How to configure Windows Service Account correctly ?

KarlZ · Post by **KarlZ** » Mon May 03, 2021 6:51 am

I want to run Hostmonitor on a Windows Server 2019, which is part of a domain.
I would like to setup Hostmonitor as a service. I have done it in the following way and would like to ask for confirmation / correction

1. I have added a AD-User "Hostmonitor" for use as a service account user
2. Hostmonitor runs as a windows service with local System account
3. I have added the AD-User "Hostmonitor" to the local-admin group on the Hostmonitor server only
4. If have added this User (Domain\Hostmonitor) to Options --> Startup --> service --> Use account....

So I think Hostmonitor should start as system account and then make impersonation to user "Domain\Hostmonitor" to perform the tests.

Ist this setup correct, so far?
Will now all test be executed with the user "Domain\Hostmonitor"?

Additional question regarding permission of service-account user:
1. I have setup the Domain-User "Hostmonitor" as local admin at the hostmonitor-server only.
2. on all other machines this user is a simple "domain-user"

Ist there a documentation availlable for needed permission for the various tests?

Is there some clear documentation availlabe about how to setup theese things in an optimal way?

In addition I would like to use Windows Authentication to access Hostmonitor via RCC - is there any additional configuration needed for the service user. ( I get an error, when trying to use Windows Authentication. (Connection error)
Do I need to setup a passwort for the user (if l like to use Windows auth) ?

Thanks is advance for help.
Karl.

KS-Soft · Post by **KS-Soft** » Mon May 03, 2021 7:56 am

2. Hostmonitor runs as a windows service with local System account
4. If have added this User (Domain\Hostmonitor) to Options --> Startup --> service --> Use account...

This works fine on Windows Server 2003.
On new Windows its better to set this account for service itself using Windows Services applet. So move account from Options dialog to Services appler (4 -> 2)

Plus you will need to set account(s) for some tests using Connection Manager, e.g. for IIS, WMI, Dominant Process, Drive Free Space, Memory, Av status tests

Ist there a documentation availlable for needed permission for the various tests?

Microsoft has a lot of documentation but sometimes we cannot make system work accordingly to the manuals..

Normally you need the following rights (groups) for the tests

CPU load, Performance Counter, Process
"Performance Monitor Users" (Power User works as well)

WMI, Dominant Process, Drive Free Space, Memory, IIS, OS updates, AV status tests (plus Service test if "some auto services are not running" option is used)
Distributed COM users + Performance Monitor group

NT Event Log tests:
Event Log Readers

In addition I would like to use Windows Authentication to access Hostmonitor via RCC - is there any additional configuration needed for the service user. ( I get an error, when trying to use Windows Authentication. (Connection error)
Do I need to setup a passwort for the user (if l like to use Windows auth) ?

No, password field is disabled. Domain controller is used for current user authentication.
You should set "HM or Win authentication" mode in User Profiles dialog.

Regards
Alex

KarlZ · Post by **KarlZ** » Mon May 03, 2021 8:10 am

Hi Alex,

thanks for fast answer!
Works perfect this way!

Regards
Karl.

johnm · Post by **johnm** » Tue Aug 17, 2021 8:49 am

Hi Alex, not sure if I can hop on this thread with an RCC > HostMonitor Windows Authentication issue.

HM is running on a domain-joined server and the HM service is running as an AD account and although I tried to created a domain qualified user for my RCC connection (domain\username) I still get the following error. Am I missing something? Does the AD account under which the HM service is running require specific AD permissions or delegation? I've tried to make it a domain admin while debugging but no luck.

Authentication... Failed. InitializeSecurityContext failed. No authority could be contacted for authentication

KS-Soft · Post by **KS-Soft** » Tue Aug 17, 2021 10:06 am

Its better to create new thread, its not related problem.

HostMonitor version?
RCC version?
Windows version on HM system?
Windows version on RCC system? Same domain? Different domain?
Windows version on DC?

Some Microsoft posts state this error may appear when there are old and new domain controllers in the network (e.g. Windows Server 2003 + 2008)

Regards
Alex