Forum Discussion

agonzalez's avatar
agonzalez
Icon for Neophyte rankNeophyte
3 months ago

Issues with Switching Non-Admin Domain Account on a Windows Collector

I have configured a non-admin domain user that I would like to use as my collector account and am receiving an error once running the command ".\Windows_NonAdmin_Config -add -UserName domain\domainUser". 

The response: GetSecurityDescriptor failed:
At C:\Program Files\LogicMonitor\Agent\bin\Windows_NonAdmin_Config.ps1:571 char:13
+             throw "GetSecurityDescriptor failed: $($output.ReturnValu ...
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (GetSecurityDescriptor failed: :String) [], RuntimeException
    + FullyQualifiedErrorId : GetSecurityDescriptor failed:

The log files are below: Set-WmiNamespaceSecurity call with add operation
ERROR - GetSecurityDescriptor failed: 

I have previously ran the Non-admin file Windows_NonAdmin_Config.ps1 from C:\Program Files\Logicmonitor\agent\bin\ from the DC and it only ran through the first 3 phases before completing w/o errors. I added WMI permissioned from WMI Control (Windows Server Monitoring and Principle of Least Privilege | LogicMonitor) on the DC and the Windows device running the collector. I would appreciate guidance on the necessary settings for a domain user to replace the current system account on the collector, enabling it to serve as a WMI data collection account for the domain.

No RepliesBe the first to reply