IBM Configuring DCOM and WMI to Remotely Retrieve Windows 2. Server Events How do I configure my Windows 2. Servers to allow QRadar to retrieve events over WMI? Administrators can follow the procedures listed below to configure DCOM and verify that Windows Server 2. WMI. Before you begin Event collection over WMI using Windows 2. Windows 3. 2- bit operating systems do not include the required registry keys to complete the procedcures listed below. Therefore, WMI event collection is not supported on Windows 2. Configuring DCOM for OPC Access. If “Everyone” is not granted remote access for “Launch and Activation Permissions” and. EXELE Information Systems, Inc.
Posts about PowerShell. Verify that DCOM access, launch, and activation permissions are enabled. Administrators with Windows 2. Win. Collect to remotely poll for Security, Application, and System event logs. Configure DCOM communications. Configure User Accounts for DCOM. Configure Windows Firewall. Test the WMI configuration. Required DCOM and WMI services for Windows Server 2. The following Windows services must be started and configured for automatic startup. Server Remote Registry Windows Management Instrumentation The procedure below outlines the steps required to configure the Server, Remote Registry, and WMI services for automatic startup. Type the following: services. Click OK. In the details pane, verify the following services are started and set to automatic startup: a. Windows Management Instrumentation To change a service property, right- click on the service name, and then click Properties. From the Startup type list box, select Automatic. If the Service status is not started, click Start. Close the Services window. You are now ready to enable DCOM on your Windows Server 2. Enabling DCOM for Windows Server 2. Procedure. To open the Run menu, press the Windows logo key + R. Type the following: dcomcnfg. Click OK. The Component Services window is displayed. Under Component Services, expand Computers, and then click My Computer. On the Action menu, click Properties. Select the Default Properties tab. Configure the following Default Properties: a. Select the Enable Distributed COM on this computer check box. Using the Default Authentication Level list box, select Connect. Using the Default Impersonation Level list box, select Identify. Click OK. Note: The system displays a message about changing the DCOM Machine wide settings. Click Yes to continue. You are now ready to configure the DCOM protocol for Windows Server 2. Configuring DCOM communications for Windows Server 2. Procedure. From the DCOM Configuration (dcomcnfg) window, expand Component Services, expand Computers, and select My Computer. On the Action menu, click Properties. Select the Default Protocols tab. Configure the following options: a. If Connection- oriented TCP/IP is listed in the DCOM Protocols window, go to Step 5. If Connection- oriented TC/IP is not listed in the DCOM Protocol window, select Add. From the Protocol Sequence list box, select Connection- oriented TC/IP. Click OK. You are now ready to configure a user account with permission to access DCOM. Configuring Windows 2. DCOM After you have enabled DCOM, you must assign an account the proper permission to access DCOM on the host. You must select an existing account with administrative access or create a normal user account that is a member of an administrative group to access the host. The user you grant DCOM permissions is the user you must configure in the QRadar log source. On the Action menu, click Properties. Select the COM Security tab. In Access Permissions, click Edit Default. Select the user or group requiring DCOM access. Note: If the user or group requiring DCOM access is not listed in the permissions list, you must add the user to the configuration. Configure the following user permissions: a. Local Access - Select the Allow check box. Remote Access - Select the Allow check box. In Launch and Activation Permissions, click Edit Default. Select the user or group requiring DCOM access. Note: If the user or group requiring DCOM access is not in the permissions list, you must add the user to the configuration. Configure the following user permissions: a. Local Launch - Select the Allow check box. Remote Launch - Select the Allow check box. Local Activation - Select the Allow check box. Remote Activation - Select the Allow check box. Click OK to close the Component Services window. You are now ready to configure the Windows firewall to allow DCOM communications. Configuring the Windows 2. Firewall. If a firewall is located between the your Windows Server 2. QRadar appliance, you must configure the firewall with an exception to permit DCOM communications. Note: You must be an administrator to change Windows Firewall settings or add an exception to the Windows Firewall. Procedure. To open the Run menu, press the Windows logo key + R. Type the following: wf. On the Action menu, click New Rule. Select Custom and click Next. The Program window is displayed. Select All programs, and click Next. The Protocol and Ports window is displayed. From the Protocol type list box, select TCP and click Next. Note: We recommend you do not limit Local and Remote ports or local IP addresses, but define firewall connection rules by remote IP address. The remote IP address defined should be the appliance defined as the Target Event Collector in the Microsoft Windows Security Event Log in QRadar. Under Which remote IP addresses does this rule apply to field, select the radio button These IP addresses. In the This IP address or subnet text box, type the IP address of QRadar appliance managing the Microsoft Windows Security Event Log source. The QRadar appliance making the request is defined in the log source in the Target Event Collector field. Select Allow the connection, and click Next. Select one or more network profiles to which the rule applies and click Next. Type a name and description for the firewall rule. You can now exit the Windows Firewall with Advanced Security panel. You are now ready to configure Windows Management Instrumentation (WMI) for Windows 2. Configuring WMI user access for Windows Server 2. The user or group you configured for DCOM access must also have Windows Management Instrumentation (WMI) permission to access the Windows event logs required by QRadar. Procedure. To open the Run menu, press the Windows logo key + R. Type the following: wmimgmt. Click OK. Right- click on WMI Control (Local), select Properties. The WMI Control (Local) Properties window is displayed. Click the Security tab. The Namespace navigation is displayed. From the Namespace menu tree, expand Root, click CIMV2. Click the Security button below the menu tree. The Security for ROOT\CIMV2 window is displayed. Select the user or group requiring WMI access. Note: If the user or group requiring WMI access is not listed in the permissions list, you must add the user to the configuration. Select the check boxes to add the following permissions: a. Execute Methods - Select the Allow check box. Provider Write - Select the Allow check box. Enable Account - Select the Allow check box. Remote Enable - Select the Allow check box. Note: If the user or group you are configuring is a system administrator, the allow permission check boxes might be selected as the permissions are inherited. Click OK. Close the WMIMGMT - WMI Control (Local) window. Configuring DCOM Access for Windows Server 2. By default, the access to specific registry values are owned by the Trusted Installer. This procedure provides guidance on how to set the Administrator as the DCOM owner, who can then provide permissions to your QRadar user. The QRadar user specified in your log source configuration should have full control to DCOM both of the DCOM objects defined in this procedure. Only an administrator can provide another user access to both of the DCOM objects outlines below. Procedure. To open the Run menu, press the Windows logo key + R. Type the following command to open the registry editor: regedit. Click OK. Note: You must be a system administrator to edit registry settings. Locate the following registry location: HKEY. Click the Advanced button. The Advanced Security Settings are displayed. In the Owner field, click Change. In the Enter the object name field, set the owner as Administrators. In the Permissions entries field, select your user and click Edit. Note: If the QRadar user is not listed in the permissions list, you must Click Add and define your user as a Principal. To search for a user, type the user name, click Check Names, then click OK to add your user. Configure the following parameters for your user. In the Type field, select Allow. In the Applies to field, select This key and subkeys. In the Basic permissions field, select Full Control. By default, selecting Full Control adds Read as a permission type. Click OK to return to the Advanced Security Settings window. In the Owner field, click Change. In the Enter the object name field, set the owner as your QRadar user. Click OK until you return to the Registry Editor. Repeat this process for the following registry key: HKEY. To use this test tool, your QRadar system must be installed with the latest version of the Windows Event Log protocol. Procedure. Using SSH, log in to QRadar as the root user. Username: root. Password: < password> Type the following command: cd /opt/qradar/jars. Type the following command: java - jar WMITest. Tool- < date>. Configure the following parameters. Remote Windows Host - Type the IP address of your Windows server. Active Directory Domain, or Hostname if in a Workgroup - Type the domain or workgroup for your Windows 2. Username - Type the username required to access the remote Windows server. Password - Type the username required to access the remote Windows server. NTLM Version (1 or 2) - Specify the version of NTLM protocol to be used. Note: In almost every case, the Windows operating systems use NTLM version 2. If you receive an error, please go back and re- check the settings on the Windows specified in the DCOM section of the Log Source Users Guide. If the connection is successful, you should see the following response: Connecting to < host> as < domain> \< user> .. Using Raw WMI: false.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. Archives
September 2017
Categories |