The problem is that "no remote anonymous access to the rpc interfaces" is allowed as of SP-1.  In a lot of ways, this is a good thing, it just sucks for our purposes since WUG relies on this to be accessible.
 
I spoke with Ipswitch tech support on Friday and they suggested that I was more or less on my own.
 
I also agree that putting the WUG account in the administrators group is not an acceptable option, especially because the boxes we're monitoring are Domain Controllers, and we want to restrict our access to them to "absolutely need to have".  That is, making the WUG account a domain admin for 40,000 users and all of the servers in our organization seemed to be a bit to ask from our monitoring group.
 
If the server(s) in question are not domain controllers, and therefore have "local" accounts, one way around the issue is to create a passthrough local account with the same username/password as the WUG account.  Depending on whether or not the box is SP-1d, you may or may not have to make this account a local admin group member on the server in question.  This is kludgy, but it may help you in the short term.  I've done this on some of our non-domain servers that need to be monitored and have no knowledge of the domain account we're using to monitor with.
 
If anyone does find out more about this issue, I'm sure that a bunch of the people, including myself, would love to hear about the solution(s).
 
I agree that Ipswitch should be paying attention to to this one as it may make agent based services begin to look more attractive.
 
Dan . . .

Dan Arsenault
Network Administrator
Siemens VDO Automotive Inc.
700 Park Avenue East
Chatham, Ontario, Canada
Voice: 519-436-3839
Fax: 519-436-3641
Email: [EMAIL PROTECTED]

The message is intended only for the use of the intended recipient(s). It is confidential and may also be privileged and/or exempt from disclosure under applicable law. If you are not the intended recipient(s), you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of this message is strictly prohibited and may be illegal. If you are not the intended recipient(s), or have received this message in error, please notify the sender immediately by return E-mail and delete this message.


 


From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Lawler
Sent: Friday, April 29, 2005 8:22 AM
To: [email protected]
Subject: RE: [WhatsUp Forum] Windows Server 2003 SP1

Rod,

 

I am having the same problem.  I do not have the W2K3 firewall enabled yet and I am still getting these problems.  Seems like the ONLY way for WU to talk to the service control manager is to be an administrator on the server it’s monitoring.  This is unacceptable and we are currently trying to figure out a way around it.  I hope ipswitch has people working on this…

 

Thanks,

Andy Lawler

Penn State University

 


From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists)
Sent: Friday, April 29, 2005 1:21 AM
To: [email protected]
Subject: RE: [WhatsUp Forum] Windows Server 2003 SP1

 

Windows Firewall Service. Add WU as a trusted app.

 

John T

eServices For You

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
Sent: Thursday, April 28, 2005 8:58 AM
To: [email protected]
Subject: [WhatsUp Forum] Windows Server 2003 SP1

 


I was seeing if anyone is seeing an issues with Windows Server 2003 SP1 and might have a fix.  The issue we are seeing is after SP1 is installed on Windows Server 2003 we get alerts showing all services stopped.  They are actually started.  I currently have a case open with support.  Below is information on SP1.

Here are some services being monitored.
McAfee Framework Service  
DNS Client  
Microsoft Web Proxy  
DHCP Client  
Remote Procedure Call  
Microsoft ISA Server Control  
Network Associates McShield
 

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/servicepack/overview.mspx

Service Pack 1 improves security around DCOM and RPC. RPC (with DCOM built upon it) is fundamentally a means to remotely call, activate, or launch a program on another computer—naturally a desirable ability for hackers! SP1 defends against this avenue of attack by checking every activation or launch of a program against a computer-wide access control list (ACL). This usage of the computer-wide ACL provides a minimum authorization standard for all program calls on a computer, discriminating between who has and who does not have permission to access a system service.

Any information would be appreciated.





Thanks,

Rod Cameron
Regions Technology

Reply via email to