0

I work in an active directory environment with many servers. I have a user account that I would like to use to check the status of other servers, without giving this account full administrative access to these other servers. Specifically, I want to check the drive space on these servers, and I'd like to do it with Powershell.

I have executed Enable-PSRemoting on the target server, and I can successfully invoke Get-PSDrive on them remotely using administrator credentials. The results are returned almost immediately, and include information about the used / free space on all drives.

However, when I run the same command (Invoke-Command -computer remoteserver1 {Get-PSDrive -PSProvider FileSystem}) as the non-administrative user, the results come back very slowly (takes about 30 seconds), and none of the drives have any information about their used / free space.

What I have done so far:

  • I have added the non-administrative user account to the Remote Management Users group on the target server.
  • Edited SDDL for scmanager (on the target server) to add the same DiscretionaryACL for Remote Management Users as Built-in Administrators have.
  • Per this post, I have granted this user WMI permissions in wmimgmt.exe > WIM Control (Local) > (right click) > Properties > Security tab > Expand 'Root' > click on SECURITY node > click 'Security' button > added non-admin user with full access.
  • Added user to the Distributed COM Users group on the target server.

Some also suggested trying Invoke-Command -computer remoteserver1 {Get-WmiObject -Class Win32_MappedLogicalDisk} to troubleshoot, but it comes back 'Access is denied.' I believe if I could get Get-WmiObject working successfully for this limited user, it would solve my issue.

What should I do to get this limited user account the access they need to check drive space on other servers? without giving the account admin rights, and preferably without having to map and unmap any drives?

Improve this question
6
  • What version(s) of Windows Server are you attempting to connect to, and what version of PowerShell are you running on those servers? Commented Sep 17, 2018 at 22:18
  • Windows Server 2016, with PowerShell version 5 Commented Sep 17, 2018 at 22:33
  • 1
    Have you looked at using JEA? This might give you the tools you need to allow someone a constrained session that can only get the specific data you want. - docs.microsoft.com/en-us/powershell/jea/overview Commented Sep 17, 2018 at 22:50
  • "Due to User Account Control, the account on the remote system must be a domain account in the Administrators group. For more information, see User Account Control and WMI." Source: docs.microsoft.com/en-us/windows/desktop/wmisdk/… Commented Sep 17, 2018 at 22:54
  • From an older link: "From reports we're receiving from the field, it appears UAC needs to be disabled for remote [non-admin] WMI queries to work." Source: poweradmin.com/help/faqs/how-to-enable-wmi-for-remote-access Commented Sep 17, 2018 at 23:11

2 Answers 2

Reset to default
2

Very much appreciate the noted answer, but I wanted a little more consistency in my implementation and I finally stumbled across the older PowerShell DSC resource below, but I'm also adding what's necessary for the group membership. On WinSrv2019, I noticed PS remoting/Dcom access were set proper by default, so just this was needed.

*Updated this to specify inheritance through the "Children" parm. Unfortunately if you use this DSC resource, you have to remove the previous rule and recreate entirely for the "appliesto" setting to work.

  1. Install DSC Resources
Install-Module -Name WmiNamespaceSecurity Install-Module -Name ComputerManagementDsc
  1. Import the reference in your DSC's code.
Import-DscResource -ModuleName WmiNamespaceSecurity Import-DscResource -ModuleName ComputerManagementDsc -ModuleVersion 9.0.0
  1. Configure with the recommended configuration from Baodad.
WmiNamespaceSecurity AddDcom { Path = 'root' Principal = "Builtin\Distributed COM Users" AppliesTo = 'Children' AccessType = 'Allow' Permission = 'Enable', 'MethodExecute', 'RemoteAccess' Ensure = 'Present' } Group "Distributed COM Users" { GroupName = "Distributed COM Users" Ensure = "Present" MembersToInclude = "Group_Or_User" } Group "Remote Management Users" { GroupName = "Remote Management Users" Ensure = "Present" MembersToInclude = "Group_Or_User" }
Improve this answer
0
0

To allow a non-administrative account to execute the necessary Powershell commands to return information about drive space on a remote server, complete the following steps (as a server/domain admin) on the target server.

  1. Enable-PSRemoting - Google this if you need further explanation.

  2. Click Start > Run..., type lusrmgr.msc and click OK

  3. Click on the Groups folder.

  4. Double-click on Remote Management Users group, and add the non-admin user account. Click OK.

  5. Double-click on Distributed COM Users group, and add the non-admin user account. Click OK.

Configure DCOM security settings

  1. Click Start > Run..., type dcomcnfg and click OK

  2. Drill down into the "Component Services" tree until you get to "My Computer". Right-click "My Computer" to bring up the menu, and click Properties.

  3. Click the COM Security tab.

  4. Click Edit Limits in the "Access Permissions" section. Make sure "Distributed COM Users" group has boxes checked for both Local Access and Remote Access. Click OK.

  5. Click Edit Limits in the "Launch and Activation Permissions" section. Make sure all four 'Allow' boxes are checked for "Distributed COM Users" group. Click OK.

Configure WMI Control security settings.

  1. Click Start > Run..., type wmimgmt.msc and click OK.

  2. Right-click WMI Control (Local) to bring up the menu, and click Properties.

  3. Click on the Security tab, then click Root, and click the Security button at the bottom of the dialog.

  4. Click Add... and add the local Distributed COM Users group.

  5. Click Advanced.

  6. Highlight the row with Distributed COM Users in it and click 'Edit' button.

  7. From the "Applies to" drop-down list, select "This namespace and subnamespaces"

  8. Under the Allow column check "Execute Methods", "Enable Account", and "Remote Enable"

  9. Click OK to exit out of dialog windows.

(26.) Restart the WinRM (Windows Remote Management) service

Please comment below if you have any feedback about security concerns, or how to improve least privilege access.

Hat tip to this link for guidance: https://helpdesk.kaseya.com/hc/en-gb/articles/229043428-Configuring-a-regular-non-admin-user-account-for-WMI-monitoring

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.