Monitor IIS app pools with a computer out of domain

Using Performance Counter outside of a domain is quite tricky. The windows dll that is used here does not provide any possibility to use explicit credentials. It automatically uses the credentials of the user calling the dll. This is why we use "impersonation". That means, that the prtg thread, that is running the sensor is temporarily switched into the users context. This only works, if the same user is available on the probe system and on the target system. We strongly recommend to use a domain, but if this is not possible, you might try to add a user to the probe system, with the same login name and the same password as on the target device.

Hello,

Thanks for your reply. First of all, it is absolutely necessary to have this server outside the company's domain, as it belongs to our DMZ.

I tried to use this method to solve my problem.

Here's what I did:

-I created a user in my working domain, let's call it FRC, for the domain test.

-I created a user on the server outside the domain, whom is also named FRC, in the domain Workgroup.

-I created a new device, with the Windows credentials "server_name"\FRC, password and the IP of the server

-I added a customized performance counter with the following information:

\WebService(entreprise.forco.org)\ServiceUptime

Here is the error message I get :

Could not log in using the specified credentials. Please make sure they are not only valid for the target system, but for the probe system aswell. (Performance Counter error 0xB0000004)

When I change the domain of the device, to set domain = test, I get :

Unable to connect to the specified computer, or the computer is offline. (Performance Counter error 0x800007D0)

I then added administrator rights to the user FRC on the server, but this didn't change anything.

Thanks for your replies,

Regards,

Theo

Theo,

First let's verify we have connectivity. Can you ping the IIS Server from the PRTG server? Next, can you upload a screenshot of the IIS Server Device settings in PRTG? Namely the section where it shows the Credentials to use when accessing the device.

Thanks!!

Thanks Torsten.

From the PRTG Probe where the device is created, I can ping the IIS Server.

I tried to make a combined screenshot of the IIS device settings on PRTG on the link below. Please note that this menu is in french, I hope you will understand the main content. http://www.freeimagehosting.net/newuploads/49r5g.png

Thanks ! Theo

Theo,

So what is the name of the computer? Is it in a domain or a workgroup?

Thanks!

Hello,

I wrote my answer yesterday but this has not been confirmed by the moderation.

I will try again to send it :

Here is my screenshot of the device settings panel in PRTG. As it is in french, please let me know if you need some translations.

http://www.freeimagehosting.net/newuploads/3x2hj.png

Regards,

Theo

Theo,

You need to change the domain name to the name of the computer and try testing again. Can you give this a try and let me know what happens?

Hello,

This doesn't work.

Below, I compiled 3 screenshots to show you what happens :

First part : I changed the name of the domain to F01S052, that is the name of the server.

Second part : I still get the same error messages even if I try to refresh my sensors

Third part : if I try adding a new "IIS Windows application" sensor, I get the following error message.

http://www.freeimagehosting.net/newuploads/cvh7a.png

Thanks for all your replies.

Best regards,

Theo

Theo,

Just wanting to make sure here, but you have verified the credentials you're giving PRTG work on the box, correct? Meaning, you can log into that box with those credentials, and have rights to IIS.

Thanks!

If you mean that I can successfully log on the server with, for example, a TSE, yes this works, I can connect to the remote server with those credentials. I also added the account into local administrators group so that I am pretty sure I have the rights to IIS.

Thanks,

Theo

Theo,

The only reason I ask is because this is returning the Microsoft error for Access Denied. This isn't a PRTG error. Can you try opening the IIS console on that server while logged in as this user?

I just opened the IIS console with the user svc_telephonie and it works fine. Regards

Hello,

I can go on the IIS console and browse the website while logged in as svc_telephonie, the user used to access the device from PRTG.

Theo,

Sorry for the delayed response. After discussing with our support guys, they recommend you install a remote probe on that server, and connect it to your core server. Once you link the remote probe and the core server, you can put sensors on this IIS box, and the remote probe will handle the authentication and permissions issues.

Please use the link below to install the remote probe. https://www.paessler.com/manuals/prtg8/install_a_prtg_remote_probe

Again, I apologize for the delay. Let me know if you have any issues getting the Remote Probe installed.