<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=Content-Type content="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 12 (filtered medium)">  <style>  </style>  </head> <body lang=EN-US link=blue vlink=purple> <div class=Section1> <p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"; color:#1F497D'>Thank you Tony,<o:p></o:p></span></p> <p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"; color:#1F497D'>I see that you’re the author of NC_Net, and I think you sent a message the other day stating that there was a newly released version.<o:p></o:p></span></p> <p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"; color:#1F497D'>What are your thoughts on doing things the way I described below vs. using NC_Net (or any agent).<o:p></o:p></span></p> <p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"; color:#1F497D'>Pros, cons, reason to use both?<o:p></o:p></span></p> <p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"; color:#1F497D'><o:p> </o:p></span></p> <p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"; color:#1F497D'>Thanks,</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"; color:#1F497D'> <br> </span><span style='font-size:10.0pt;font-family:"Arial","sans-serif"; color:#1F497D'>Garry</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"; color:#1F497D'><o:p></o:p></span></p> <p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"; color:#1F497D'><o:p> </o:p></span></p> <div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'> <p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Anthony Montibello [mailto:amontibello@gmail.com] <br> <b>Sent:</b> Thursday, April 24, 2008 4:04 PM<br> <b>To:</b> Cook, Garry<br> <b>Cc:</b> Nagios-users@lists.sourceforge.net<br> <b>Subject:</b> Re: [Nagios-users] Using NRPE-NT to check WMI on Windows Server<o:p></o:p></span></p> </div> <p class=MsoNormal><o:p> </o:p></p> <div> <p class=MsoNormal>Each WIndows element and WMI stuff require different permissions, <o:p></o:p></p> </div> <div> <p class=MsoNormal> <o:p></o:p></p> </div> <div> <p class=MsoNormal>When using WMI, you have access to do almost anything, <o:p></o:p></p> </div> <div> <p class=MsoNormal>for example when query for users WMI contacts the primary domain controler and waits for its results of all users in the Domamin. Naturally this requires higher permissions than just qurying processes running in your user space.<o:p></o:p></p> </div> <div> <p class=MsoNormal> <o:p></o:p></p> </div> <div> <p class=MsoNormal>To minimize your headacks, I assunme you want to test many system stats that only System, Network Services or Administrators have access. <o:p></o:p></p> </div> <div> <p class=MsoNormal>If this is true,Try to convince the domain admins to approve all your scripts as non-destructive scripts. Then get the Domain Admins to add a user with thesse administrator permissions, then restict that user to no logon rights, and only rights to access the particular NRPE port. <o:p></o:p></p> </div> <div> <p class=MsoNormal> <o:p></o:p></p> </div> <div> <p class=MsoNormal>I hope this helps<o:p></o:p></p> </div> <div> <p class=MsoNormal> <o:p></o:p></p> </div> <div> <p class=MsoNormal>TOny<o:p></o:p></p> </div> <div> <p class=MsoNormal>(Author of NC_NEt)<o:p></o:p></p> </div> <div> <p class=MsoNormal> <o:p></o:p></p> </div> <div> <p class=MsoNormal> <o:p></o:p></p> </div> <div> <p class=MsoNormal> <o:p></o:p></p> </div> <div> <p class=MsoNormal>On Thu, Apr 24, 2008 at 4:05 PM, Cook, Garry <<a href="mailto:Garry.Cook@arcadis-us.com">Garry.Cook@arcadis-us.com</a>> wrote:<o:p></o:p></p> <div> <div> <p>Question for the Window's gurus out there. I'm not really a 'windows guy' and don't have access to the Windows servers that I've been asked to monitor. Therefore, I'm using the NRPE VBScript setup developed by Groundwork to monitor some Windows servers via WMI. The NRPE-NT service runs on one box which I do have control over and this is also where the VBScript plugins live.<o:p></o:p></p> <p> <o:p></o:p></p> <p>When running NRPE-NT as my own Windows account, I can check services on File/Print servers, but not Domain Controllers. I tried several other accounts that have various levels of access and receive different errors. I've been reduced to having one of our Domain Admins run this service under his account, which works. This was done temporarily to test that this method is possible, but cannot be used as a permanent solution. The goal is to have NRPE-NT run as an account with the minimum level of permissions to perform these service checks.<o:p></o:p></p> <p> <o:p></o:p></p> <p>What level of access does the account that runs the NRPE-NT service need to have on all of the servers in order to function properly?<o:p></o:p></p> <p><span style='font-size:10.0pt'>Thank you,</span> <o:p></o:p></p> <p><span style='font-size:10.0pt'>Garry W. Cook, CCNA</span> <br> <span style='font-size:10.0pt'>Network Systems Specialist</span> <br> <span style='font-size:10.0pt'>ARCADIS U.S., Inc.</span> <br> <span style='font-size:10.0pt'>630 Plaza Drive, Suite 200</span> <br> <span style='font-size:10.0pt'>Highlands Ranch, CO 80129</span> <br> <span style='font-size:10.0pt'>720.344.3708 (Office)</span> <br> <span style='font-size:10.0pt'>720.220.1862 (Mobile)</span> <o:p></o:p></p> </div> <p class=MsoNormal><o:p> </o:p></p> <div class=MsoNormal align=center style='text-align:center'> <hr size=2 width="100%" align=center> </div> <p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial","sans-serif"; color:black'>NOTICE: This e-mail and any files transmitted with it are the property of ARCADIS U.S., Inc. and its affiliates. All rights, including without limitation copyright, are reserved. The proprietary information contained in this e-mail message, and any files transmitted with it, is intended for the use of the recipient(s) named above. If the reader of this e-mail is not the intended recipient, you are hereby notified that you have received this e-mail in error and that any review, distribution or copying of this e-mail or any files transmitted with it is strictly prohibited. If you have received this e-mail in error, please notify the sender immediately and delete the original message and any files transmitted. The unauthorized use of this e-mail or any files transmitted with it is prohibited and disclaimed by ARCADIS U.S., Inc. and its affiliates.</span><o:p></o:p></p> </div> <p class=MsoNormal><br> -------------------------------------------------------------------------<br> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference<br> Don't miss this year's exciting event. There's still time to save $100.<br> Use priority code J8TL2D2.<br> <a href="http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone" target="_blank">http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone</a><br> _______________________________________________<br> Nagios-users mailing list<br> <a href="mailto:Nagios-users@lists.sourceforge.net">Nagios-users@lists.sourceforge.net</a><br> <a href="https://lists.sourceforge.net/lists/listinfo/nagios-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/nagios-users</a><br> ::: Please include Nagios version, plugin version (-v) and OS when reporting any issue.<br> ::: Messages without supporting info will risk being sent to /dev/null<o:p></o:p></p> </div> <p class=MsoNormal><o:p> </o:p></p> </div> </body> </html>