How do I configure and troubleshoot WinRM?

To configure WinRM

To configure WinRM access as a non-admin user

Configuring Kerberos authentication for WinRM 

Troubleshooting Windows OS monitoring

To configure WinRM:

Entuity v19.0 upwards supports monitoring of Windows OSes and servers using WinRM. Before you can start monitoring, you must configure WinRM on the server for remote management.

1. Ensure that the WinRM service is running on the Windows server:
   • If the Windows server is running the Microsoft Windows Server 2012 OS or later, the WinRM service is running on the server, by default. No further steps are required.

   • If the Windows server is running a Windows OS version earlier than 2012, or a non-default configuration, run the following command (as a user with Administrative privileges) to configure the server for remote management:

     winrm quickconfig
      

2. Ensure that the WinRM service is not blocked by a firewall and therefore is remote accessible. 
   By default, WinRM uses port 5985, which must be open. If WinRM is configured to use a non-default port, then this port must be open. 
   Note, Entuity can use the non-default port.
3. Ensure that a user account with appropriate privileges is used on the Windows server. 
   The user account must be part of the local Administrators group on the managed server. Entuity uses Microsoft's negotiate authentication method, allowing Entuity to manage Windows machines that are either part of the domain or not. You can use the following username formats to do so:
    
   • To manage a Windows OS that is part of the domain, use <domain>\<user> format. For example: 'mydomain\username'
   • To manage a Windows OS that is not part of the domain, use just the username. For example: 'Administrator'
4. If you optionally want Entuity to use Kerberos with WinRM for remote connection authentication, follow the configuration steps later in this article to configure Kerberos authentication for WinRM through Entuity.

To configure WinRM access as a non-admin user:

It is possible to manage Windows OS with a user account that is not a member of the local Administrators group. There are four requirements for configuring non-admin user access:

1. User must be a member of required groups.
2. User must have access to WinRM resources.
3. User must have access to WMI namespace.
4. User must have query service manager permissions.

Notes:

• as a prerequisite, the following four sets of instructions assume that you have already created a domain user account to be used for monitoring. In the instructions, the domain user account for monitoring is referred to as <domain>\<user>, which must be replaced with an actual domain user when setting up the non-admin user.
• all actions in these instructions are performed on the Windows server that is to be monitored with an Administrative account (command prompt runs as Administrator).

1. To add the user to the required groups:

1. At the command prompt, run the following commands:

   net localgroup "Remote Management Users" /add <domain>\<user>
   net localgroup "Performance Monitor Users" /add <domain>\<user>

2. To give the user access to WinRM resources:

1. At the command prompt, run the following command to open the Permissions for Default dialog window:
   
    winrm configSDDL default
    
2. In the Group or user names section of the window, add <domain>\<user> to the list.
3. Select the <domain>\<user> you have just added, and in the Permissions for entuity section, select the Allow check box for Read(Get,Enumerate,Subscribe) and Execute(Invoke). 
   For example, to allow Read and Execute permissions for the user 'entuity@places.world':
   
   
    
4. Click OK to confirm your changes.

3. To give the user access to WMI namespace:

1. At the command prompt, run the following command to open the WmiMgmt console.
2. Right-click on WMIControl (Local), and from the context menu, click Properties.
   
   
    
   The WMI Control (Local) Properties dialog is opened.
    
3. Under the Security tab, select Root and then click Security at the bottom of the window.
   
   
   
    The Security for Root dialog is opened. 
    
4. In the Group or user names section, add the 'Remote Management Users' group.
5. Select the newly added 'Remote Management Users' group from the list and click Advanced at the bottom of the window.
   
   
   
    The Advanced Security Settings for Root dialog is opened. 
    
6. Select the 'Remote Management Users' group and click Edit.
   
   
   
    The Permission Entry for Root dialog is opened. 
    
7. In the Applies to dropdown field, select 'This namespace and subnamespaces'.

8. In the Permissions section, select the following check boxes:

   • Execute Methods
   • Enable Account
   • Remote Enable

   
   
    

9. Click OK to save your changes.

4. To allow the user service control manager queries:

1. Open the command prompt in Administrator mode.
2. Obtain and take note of the SID of the user by using 'wmic useraccount where name="<username>" get name,sid'.

3. Output the existing SDDL, which you must adjust by using 'sc sdshow scmanager'. 
   The output will be similar to the following output (note the 'S:' in the SDDL - you must add new text immediately before it):
    

   D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPWPRC;;;<user-SID>)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
    

4. Create a new SDDL snippet that you will insert into the original SDDL from Step 3. 
   The content of the snippet is:

   (A;;CCLCRPWPRC;;;<SID-of-User>)

   You must replace <SID-of-User> with the SID obtained in Step 2. 
   
   After replacement, the new snippet will look similar to the following:
    

   (A;;CCLCRPWPRC;;;S-1-0-10-200000-30000000000-4000000000-500)
    

5. Place the new snippet immediately before the 'S:' of the original SDDL from Step 3. 
   This will look similar to the following:

   D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPWPRC;;;S-1-0-10-200000-30000000000-4000000000-500)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
    

6. Update the service manager SDDL:

   sc sdset scmanager <SDDL-from-Step-5>

Configuring Kerberos authentication for WinRM

Entuity can optionally use Kerberos authentication for WinRM.

Note, configuring Kerberos authentication for WinRM applies to both Microsoft Hyper-V and Windows servers.

Prerequisites

Each server that you want to monitor must have a valid certificate that can be used by WinRM through HTTPS, and the certificate must be installed in "Cert:\LocalMachine\My" (or in the Microsoft Management Console (MMC), under Certificates (Local Computer) > Personal > Certificates). WinRM can't locate the certificate if the certificate resides in a different location.

The host must also be able to contact and resolve the domain controller. To test and verify this, use the following command: 

nltest /dsgetdc: <domain>

To configure Kerberos authentication for WinRM:

1. On the Active Directory (AD) server, create a Service Principal Name (SPN) for the domain account that's used for WinRM.
   For example:
    

   setspn -S HTTP/<FQDN_of_server> <domain>\<user>
   setspn -S HTTPS/<FQDN_of_server> <domain>\<user>

2. Log onto the Hyper-V or Windows server that you want to monitor with WinRM and add the AD account to the admins group.
3. Navigate to Computer Management > Local Users & Groups, and add the domain user to the Administrator group.
   Note, alternatively, if you are using non-administrator accounts, add the domain user to the group that has permissions for executing WinRM.

4. Check for HTTP and HTTPS listeners that might already be configured on the host.
    

   winrm e winrm/config/listener

5. Ensure that Kerberos and Negotiate are set to true, and that basic is set to false.
    

   winrm get winrm/config/Service/Auth

6. Configure an HTTPS listener, if needed.

   winrm quickconfig -transport:https

   
   If this doesn't work, then use the following commands:

   1. Obtain the certificate thumbprint by running the following PowerShell command:
       

      Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Subject -match "<Hostname>" }

   2. Run the winrm create command and substitute <thumbprint> for the thumbprint of the certificate without spaces.
       

      winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="<Hostname>"; CertificateThumbprint="<thumbprint>"}

7. Verify WinRM uses Kerberos authentication by running the following commands from the command line of another Windows host or from the Entuity server.
    

   winrm Get wmicimv2/Win32_OperatingSystem -r:http://<Hostname>:5985 -auth:kerberos -u:<domain>\<user> -p:<password>
   winrm Get wmicimv2/Win32_OperatingSystem -r:<Hostname> -auth:kerberos -u:<domain>\<user> -p:<password>

To edit the Entuity server:

1. Ensure that Entuity uses Kerberos authentication for WinRM by adding the following to the entuity.cfg file, located in entuity_home/etc. 
    

   [winrm]
   realm=ENTUITY.COM
   kdc=Entuity.com

   
   realm is the domain (AD Server) in all capitals, and kdc is the domain as is (either in all lower-case letters or mixed).
    

2. Edit the kerberosAssetStore.txt file, located in entuity_home/etc/CollectionEngine, by adding the IP addresses of the Hypervisor/Windows server(s) that you want to monitor.
3. For the changes to take effect, stop Entuity, run configure, and then restart Entuity.

Troubleshooting Windows OS monitoring:

In some cases, errors may be caused by the WMI performance metrics database being out of sync. To resolve this issue, follow the below instructions:

1. Log in to the affected server.

2. From the command line (run as Administrator), issue the following commands:
    

   cd %windir%\system32\
   lodctr /R
   cd %windir%\sysWOW64\
   lodctr /R