Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking at deploying SNMP Settings for windows servers via Group Policy and have an administrative template prepared. However I am noting strange behaviour when applying the policy.

Two Community strings are created, with different permissions. ie:

MYCOMMUNITY - READ ONLY
MYCOMMUNITY - READ CREATE

The Windows Registry also shows two values being created in

HKLM\Software\Policies\SNMP\Parameters\ValidCommunities

NAME         TYPE       DATA
1            REG_SZ     MYCOMMUNITY
MYCOMMUNITY  REG_DWORD  0x00000010 (16)

It is the latter of these two registry values that generates the READ CREATE community that I want, yet I seem to be unable to stop the first string entry from being generated.

My question is Whether READ CREATE Permissions will take precedence over READ ONLY permissions, or will there be "Random" behaviour with this configuration?

Thanks

share|improve this question
add comment

2 Answers

For SNMP v1, you want the communities to be different, ie

MYROCOMMUNITY - READ ONLY
MYRWCOMMUNITY - READ WRITE

Since there are no user names for SNMP v1, the community is what decides what the access level is. I don't know how Windows deals with this situation.

share|improve this answer
    
Hi David, agreed. There is supposed to be only 1 community called MYCOMMUNITY, yet the 2 regkeys gets created making it appear to be 2 communities of the same name. What I am wondering is whether as a result of this, MYCOMMUNITY will be READ ONLY, or will it be READ CREATE, or neither :) –  Ben Short Feb 10 '10 at 4:23
add comment
up vote 0 down vote accepted

Have actually found a solution using Group Policy. Despite what I read yesterday, you can in fact delete registry values with an adm template. The policy code that solved this for me is as follows.

        POLICY "Delete Default SNMP Community"
            EXPLAIN "Deletes the first Community String from SNMP"
            KEYNAME "Software\Policies\SNMP\Parameters\ValidCommunities"
            VALUENAME "1"
            VALUEON DELETE
            VALUEOFF "MYCOMMUNITY"
        END POLICY

Slightly different to the question asked, I know. However this achieves the result I needed - which was a single community which I know has READ CREATE access.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.