Microsoft System Center Operations Manager (SCOM) and Configuration Manager (SCCM) administrators that wish to follow security best practices (i.e. the low privilege scenario) may have experienced some difficulties when granting the agent action account permissions on SMS WMI Classes (highlighted below) at the class level as stated in the following TechNet article: Deploying the Operations Manager 2007 Agent. Here’s a summary of the article’s instructions:
Windows Event Log
Read
The Action Account must be given the Manage auditing and security log privilege using Local or Global Policy.
SMS registry keys
HKLM\Software\Microsoft\SMS
Add the Action Account to the registry properties and provide read access that is inherited by all subkeys.
Win32 Services registry keys
HKLM\System\CurrentControlSet\Services
Add Action Account to the local users group.
Script generated temp files
Read and Write
The path specified by the TMP variable for the Action Agent. For Local System this is %Windir%\Temp
Add the Action Account to the local users group.
SMS log files
<ConfigMgrInstallFolder> \Logs
Add the Action Account to the folder properties.
WMI namespaces
root and root\cimv2
No action should be required.
SMS WMI namespaces
SMS WMI classes
SMS_Site
SMS_R_System
SMS_SiteControlFile
SMS_ProviderLocation
SMS_SCI_SiteDefinition
SMS_SystemResourceList
SMS_SystemResourceList SMS_SiteSystemSummarizer
Add the Action Account to the class for all instances
Security login rights to the default instance
Grant access
For the default instance on a managed SQL Server computer, the Action Account must be given Grant access rights for security logins. In SQL Server Enterprise Manager, add the Action Account to the following node: instancename\Security\Logins.
Access to the Master database on the default instance (required to identify the SMS Site database)
Permit
For the default instance on a managed SQL Server computer, the Action Account must be given permit access to the Master database. In SQL Server Enterprise Manager, add the Action Account to the following node: instancename\Databases\Master\Users.
Keep all default permissions associated with this new user.
Access to the SMS Site database on the default instance
For the default instance on a managed SQL Server computer, the Action Account must be given permit access to the SMS Site database. In SQL Server Enterprise Manager, add the Action Account to the following node: instancename\Databases\<SMS site>\Users.
SMS site
To correct any difficulties you might experience, grant the agent action account the required permissions by following these simple instructions:
That’s it!