Invoke-IcingaCheckDiskHealth - permission problems

[aheinhold]

Hi,

while testing the Invoke-IcingaCheckDiskHealth with the parameters DiskQueueLenWarning and DiskQueueLenCritical (or the parameters from your example) i get the following plugin output:

[UNKNOWN]: Icinga Permission Error was thrown: CimInstance: MSFT_PhysicalDisk
The user you are running this command as does not have permission to access the requested Cim-Object. To fix this, please add the user the Agent is running with to the "Remote Management Users" groups and grant access to the WMI branch "root/cimv2" and add the permission "Remote enable".

Our Icinga-Domain-User is member of the "Remote Management Users" an access to the WMI branch "root/cimv2" is grantet with the permission "Remote enable". Which permissions are required?

I used the version from this branch.

[yhabteab]

Hiii @aheinhold , thanks for your report. Is the user account also enabled? If Enable Account and Remote Enable are activated, it should work properly. And if you still get the error message even though they are both activated, please let me know.

[aheinhold]

Servus @Yonas-net , the user account is used to execute other powershell-based checks, e. g. "Invoke-IcingaCheckEventlog" or "Invoke-IcingaCheckMemory" over remote powershell on the same target.
The WMI Control security settings for ROOT/CIMV2 are "Enable Account" and "Remote enable" = true.

[LordHepipud]

Hello and thank you for the issue. We checked this internally and we did some slight improvement on the Framework itself.
It will now print the exact Class and Namespace required for the specific call.

In this case it will now look like this:

UNKNOWN]: Icinga Permission Error was thrown: CimInstance: Class: "MSFT_PhysicalDisk", Namespace: "root\Microsoft\Windows\Storage"

The user you are running this command as does not have permission to access the requested Wmi-Object. To fix this, please add the user the Agent is running with to the "Remote Management Users" groups and grant access to the WMI branch for the Class/Namespace mentioned above and add the permission "Remote enable". Further details can be found here: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771551(v=ws.11)

In order to resolve your permission error, you will require to add permissions to: root\Microsoft\Windows\Storage

I hope this helps!