The facts as I know them.
- Orion Platform 2014.2.1, SAM 6.1.1, QoE 1.0, IPAM 4.3, NCM 7.3.2, NPM 11.0.1, NTA 4.1.0, IVIM 1.10.0
- Running on Windows 2008 R2 server
- When I poll systems in our domain everything is fine - I get all the WMI objects.
- When I poll systems in the DMZ - not part of our Domain - I get most objects but never the network interfaces. I can poll the system locally and it returns everything.
- If I use SNMP it works fine in the DMZ.
- I have made credentials specifically for WMI polling and performed the following:
COM+ Network Access needs to be installed which is a feature of App Server Role
netsh firewall set service RemoteAdmin enable
Open WMIMGMT.MSC
a. Right Click on WMI Control (Local) and select "Properties"
b. Select the "Security" tab
c. Select ROOT and click "Security"
d. Select Advanced
e. Add Permissions to Root for the account created
i. Full Write, Partial Write, Provider Write, Enable Account, Remote Enable, and Read Security
ii. Make sure that "Apply to:" is set toe "This namespace and subnamespaces"
iii. Select OK, then OK, then OK, and then OK one last time
Open DCOMCNFG.exe
a. Select My Computer, under Component Services | Computers | My Computer
b. Right Click and select properties
c. Then select the COM Security Tab
i. Under Access Permissions Edit Limits...
ii. Add the account and ALLOW "Local Access" and "Remote Access"
iii. Under Launch and Activation Permissions Edit Limits...
iv. Add the account and ALLOW all four items.
7. When I do a packet capture on the Palo Alto firewall I see no dropped packets coming from the DMZ related to this.
8. Wireshark has been somewhat of a struggle to work through with this but I see all the activity - requests and responses. Yet it has not yielded an answer to this puzzle.
9. I turned up logging and tracing on the system I am testing against for WMI and I yet to see anything of interest.
10. I added the account to the administrators group on the test system as a last resort and that did nothing.
My questions are, is there an ACL on the object for NICs that prevents querying from non-domain/workgroup systems? Should I just give up and work out SNMP v3 for the DMZ?