Configuring a non-admin user account for WMI

You can configure a regular Windows user to access WMI information by adding the regular user account to the Distributed COM Users and the Performance Monitor Users group using lusrmgr.msc, and then configuring the DCOM security settings to allow the groups to access the system remotely (using dcomcnfg).

Note: These configurations are required to be performed in the User profiles of the client devices that are to be monitored.

Configuring Distributed COM Users in Local user and Groups Setting:

1. Click Start → Run, type lusrmgr.msc and click OK.
2. In the Users folder, right-click the user to bring up the menu, and select Properties.
3. Click over to the Members of tab, and click Add.
4. Under 'Enter the object names to select', type 'Distributed COM Users' (without quotes), click Check Names, then click OK.
5. Click Add.
6. Repeat steps 3-5 for the Performance Monitor Users group.

Configuring the DCOM Security Settings to allow the groups to access the system remotely:

7. Click Start → Run, type dcomcnfg and click OK.
8. Drill down into the Component Services tree until you get to My Computer. Right-click 'My Computer' to bring up the menu, and click Properties.
9. Click the COM Security tab, then click Edit Limits under the Launch and Activation Permissions section.
10. Click Add.
11. Under 'Enter the object names to select', type 'Distributed COM Users' (without quotes), click Check Names, then click OK.
12. Click Add.
13. Repeat steps 9-12 for the Performance Monitor Users group.
14. Check Allow for each of the permissions (Local Launch, Remote Launch, Local Activation, Remote Activation) for each of these groups, and click OK.

Setting the WMI Control security settings to be applied to all namespaces:

15. Click Start → Run, type wmimgmt.msc and click OK.
16. Right-click WMI Control (Local) to bring up the menu, and click Properties.
17. Click over to the Security tab, then click Root, and click the Security button.
18. Click Add.
19. Under 'Enter the object names to select', type 'Distributed COM Users' (without quotes), click Check Names, then click OK.
20. Make sure the Distributed COM Users group is selected, and click Advanced.
21. Highlight the row with Distributed COM Users in it and click Edit.
22. From the 'Applies to' drop-down list, select 'This namespace and subnamespaces'.

 

23. Under the 'Allow' column, check Execute Methods, Enable Account and Remote Enable, and then click OK.
24. Repeat steps 17-23 for the Performance Monitor Users group.
25. Click OK to close all windows.