PDF

Windows Monitoring Setup

Reading this topic will make your Windows monitoring experience much better.

NetCrunch can monitor Microsoft Windows systems without installing additional agents. However, tightened security rules make remote monitoring possible only after the initial configuration, depending on your Windows environment.

MONITORING SERVER

NetCrunch Server can be installed on Windows Server 2016 or later. If you manage most of the servers by Active Directory, installing NetCrunch on a machine within an Active Directory domain is the better option. This method makes configuration much easier.

MONITORED SYSTEMS

SERVERS

Most server systems come with an enabled firewall, which blocks remote administration. It is the first step you need to take. It could be done either from Active Directory Group Policies or manually one by one. We suggest using a simple script.

Download it here: www.adremsoft.com/download/SetWinForNC.zip.

WORKSTATIONS

If you manage your workstations by Active Directory, preparing them for monitoring will be the same as for the servers (by Active Directory Group Policies or using the script).

Monitoring of workstations in Workgroups requires manual configuration. You can choose to use the built-in local Administrator account or create a new account and manually assign necessary rights directly to this monitoring account.

CONFIGURATION STEPS OVERVIEW

  1. Setting Access Rights
    NetCrunch needs a user account for monitoring that has proper access rights to DCOM, WMI (root\cimV2), and (Read Access) to the registry key (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib.
    The easiest way (not the only one) you can do it is by adding this user to the local Administrators group.

  2. Setting Firewall Rules
    Firewall rules must allow traffic of RPC, Performance Monitoring, Named Pipes, and WMI.

  3. Enabling PerfMon monitoring
    The Remote Registry service must be running, and its startup type should be Automatic.

CONFIGURING ACTIVE DIRECTORY DOMAIN

The procedure below requires a working knowledge of Active Directory Users and Computers and of the Group Policy Management Administrative Tools.

If you manage most of the servers by Active Directory, the best solution is installing NetCrunch on a server in the Active Directory domain and creating a dedicated user for monitoring. If you have not yet created such a user in your Active Directory, you should abort your NetCrunch installation now and configure your Active Directory first, allowing time for the user to propagate across your machines. You can start the NetCrunch installation again after your configuration has been propagated to all servers – it takes approximately 2 hours.

This is done for NetCrunch to discover all servers in the AD and automatically set up monitoring for them. Other servers in untrusted domains or workgroups can be configured separately (see Configuration of Separate Windows Server section below).

SETTING ACCESS RIGHTS

STEP 1 - CREATE USER FOR MONITORING

Create an Active Directory user account (for example, nc-mon-user) used by NetCrunch Server for monitoring. You will be asked later for this user's credentials during the NetCrunch installation.

STEP 2 - SET UP THE RIGHTS FOR THE USER

The user account needs administrative rights to all monitored Windows computers (including the server where NetCrunch Server is installed). There are two different ways to accomplish this, depending on your Active Directory architecture and your needs:

IF IN A SINGLE DOMAIN WHERE YOU WANT TO MONITOR ALL MACHINES

Create an Active Directory group (e.g., Monitoring Users) and add the previously created nc-mon-user account. Then use Group Policy to add that group to the local Administrators group on each monitored computer, using Restricted Groups.

IF MULTIPLE TRUSTED DOMAINS OR ONLY A SUBSET OF COMPUTERS NEEDS MONITORING

It would be best to use Group Policy to modify local Administrators' groups (on each monitored Windows machine).

a) Create an Active Directory group named Monitoring Users and add a previously created user account (nc-mon-user) to it.

In the multi-domain forest, the default Active Directory group scope (which is Global) should be sufficient for this group because global groups can assign permissions to resources in any domain in a forest.

b) Create a new Group Policy Object (GPO) and name it, for example, Local Administrators group membership for NetCrunch.

c) Create the rule for Monitoring Users' group membership.

Go to: Computer Configuration Policies Windows Settings Security Settings Restricted Groups

and add Monitoring Users to the local Administrators group using the section 'This group is a member of.'

d) Link the Local Administrators group membership for NetCrunch GPO to the appropriate Organization Unit(s) (OU) in your Active Directory domain(s).

SETTING FIREWALL RULES

  1. Create a new Group Policy Object and name it, for example, "Windows Firewall rules for monitoring by NetCrunch."
    For Windows Server 2016 or later, go to: Computer Configuration Policies Windows Settings Security Settings Windows Defender Firewall with Advanced Security and add these rules to Inbound Rules, choosing them from a predefined list: File and Printer Sharing, Windows Management Instrumentation (WMI-In), Remote Event Log Management, Performance Logs and Alerts.

  2. Link Windows Firewall rules for monitoring by NetCrunch GPO to the appropriate Organization Unit(s) (OU) in your Active Directory domain(s). For security reasons, it is recommended to customize remote administration rules to narrow the list of allowed IP addresses to the address of your NetCrunch Server only.

ENABLING PERFMON MONITORING

  1. Create a new Group Policy Object and name it, for example, Windows services for monitoring by NetCrunch.
  2. Setup Remote Registry service.
    Go to: Computer Configuration Policies Windows Settings Security Settings System Services and set Remote Registry Windows service startup mode to Automatic.
  3. Link Windows services for monitoring by NetCrunch GPO to appropriate Organization Unit(s) (OU) in your Active Directory domain(s).
    After the policy refresh, the service should start immediately on every computer.

By default, Windows built-in firewall doesn’t block outgoing traffic – if you have changed this behavior, add rules with the same names from the predefined list above to the Outbound Rules.

CONFIGURING OF SEPARATE WINDOWS SERVERS

SETTING ACCESS RIGHTS

Create nc-mon-user account using shell commands and add it to the local Administrators group.

net user /add nc-mon-user <Password>
net localgroup Administrators /add nc-mon-user

SETTING FIREWALL RULES

For Windows Server 2016 or later

you can create a rule for the IP address of the NetCrunch server only.

New-NetFirewallRule -DisplayName "NC-Mon-In" -Direction Inbound -RemoteAddress %IP% -Action Allow -Protocol TCP
New-NetFirewallRule -DisplayName "NC-Mon-Out" -Direction Outbound -RemoteAddress %IP% -Action Allow -Protocol TCP

ENABLING PERFMON MONITORING

Set up Remote Registry service startup and start the service.

Set-Service -Name RemoteRegistry -StartupType Automatic
Start-Service RemoteRegistry
DISABLING UAC REMOTE RESTRICTIONS

This step is no longer required for modern systems and has been removed in accordance with current best practices.

COMPLETE SCRIPT CAN BE DOWNLOADED FROM: this link

Summary of Technologies Used by NetCrunch

Windows technologies have been built layer by layer, one on top of another. For example, RPC is working on top of the Named Pipes, Remote Registry needs RPC, and WMI uses DCOM, which is also using RPC for communication. Everything needs proper settings of firewall and security settings. Here is the shortlist of technologies used by NetCrunch that need adequate configuration:

  1. RPC & Named Pipes – Needs enabling File Sharing, firewall settings
  2. Remote Registry – Needs firewall settings and Remote Registry service running
  3. WMI & DCOM – Needs Firewall settings, DCOM & WMI security settings

It is straightforward and fastest way to do when the user designated for monitoring is a member of the local Administrators group – as described in this document.

It is the simplest way to configure servers for monitoring, but not the most secure. When you need to tighten your security settings even more, setting up specific rights for the monitoring account is possible but may vary depending on your configuration. Please contact Microsoft support for help.

You may also contact AdRem support for an example of how other users NetCrunch users have modified their Windows Monitoring Setup.

access rightsactive directoryfirewallmonitoringperfmonsetupwindowsworkstations