog box, enter the name of the object (user or group) you want to add.
  8. Click OK.
  9. Click Advanced to open the Advanced Security Settings dialog box:
  10. On the Permissions tab, select the desired user in Permissions entries.
  11. Click Edit:
  12. Set Type to Allow, set Applies to to This namespace and subnamespaces, and select the Execute Methods, Enable Account and Remote Enable options:
  13. Click OK to close all windows and apply the changed settings.

See http://technet.microsoft.com/en-us/library/cc771551.aspx for more details.

3 - Allowing Windows Service Configuration Manager Access

We need to grant the user Windows Service Configuration Manager Access.

Run a Command Prompt as Administrator, andexecute the following command: 

sc sdset SCMANAGER D:(A;;CCLCRPRC;;;AU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

See http://support.microsoft.com/kb/907460/en-us for more details.

4 - Validating remote PowerShell connectivity

To validate remote PowerShell connectivity from the system that is running GSX Monitor, open a PowerShell console and enter the following commands:

  • $s = New-PSSession -ConfigurationName Microsoft.PowerShell -ConnectionUri http://YourServerName:5985/wsman -Credential Get-Credential -Authentication kerberos
  • Enter-PSSession $s
  • Get-Counter –listSet *
  • Get-WmiObject -Query "SELECT Name, Description, State, AcceptStop, AcceptPause FROM Win32_Service"

 You should obtain the list of Windows Performance Counters and Services:


Was this article helpful?

38 out of 55 found this helpful




Not finding what you are looking for?

Have more questions? Submit a request