Skip to main content

Incident ResponderIncident Responder Documentation

Version: i56

Table of Contents

Configure the Microsoft Windows Management Instrumentation Service

Configure Microsoft Windows Management Instrumentation (WMI) as a service to connect to and gather information from endpoints using actions.

Prerequisites

Last updated: June 15, 2022

Ensure you have a Windows user account with the necessary permissions. To run any WMI action, you must have an account in the Administrators security group or configure a non-administrator account so it can execute WMI Control commands.

Configure a non-administrator account

To configure a non-administrator account so it can execute all WMI Control commands, you must add the account to the Distributed COM Users, Performance Monitor Users, and Event Log Readers security groups, then configure the group security settings.

1. Add the account to security groups

  1. Open the Local User and Group Management snap-in console. There are two ways to open the console:

    • Open Computer Management, then navigate to System Tools > Local Users and Groups.

    • Run the lusrmgr.msc command: In the Run window, enter lusrmgr.msc, then click OK.

  2. Add the account to the Distributed COM Users, Performance Monitor Users, and Event Log Readers security groups. There are two ways to add an account to a security group:

    • In the Users folder, right-click on the user, select Properties, then select the Member of tab. Click Add, then enter the group name. To validate the group name you entered, click Check Names. Click OK, click Add, then click OK.

    • In the Groups folder, right-click on the group, then select Properties. Click Add, then enter the user account name. To validate the name, click Check Names. Click OK, click Add, then click OK.

2. Configure security group permissions

To enable the Distributed COM Users and Performance Monitor Users security groups to access devices remotely, configure the groups' security settings.

  1. Run the DCOMCNFG utility: In the Run window, enter DCOMCNFG, then click OK.

  2. Navigate to Component Services > Computers, right-click My Computers, then select Properties.

  3. Navigate to the COM Security tab, then under Launch and Activation Permissions, click Edit Limits.

  4. Click Add, then under Enter the object names to select, enter the group name.

  5. To validate the group name you entered, click Check Names.

  6. Click OK, then click Add.

  7. Assign both the Distributed COM Users and Performance Monitor Users security groups specific permissions:

    1. In Group or user names, select a group.

    2. Under Permissions for User, in the Allow column, select:

      • Local Launch

      • Remote Launch

      • Local Activation

      • Remote Activation

    3. Click OK.

3. Apply WMI Control security settings to all namespaces

For the Incident Responder service to fetch data using WMI, you must give access to all classes under all namespaces for the Distributed COM Users and Performance Monitor Users security groups.

  1. Run the winmgmt service: In the Run window, enter wmimgmt.msc, then click OK.

  2. Right-click WMI Control (Local), then select Properties.

  3. Navigate to the Security tab, click Root, click Security, then click Add.

  4. For the Distributed COM Users and Performance Monitor Users security groups, assign namespaces specific permissions:

    1. Under Enter the object names to select, enter the group name.

    2. To validate the group name you entered, click Check Names.

    3. Click OK.

    4. Ensure the group is selected, then click Advanced.

    5. Select the row with the group, then click Edit.

    6. Under Applies to, select This namespace and subnamespaces.

    7. Under Allow, select Execute Methods, Enable Account, and Remote Enable, then click OK.

  5. Click OK.

Configure the Service in Exabeam Incident Responder

  1. In the navigation bar, click the menu The menu icon in the navigation bar; three white lines on a green background., select Settings, then select Core.

  2. Under SERVICE INTEGRATIONS, select Services.

  3. Select a service:

    • To configure a specific service, hover over a service, then click CONFIGURE. Use the search by vendor or filter by action to find a service.

    • To manually provide the relevant information for a service, click Configure a new serviceA blue circle with a white plus sign..

    • To view all actions for a service, hover over a service, then click the information icon An icon of a grey i inside a grey circle..

  4. Enter information about the service:

    • Service Name – Enter a unique name for the service. By default, the service name is WMI.

    • (Optional) Description – Describe the service.

    • (Optional) Owner – Enter the email address of the person or group responsible for the service. 

    • Username – Enter the user account name for the Windows user account with permissions to execute WMI commands.

    • Password – Enter the password to the Windows user account with permissions to execute WMI commands.

  5. To validate the source, select TEST CONNECTIVITY.

  6. Click CREATE SERVICE.