RVY200347: Required Permissions for a Zero Touch Inventory of Windows Devices

1. General Information

This document describes the permission standard for an Inventory Service User account (Domain/local) or a specified Group (domain/local) to have scanning permission for the Zero Touch Windows scanning technology.

2. User Specifications

Option 1: Use a local Administrator account

This is the highest permission level.

The user account needs to be member of the local Administrators group. Local administrators usually have full permissions to WMI. Such user needs to be permitted and rolled out to every target device in scope.

Option 2: Create an Inventory Service user account with dedicated permissions

This is the least privilege approach.

For granting dedicated permissions to specified Service Users or Groups the following needs to be configured on every target device in scope:

Group Membership

The User or Group needs to be member of the following groups:

Performance Monitor Users

S-1-5-32-558

Distributed COM Users

S-1-5-32-562

Remote Management Users

(Not needed on Windows 7 and its counterparts)

S-1-5-32-580

Hint: Windows Domain Controllers uses Domain Groups, only. Therefor the designated Inventory Service User needs to be member of the corresponding Domain Groups.

Required permissions on the target device

The following permissions on the WMI-Namespaces for the specified user or group should be granted: 

Common WMI permissions

Namespace

Permissions

Inheritance

\root

Enable Account
Remote Enable

No

\root\cimv2

Enable Account
Execute Methods
Remote Enable
Read Security

Yes

WMI permissions for MS SQL Servers

Namespace Permissions Inheritance

\root\Microsoft\SqlServer

Enable Account
Execute Methods
Remote Enable
Read Security

Yes

WMI permissions for MS SQL Server version <= 2000

Namespace

Permissions

Inheritance

\root\Microsoft\SqlServer\MSSQL_Server

Enable Account
Execute Methods
Remote Enable
Read Security

yes

\root\Microsoft\SqlServer\MSSQL_RegistrySetting

Enable Account
Execute Methods
Remote Enable
Read Security

yes

WMI permissions for MS SQL Server version >= 2005

\root\Microsoft\SqlServer\ComputerManagementVV

(VV is the major version number of SQL Server)

Enable Account
Execute Methods
Remote Enable
Read Security

yes

WMI permissions for Hyper-V

Namespace Permissions Inheritance
\root\virtualization Enable Account
Execute Methods
Remote Enable
Read Security
yes
\root\virtualization\v1 Enable Account
Execute Methods
Remote Enable
Read Security
yes
\root\virtualization\v2 Enable Account
Execute Methods
Remote Enable
Read Security
yes
\root\MSCluster Enable Account
Execute Methods
Remote Enable
Read Security
yes

Permissions for Windows Services

To get a full inventory including WIndows Services, the user needs to have the following permissions:

  • QueryStatus
  • QueryConfig
  • Interrogate
  • EnumerateDependents
  • Start
  • ReadPermissions

Local Firewall rule

WMI connection needs to be allowed on the device that is about to be scanned. 

Example command for Windows Firewall: 

  • "netsh.exe advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes"

WMI Service Restart

The WMI Service (Windows Management Instrumentation) needs to be restarted in order to apply changes of WMI permissions.

 

For more information see RVY200410: Script Template to Grant Permissions for a Zero Touch Inventory of Windows Devices.

Have more questions? Submit a request

Comments

Powered by Zendesk