Configuring Windows Hosts for Monitoring

Enter a password and do the following:

Deselect: User must change password at next logon

Select: User cannot change password

Select: Password never expires

Click Next and Finish.

Navigate to Administrative Tools and access Computer Management.

Navigate to Local Users and Groups and select Groups.

Double-click Performance Monitor Users and add the Domain User Service account created in the previous section.

Click Apply and OK to close the properties page.

Open Windows PowerShell and enter the following command:

wmimgmt.msc

Alternatively, you can navigate in the UI to Control Panel > Administrative Tools > Computer Management > More Actions > WMI Control.

Under Actions/WMI Control (right pane), click More Actions to open the WMI Control Properties wizard.

Click the Security tab and select Root.

Click the Security button and, in "Group or user names", select the domain user service account you previously created.

If the domain user is not listed, click Add, enter the username in the text field, and click OK.

Select the domain user service account and select the following permissions:

Click Advanced section, select the domain user service account, and then click Edit.

Choose the following:

Applies to = This namespace and subnamespaces

Ensure the permissions selected previously are also selected on this window:

Execute Methods, Provider Write, Remote Enable

Click Apply and OK to all open dialog boxes.

Access Windows Powershell and enter the following command:

Enable-PSRemoting

Open PowerShell and enter the following command:

winrm configSDDL default

Alternatively, you can navigate in the UI to Control Panel > Administrative Tools > Computer Management > More Actions > WMI Control.

A Permissions for Default property windows will be displayed.

Select the domain user service account and select the following permissions for the user:

If the domain user is not listed, click Add, enter the username in the text field, and click OK.

Click Apply and OK to exit the window.

Open PowerShell and enter the following command:

wf.msc

A firewall properties page will be displayed.

Click Inbound Rules (left pane) and click New Rule (right pane).

The New Inbound Rules wizard opens to the Rule Type tab.

Modify the configuration as follows:

Clicking Next moves you through the wizard tabs, identified in the left pane.

1. On the Rule Type tab: Select Custom and click Next.

2. On the Program tab: Ensure All programs is selected and click Next.

3. On the Protocol and Ports tab: Leave the defaults and click Next.

4. On the Scope tab:

   • In the Which remote IP addresses does this rule apply to field, select These IP addresses and click Add.

   • In the This IP address or subnet field, type the IP address of the IO Appliance and click Next.

5. On the Action tab: Ensure Allow the connection is enabled and click Next.

6. On the Profile tab: Ensure Domain is selected and deselect Private and Public (as required), and then click Next.

7. On the Name tab: Enter a name and description for the firewall rule and click Finish.

Restart services:

Access the Windows Powershell and enter the following command:

New-SelfSignedCertificate -DnsName "SERVER_FQDN" -CertStoreLocation Cert:\LocalMachine\My

Example:

PS C:\Users\Administrator> New-SelfSignedCertificate -DnsName "win2019lab" -CertStoreLocation Cert:\LocalMachine\My

The output displays ParentPath, Thumbprint, and Subject.

Enter the following command, using the certificate Thumbprint entry from the previous output:

winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname="YOUR_DNS_NAME"; CertificateThumbprint="THUMB_PRINT_FROM_PREVIOUS_COMMAND"}'

Example:

PS C:\Users\Administrator> winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname="win2019lab"; CertificateThumbprint="071EE2A7E83985C86A82149308B1E763B3A8DCFC"}'

Output displays ResourceCreated, ReferenceParameters, and SelectorSet.

In PowerShell, run the following command:

certmgr.msc

In the window, select Intermediate Certification Authorityin the left-hand column, and then select Certificates.

Right-click the certificate in the right-hand pane and select Open.

In the Details tab, click on the Copy to File button and then click on Next.

Select Base-64 encoded x.509 (.CER) and then click on Next.

Name the file, being certain that the file location is accessible from IO, and then click on Next and then Finish. Click OK.

Access Windows Powershell and enter the following command:

Enable-PSRemoting

WinRM Quick Configuraton displays.

Enter Y (yes) to continue.

A message states that WinRM is already set up.

Confirm configuration by typing Y (yes) again.

This should fix the connection problem.