remote control - Page 435

Zenoss Setup for Windows Servers

- by Jay Fox

Recently I was saddled with standing up Zenoss for our enterprise. We're running about 1200 servers, so manually touching each box was not an option. We use LANDesk for a lot of automated installs and patching - more about that later.The steps below may not necessarily have to be completed in this order - it's just the way I did it.STEP ONE:Setup a standard AD user. We want to do this so there's minimal security exposure. Call the account what ever you want "domain/zenoss" for our examples.***********************************************************STEP TWO:Make the following local groups accessible by your zenoss account.Distributed COM UsersPerformance Monitor UsersEvent Log Readers (which doesn't exist on pre-2008 machines)Here's the Powershell script I used to setup access to these local groups:# Created to add Active Directory account to local groups# Must be run from elevated prompt, with permissions on the remote machine(s).# Create txt file should contain the names of the machines that need the account added, one per line.# Script will process machines line by line.foreach($i in (gc c:\tmp\computers.txt)){# Add the user to the first group$objUser=[ADSI]("WinNT://domain/zenoss")$objGroup=[ADSI]("WinNT://$i/Distributed COM Users")$objGroup.PSBase.Invoke("Add",$objUser.PSBase.Path)# Add the user to the second group$objUser=[ADSI]("WinNT://domain/zenoss")$objGroup=[ADSI]("WinNT://$i/Performance Monitor Users")$objGroup.PSBase.Invoke("Add",$objUser.PSBase.Path)# Add the user to the third group - Group doesn't exist on < Server 2008#$objUser=[ADSI]("WinNT://domain/zenoss")#$objGroup=[ADSI]("WinNT://$i/Event Log Readers")#$objGroup.PSBase.Invoke("Add",$objUser.PSBase.Path)}**********************************************************STEP THREE:Setup security on the machines namespace so our domain/zenoss account can access itThe default namespace for zenoss is: root/cimv2Here's the Powershell script:#Grant account defined below (line 11) access to WMI Namespace#Has to be run as account with permissions on remote machinefunction get-sid{Param ($DSIdentity)$ID = new-object System.Security.Principal.NTAccount($DSIdentity)return $ID.Translate( [System.Security.Principal.SecurityIdentifier] ).toString()}$sid = get-sid "domain\zenoss"$SDDL = "A;;CCWP;;;$sid" $DCOMSDDL = "A;;CCDCRP;;;$sid"$computers = Get-Content "c:\tmp\computers.txt"foreach ($strcomputer in $computers){ $Reg = [WMIClass]"\\$strcomputer\root\default:StdRegProv" $DCOM = $Reg.GetBinaryValue(2147483650,"software\microsoft\ole","MachineLaunchRestriction").uValue $security = Get-WmiObject -ComputerName $strcomputer -Namespace root/cimv2 -Class __SystemSecurity $converter = new-object system.management.ManagementClass Win32_SecurityDescriptorHelper $binarySD = @($null) $result = $security.PsBase.InvokeMethod("GetSD",$binarySD) $outsddl = $converter.BinarySDToSDDL($binarySD[0]) $outDCOMSDDL = $converter.BinarySDToSDDL($DCOM) $newSDDL = $outsddl.SDDL += "(" + $SDDL + ")" $newDCOMSDDL = $outDCOMSDDL.SDDL += "(" + $DCOMSDDL + ")" $WMIbinarySD = $converter.SDDLToBinarySD($newSDDL) $WMIconvertedPermissions = ,$WMIbinarySD.BinarySD $DCOMbinarySD = $converter.SDDLToBinarySD($newDCOMSDDL) $DCOMconvertedPermissions = ,$DCOMbinarySD.BinarySD $result = $security.PsBase.InvokeMethod("SetSD",$WMIconvertedPermissions) $result = $Reg.SetBinaryValue(2147483650,"software\microsoft\ole","MachineLaunchRestriction", $DCOMbinarySD.binarySD)}***********************************************************STEP FOUR:Get the SID for our zenoss account.Powershell#Provide AD User get SID$objUser = New-Object System.Security.Principal.NTAccount("domain", "zenoss") $strSID = $objUser.Translate([System.Security.Principal.SecurityIdentifier]) $strSID.Value******************************************************************STEP FIVE:Modify the Service Control Manager to allow access to the zenoss AD account.This command can be run from an elevated command line, or through Powershellsc sdset scmanager "D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CCLCRPRC;;;PUT_YOUR_SID_HERE_FROM STEP_FOUR)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)"******************************************************************In step two the script plows through a txt file that processes each computer listed on each line. For the other scripts I ran them on each machine using LANDesk. You can probably edit those scripts to process a text file as well.That's what got me off the ground monitoring the machines using Zenoss. Hopefully this is helpful for you. Watch the line breaks when copy the scripts.

Search Results

Search found 27521 results on 1101 pages for 'remote control'.

Page 435/1101 | < Previous Page | 431 432 433 434 435 436 437 438 439 440 441 442 | Next Page >

- by Jay Fox

- by Rob

- by serverninja

- by Kevin Boyd

- by wrt

- by scunliffe

- by user288778

- by Ilya Verbitskiy

- by Jason Fitzpatrick

- by Michal Gow

- by bVector

- by lamp_scaler

- by sdaau

- by Itai

- by Schnapple

- by Charles Didier

- by Gerry Haskins

- by Clint Edmonson

- by gourav

- by Chad

- by Fabian

< Previous Page | 431 432 433 434 435 436 437 438 439 440 441 442 | Next Page >