This chapter describes the permission standard for an Inventory Service User account (Domain/local) or a specified Group (domain/local) to have scanning permission for the Zero Touch Windows scanning technology.
User Specifications
Option 1: Use a local Administrator account
This is the highest permission level.
The user account needs to be member of the local Administrators group. Local administrators usually have full permissions to WMI. Such user needs to be permitted and rolled out to every target device in scope.
Option 2: Create an Inventory Service user account with dedicated permissions
This is the least privilege approach.
For granting dedicated permissions to specified Service Users or Groups the following needs to be configured on every target device in scope:
Group Membership
The User or Group needs to be member of the following groups:
Performance Monitor Users |
S-1-5-32-558 |
Distributed COM Users |
S-1-5-32-562 |
Remote Management Users (Not needed on Windows 7 and its counterparts) |
S-1-5-32-580 |
|
Note: Windows Domain Controllers use Domain Groups only. Therefore, the designated Inventory Service Users needs to be member of the corresponding Domain Groups. |
Required permissions on the target device
The following permissions on the WMI-Namespaces for the specified user or group should be granted:
Common WMI permissions
Namespace |
Permissions |
Inheritance |
|---|---|---|
\root |
•Enable Account •Remote Enable |
No |
\root\cimv2 |
•Enable Account •Execute Methods •Remote Enable •Read Security |
Yes |
WMI permissions for MS SQL Servers
Namespace |
Permissions |
Inheritance |
|---|---|---|
\root\Microsoft\SqlServer |
•Enable Account •Execute Methods •Remote Enable •Read Security |
Yes |
WMI permissions for MS SQL Server version <= 2000
Namespace |
Permissions |
Inheritance |
|---|---|---|
\root\Microsoft\SqlServer\MSSQL_Server |
•Enable Account •Execute Methods •Remote Enable •Read Security |
Yes |
\root\Microsoft\SqlServer\MSSQL_RegistrySetting |
•Enable Account •Execute Methods •Remote Enable •Read Security |
Yes |
WMI permissions for MS SQL Server version >= 2005
Namespace |
Permissions |
Inheritance |
|---|---|---|
\root\Microsoft\SqlServer\ComputerManagementXX (XX is the major version number of SQL Server) |
•Enable Account •Execute Methods •Remote Enable •Read Security |
Yes |
WMI permissions for Hyper-V
Namespace |
Permissions |
Inheritance |
|---|---|---|
\root\virtualization |
•Enable Account •Execute Methods •Remote Enable •Read Security |
Yes |
\root\virtualization\v1 |
•Enable Account •Execute Methods •Remote Enable •Read Security |
Yes |
\root\virtualization\v2 |
•Enable Account •Execute Methods •Remote Enable •Read Security |
Yes |
\root\MSCluster |
•Enable Account •Execute Methods •Remote Enable •Read Security |
Yes |
Locale group for Hyper-V
For a full Hyper-V inventory to work, it is necessary that the inventory user is in the group on all Hyper-V hosts:
•Hyper-V Administrators
Permissions for Windows Services
To get a full inventory including WIndows Services, the user needs to have the following permissions:
•QueryStatus
•QueryConfig
•Interrogate
•EnumerateDependents
•Start
•ReadPermissions
For full SQL Details, it's as well needed to have the described rights for Windows Services.
Local Firewall rule
WMI connection needs to be allowed on the device that is about to be scanned.
Example command for Windows Firewall:
•"netsh.exe advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes"
WMI Service Restart
The WMI Service (Windows Management Instrumentation) needs to be restarted in order to apply changes of WMI permissions.