User manual VMWARE VCENTER APPLICATION DISCOVERY MANAGER 6.1.1

[. . . ] Application Discovery Manager User's Guide vCenter Application Discovery Manager 6. 1. 1 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see http://www. vmware. com/support/pubs. EN-000453-01 ADM User's Guide You can find the most up-to-date technical documentation on the VMware Web site at: http://www. vmware. com/support/ The VMware Web site also provides the latest product updates. If you have comments about this documentation, submit your feedback to: docfeedback@vmware. com Copyright © 2010 VMware, Inc. and international copyright and intellectual property laws. [. . . ] IMPORTANT The permissions required to complete the same WMI operations might vary between different versions of Windows and different Service Packs installed. Some windows versions such as Windows 2003 Server with SP2 require an account with local administrator permissions in order to successfully complete all queries performed by ADM. 40 VMware, Inc. Chapter 5 Discovery WMI Deployment Recommendations Following are the WMI deployment recommendations. Creating a User for WMI Detail Discovery Using WMI to query remote hosts for their configuration details requires appropriate privileges, as described next. To easily manage these privileges, it is recommended to use a separate domain user for this purpose. Therefore, the first step in deploying WMI Detail Discovery is to create a domain user account. This user should not have any special administrative privileges. In fact, there is no reason for it to belong to any groups at all. In the event that a local administrator user is used instead of a specially created user, it is important that DCOM configuration allows remote access and launch for administrator users. Troubleshooting tips regarding WMI and DCOM permissions is found in the article at: http://blogs. technet. com/askperf/archive/2007/08/14/wmi-troubleshooting-permissions. aspx You need to create a profile and temporary folder on all machines where Detail Discovery is to be performed by logging in to those machines. If a local user is used rather than a domain user, follow the instructions in "Configuring the Windows Telnet server" on page 44 regarding local security policy settings. Firewall Settings WMI queries involve the Microsoft RPC network protocol, which uses dynamically assigned ports on the server side and might result in firewallrelated problems. To avoid firewall problems, you can deploy the Collector appliance in the same network as the managed hosts without a firewall between them. If your environment requires a firewall between the Aggregator appliance and the Collector appliance, configure it to allow RPC traffic. This is done in two stages: 1 2 Configure the managed hosts to use a narrow range of dynamic ports for their RPC. For more information, go to http://support. microsoft. com/kb/154596 In the firewall settings, open TCP port 135 (the port for RPC Service Control Manager) for access by the Collector appliance. Disabling Internal Firewall for Windows XP Service Pack 2 IMPORTANT Windows XP with Service Pack 2 has a builtin internal firewall that might block incoming RPC/DCOM requests. The internal firewall should be turned off or partially disabled to allow direct connection to the local network. To change the firewall configuration 1 2 3 Go to Control Panel > Security Center > Windows Firewall. To fully disable the firewall, in the General tab, select Off. If you want to leave the firewall enabled but still allow RPC/DCOM communication, select On in the General tab, and in the Advanced tab, clear local network. Setting DCOM Privileges In the following steps, it is assumed that the domain name is MYDOMAIN and that the user used for WMI Detail Discovery and that domain is named DOMAINUSER. Since WMI access to a Windows host involves DCOM technology, the DOMAINUSER needs to be allowed to perform DCOM operations on each managed host. [. . . ] Create a short list of hosts that have minimal dependency on other hosts and services. List all hosts that support your application infrastructure. List all services that support your application infrastructure. Show which other hosts and services are dependent on the hosts that support this application. [. . . ]