WMI Permissions for a Local User

We have created DL-LOCALADMIN-"SERVERNAME" groups for each individual server with powershell. I then created one GG-LOCALADMIN-ALLSERVERS group which holds all DL-LOCALADMIN groups as member off, in the members section of the GG group I place the PRTG service account.

This way the PRTG service account is localadmin on all servers and able to query the machine through WMI.

The powershell script I uses it this:

$ServerName = ""
$OU = ""
New-ADGroup –name “GG-LOCALADMIN-$ServerName” –path $OU -GroupCategory Security -GroupScope Global
New-ADGroup –name “DL-LOCALADMIN-$ServerName” –path $OU -GroupCategory Security -GroupScope DomainLocal
Add-ADGroupMember -Identity “DL-LOCALADMIN-$ServerName” -Members “GG-LOCALADMIN-$ServerName”
Add-ADGroupMember -Identity “DL-LOCALADMIN-$ServerName” -Members “GG-LOCALADMIN-ALLSERVERS”
Invoke-Command -Computername $ServerName -ScriptBlock { Add-LocalGroupMember -Group "Administrators" -Member "DL-LOCALADMIN-$ServerName"}

This script creates a GG-LOCALADMIN group and a DL-LOCALADMIN group for every server, it then makes the DL-LOCALADMIN group member of the GG-LOCALADMIN-ALLSERVERS group, lastly it invokes a remote command to add the DL-LOCALADMIN group to the local administrators group.

I follow AGDLP or UGLY principle.

Alternatively you can throw your PRTG service account in the domain group "Administrators" (not Domain Administrators!!!) which grants the account local administrator privileges but not domain administrator privileges. Although I dislike the fact of using built-in groups and just have control over which accounts has permissions on which machine.

@Rens, thanks for your reply. I thought about this as well, however, it's almost the same principle. Next to that - how are you monitoring your Domain Controller?