KS-Soft. Network Management Solutions
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister    ProfileProfile    Log inLog in 

How to configure Windows Service Account correctly ?

 
Post new topic   Reply to topic    KS-Soft Forum Index -> Configuration, Maintenance, Troubleshooting
View previous topic :: View next topic  
Author Message
KarlZ



Joined: 30 Apr 2021
Posts: 11

PostPosted: Mon May 03, 2021 6:51 am    Post subject: How to configure Windows Service Account correctly ? Reply with quote

I want to run Hostmonitor on a Windows Server 2019, which is part of a domain.
I would like to setup Hostmonitor as a service. I have done it in the following way and would like to ask for confirmation / correction

1. I have added a AD-User "Hostmonitor" for use as a service account user
2. Hostmonitor runs as a windows service with local System account
3. I have added the AD-User "Hostmonitor" to the local-admin group on the Hostmonitor server only
4. If have added this User (Domain\Hostmonitor) to Options --> Startup --> service --> Use account....

So I think Hostmonitor should start as system account and then make impersonation to user "Domain\Hostmonitor" to perform the tests.

Ist this setup correct, so far?
Will now all test be executed with the user "Domain\Hostmonitor"?

Additional question regarding permission of service-account user:
1. I have setup the Domain-User "Hostmonitor" as local admin at the hostmonitor-server only.
2. on all other machines this user is a simple "domain-user"

Ist there a documentation availlable for needed permission for the various tests?

Is there some clear documentation availlabe about how to setup theese things in an optimal way?

In addition I would like to use Windows Authentication to access Hostmonitor via RCC - is there any additional configuration needed for the service user. ( I get an error, when trying to use Windows Authentication. (Connection error)
Do I need to setup a passwort for the user (if l like to use Windows auth) ?

Thanks is advance for help.
Karl.
Back to top
View user's profile Send private message
KS-Soft



Joined: 03 Apr 2002
Posts: 12790
Location: USA

PostPosted: Mon May 03, 2021 7:56 am    Post subject: Reply with quote

Quote:
2. Hostmonitor runs as a windows service with local System account
4. If have added this User (Domain\Hostmonitor) to Options --> Startup --> service --> Use account...

This works fine on Windows Server 2003.
On new Windows its better to set this account for service itself using Windows Services applet. So move account from Options dialog to Services appler (4 -> 2)

Plus you will need to set account(s) for some tests using Connection Manager, e.g. for IIS, WMI, Dominant Process, Drive Free Space, Memory, Av status tests

Quote:
Ist there a documentation availlable for needed permission for the various tests?

Microsoft has a lot of documentation but sometimes we cannot make system work accordingly to the manuals..

Normally you need the following rights (groups) for the tests

CPU load, Performance Counter, Process
"Performance Monitor Users" (Power User works as well)

WMI, Dominant Process, Drive Free Space, Memory, IIS, OS updates, AV status tests (plus Service test if "some auto services are not running" option is used)
Distributed COM users + Performance Monitor group

NT Event Log tests:
Event Log Readers

Quote:
In addition I would like to use Windows Authentication to access Hostmonitor via RCC - is there any additional configuration needed for the service user. ( I get an error, when trying to use Windows Authentication. (Connection error)
Do I need to setup a passwort for the user (if l like to use Windows auth) ?

No, password field is disabled. Domain controller is used for current user authentication.
You should set "HM or Win authentication" mode in User Profiles dialog.

Regards
Alex
Back to top
View user's profile Send private message Visit poster's website
KarlZ



Joined: 30 Apr 2021
Posts: 11

PostPosted: Mon May 03, 2021 8:10 am    Post subject: Reply with quote

Hi Alex,

thanks for fast answer!
Works perfect this way!


Regards
Karl.
Back to top
View user's profile Send private message
johnm



Joined: 01 Apr 2005
Posts: 117

PostPosted: Tue Aug 17, 2021 8:49 am    Post subject: Reply with quote

Hi Alex, not sure if I can hop on this thread with an RCC > HostMonitor Windows Authentication issue.

HM is running on a domain-joined server and the HM service is running as an AD account and although I tried to created a domain qualified user for my RCC connection (domain\username) I still get the following error. Am I missing something? Does the AD account under which the HM service is running require specific AD permissions or delegation? I've tried to make it a domain admin while debugging but no luck.

Authentication... Failed. InitializeSecurityContext failed. No authority could be contacted for authentication
Back to top
View user's profile Send private message
KS-Soft



Joined: 03 Apr 2002
Posts: 12790
Location: USA

PostPosted: Tue Aug 17, 2021 10:06 am    Post subject: Reply with quote

Its better to create new thread, its not related problem.

HostMonitor version?
RCC version?
Windows version on HM system?
Windows version on RCC system? Same domain? Different domain?
Windows version on DC?

Some Microsoft posts state this error may appear when there are old and new domain controllers in the network (e.g. Windows Server 2003 + 2008)

Regards
Alex
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    KS-Soft Forum Index -> Configuration, Maintenance, Troubleshooting All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group

KS-Soft Forum Index