PowerShell Datasource with NonAdmin Collector

It looks like something is attempting to use the Set-ExecutionPolicy command. Running that command requires running as Administrator and it looks like whatever is failing is not running as admin. You may need to determine what is attempting to run that.

If the DataSource itself has that command, you may need to remove it, if the DataSource is no longer running as administrator. You shouldn't need, nor want to, to run that command in a DataSource.

If it's the collector software attempting to use that command, that might be a bug in the collector or your not using a collector version that supports non-admin use. I would verify you have the latest collector version (perhaps even try the latest EA version).

They could be using different credentials. There are two ways LM can authenticate in Windows: 1) Integrated 2) discrete.

For integrated authentication, the collector uses the credentials used to run the service. If those creds (which can be explicitly defined as a username or could be system) don't have access to the target, it'll fail. 

For discrete auth, this uses wmi.user and wmi.pass properties defined on the resource in LM.

Most of the logicmodules built by LM automatically detect which auth method to use. Yours may not. So they could be using different creds.

Not running as admin on a Windows collector should be a careful decision for this very reason. In our case, unless we ran it as admin, we'd have to specify admin creds on every target server, which is just as much a security concern as running the service with the admin creds. Since they are equally as risky, but both the nature of monitoring in Windows, we choose to just run the service with domain admin creds. In actuality, we run most as system, but give that system admin access. This means there's no password to be hacked because it's not a user account but a computer object in the domain that is granted access.

I'm using wmi.user and wmi.pass properties, the properties are set on the server object and has the rights on the target server but is non admin on collector.

If I have not overlooked anything then there should be nothing in the powershell script that triggers Set-ExecutionPolicy.

I have also run the code once on the collector under the non admin service user and get no error. I have also tested signing. I can't explain what is causing this.

This is my test datasource (i need to change my return to int)

# Clears the CLI of any text
Clear-Host
# Clears memory of all previous variables
Remove-Variable * -ErrorAction SilentlyContinue
#------------------------------------------------------------------------------------------------------------
# Initialize Variables
$TargetHostName = '##SYSTEM.SYSNAME##' + '.' + '##SYSTEM.DOMAIN##'
$CollectorHostName = $env:computername
$TargetUserName = '##wmi.user##'
$TargetPassword = '##wmi.pass##'
$DebugMode = $false

$ScriptBlock = {
    param (
        [bool]$Debug
    )
    # Get pagefile information
    $pageFileInfo = Get-CimInstance -Class Win32_PageFileUsage | Select-Object *
    $CompSysResults = Get-CimInstance win32_computersystem -Namespace 'root\cimv2'

    # Initialize variables
    $pageFileDrive = ""
    $isOnC = $false
    $isAuto = $false
    $otherFilesExist = $false

    if ($pageFileInfo) {
        $pageFilePath = $pageFileInfo.Name
        $pageFileDrive = Split-Path -Path $pageFilePath -Qualifier

        # Check if pagefile is on C: drive
        $isOnC = $pageFileDrive -eq "C:"

        # Check if pagefile size is set to auto
        $isAuto = $CompSysResults.AutomaticManagedPagefile

        # Output results
        Write-Host "PageFileDrive=$pageFileDrive"
        Write-Host "IsOnCDrive=$isOnC"
        Write-Host "IsAutoManaged=$isAuto"

        # Check for other files/folders on pagefile drive
        if ($pageFileDrive -eq "D:") {
            $otherItems = Get-ChildItem -Path $pageFileDrive -Force | Where-Object { $_.FullName -ne $pageFilePath }
            $otherFilesExist = $otherItems.Count -gt 0
            Write-Host "OtherFilesExist=$otherFilesExist"
        }

    }
}


if ($TargetHostName -eq $CollectorHostName)
{
    Invoke-Command -ScriptBlock $ScriptBlock -ArgumentList @($DebugMode,$Instance)
}
else
{
    #If WMI creds undefined - invoke remote command without creds, if not - create credential object and use it for authorization
    if (($TargetUserName -Match "wmi.user" -and $TargetPassword -Match "wmi.pass") -or 
        ($TargetUserName -eq "" -and $TargetPassword -eq ""))
    {
        Invoke-Command -ComputerName $TargetHostName -ScriptBlock $ScriptBlock -ArgumentList @($DebugMode,$Instance)
    }
    else
    {
        $TargetCredentials = New-Object System.Management.Automation.PSCredential ($TargetUserName, $(ConvertTo-SecureString $TargetPassword -AsPlainText -Force))
        Invoke-Command -ComputerName $TargetHostName -ScriptBlock $ScriptBlock -Credential $TargetCredentials -ArgumentList @($DebugMode,$Instance)
    }
}

Exit 0

and this is code from Windows Certificate Datasource and its running without error. If i past the code into my newly created datasource i also get an error for ExecutionPolicy. So if there is not command inside that is triggering ExecutionPolicy this should be a bug?

$Instance = '##WILDVALUE##'
$TargetHostName = '##SYSTEM.SYSNAME##' + '.' + '##SYSTEM.DOMAIN##'
$CollectorHostName = $env:computername
$TargetUserName = '##wmi.user##'
$TargetPassword = '##wmi.pass##'
$DebugMode = $false

$ScriptBlock = {
    param (
        [bool]$Debug,
        [String]$SerialNumber
    )
    
    if ($Cert = Get-ChildItem -Path cert:LocalMachine -Recurse | Where-Object { $_.SerialNumber -eq $SerialNumber } | Sort-Object -Unique) {
        $TimeSpan = New-TimeSpan -Start (Get-Date) -End $Cert.NotAfter
        $DaysLeft = $TimeSpan.Days
        Write-Host "DaysLeft=$DaysLeft"
    }
}

if ($TargetHostName -eq $CollectorHostName)
{
    Invoke-Command -ScriptBlock $ScriptBlock -ArgumentList @($DebugMode,$Instance)
}
else
{
    #If WMI creds undefined - invoke remote command without creds, if not - create credential object and use it for authorization
    if (($TargetUserName -Match "wmi.user" -and $TargetPassword -Match "wmi.pass") -or 
        ($TargetUserName -eq "" -and $TargetPassword -eq ""))
    {
        Invoke-Command -ComputerName $TargetHostName -ScriptBlock $ScriptBlock -ArgumentList @($DebugMode,$Instance)
    }
    else
    {
        $TargetCredentials = New-Object System.Management.Automation.PSCredential ($TargetUserName, $(ConvertTo-SecureString $TargetPassword -AsPlainText -Force))
        Invoke-Command -ComputerName $TargetHostName -ScriptBlock $ScriptBlock -Credential $TargetCredentials -ArgumentList @($DebugMode,$Instance)
    }
}

Exit 0