6.1
Table Of Contents
- Application Discovery Manager User’s Guide
- Contents
- About This Book
- Architecture Overview
- Getting Started
- Managing ADM
- Groups
- Discovery
- Application Patterns
- Report
- Connectors
- Solver
- Index
VMware, Inc. 41
Chapter 5 Discovery
WMI Deployment Recommendations
Creating a User for WMI Detail Discovery
UsingWMItoqueryremotehostsfortheirconfigurationdetailsrequiresappropriateprivileges,asdescribed
next.Toeasilymanagetheseprivileges,itisrecommendedtouseaseparatedomainuserforthispurpose.
Therefore,thefirststepindeployingWMIDetailDiscoveryistocreateadomainuseraccount.This
user
shouldnothaveanyspecialadministrativeprivileges.Infact,thereisnoreasonforittobelongtoanygroups
atall.
Intheeventthatalocaladministratoruserisusedinsteadofaspeciallycreateduser,itisimportantthat
DCOMconfigurationallowsremoteaccessandlaunchfor
administratorusers.Troubleshootingtipsregarding
WMIandDCOMpermissionsisfoundinthearticleat:
http://blogs.technet.com/askperf/archive/2007/08/14/wmi-troubleshooting-permissions.aspx
YouneedtocreateaprofileandtemporaryfolderonallmachineswhereDetailDiscoveryistobeperformed
byloggingintothosemachines.
Ifalocaluserisusedratherthanadomainuser,followtheinstructionsin“ConfiguringtheWindowsTelnet
server”onpage 44regardinglocalsecuritypolicy
settings.
Firewall Settings
WMIqueriesinvolvetheMicrosoftRPCnetworkprotocolthatusesdynamically‐assignedportsontheserver
side,andisthereforequitefirewall‐unfriendly.Toavoidfirewalltrouble,itisrecommendedtodeploythe
DetailDiscovery,Collectorapplianceinthesamenetworkasthemanagedhostswithoutafirewallbetween
them.
IftheremustbeafirewallbetweentheManagement,AggregatorapplianceandtheDetailDiscovery,Collector
appliance,itshouldbeconfiguredtoallowRPCtraffic.Thisisdoneintwostages:
1ConfigurethemanagedhoststouseanarrowrangeofdynamicportsfortheirRPC.ThefollowingURLs
provide
furtherinformation:
http://msdn2.microsoft.com/en-us/library/ms809327
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dndcom/html/msdn_dcomfirewal
l.asp
2Inthefirewallsettings,openTCPport135(theRPCServiceControlManagerport),inadditiontothefull
rangeofRPCportsspecifiedinStep 1,foraccessbytheDetailDiscovery,Collectorappliance.
Disabling Internal Firewall for Windows XP Service Pack 2
Theinternalfirewallshouldbeturnedofforpartiallydisabledtoallowdirectconnectiontothe
localnetwork.
To change the firewall configuration
1GotoControlPanel>SecurityCenter>WindowsFirewall.
2Tofullydisablethefirewall,intheGeneraltab,selectOff.
3IfyouwanttoleavethefirewallenabledbutstillallowRPC/DCOMcommunication,selectOninthe
Generaltab,andintheAdvancedtab,clearlocal
network.
Setting DCOM Privileges
Inthefollowingsteps,itisassumedthatthedomainnameisMYDOMAINandthattheuserusedforWMI
DetailDiscoveryandthatdomainisnamedDOMAINUSER.
SinceWMIaccesstoaWindowshostinvolvesDCOMtechnology,theDOMAINUSERneedstobeallowedto
performDCOMoperationsoneachmanagedhost.ThisisalreadythedefaultsettinginmostWindowsservers
(Windows2000and2003serverfamilies),butnotinWindowsXPorinserversthathadtheir
defaultschanged.
I
MPORTANTWindowsXPwithServicePack2hasabuilt‐ininternalfirewallthatmightblockincoming
RPC/DCOMrequests.