Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm writing a monitoring service that uses WMI to get information from remote machines. Having local admin rights on all these machines is not possible for political reasons.

Is this possible? What permissions/rights does my user require for this?

share|improve this question
add comment

4 Answers 4

up vote 10 down vote accepted

The following works on Window 2003 R2 SP 2

  1. Add the user(s) in question to the Performance Monitor Users group
  2. Under Services and Applications, bring up the properties dialog of WMI Control. In the Security tab, highlight Root/CIMV2, click Security; add Performance Monitor Users and enable the options : Enable Account and Remote Enable
  3. Run dcomcnfg. At Component Services > Computers > My Computer, in the COM security tab of the Properties dialog click "Edit Limits" for both Access Permissions and Launch and Activation Permissions. Add Performance Monitor Users and allow remote access, remote launch, and remote activation
  4. Select Windows Management Instrumentation under Component Services > Computers > My Computer > DCOM Config and give Remote Launch and Remote Activation privileges to Performance Users Group.
share|improve this answer
I've found steps 2 and 3 aren't necessary if you add the user to Distributed COM Users. –  Nexus Feb 12 '10 at 0:53
Working on WinXP and Win7, I was not able to add the "Distributed COM Users" group - maybe this group is only accessible on servers? It would not resolve during name lookup when trying to add to the permissions. Also, I found that I had to set permissions for WMI on "Root" as well as "Root/CIMV2" and that I had to go into advanced permissions and apply the permission for the subnamespaces as well as the namespace. –  Shannon Wagner Aug 3 '12 at 20:26
Works also for Windows 8! Also, does somebody know how to do the same from powershell or some other shell? –  Bunyk Mar 24 at 9:02
add comment

By default, only the local Administrators group has remote permissions to WMI. You will have to customise the WMI "Remote Enable" permissions.

share|improve this answer
add comment

You may also have to grant "DCOM remote access permissions" and/or "DCOM remote launch and activation permissions" depending on what exactly you are trying to do. This MSDN article gives the step-by-step procedures.

share|improve this answer
add comment

All I did on Windows 8 was added user to group "Remote Management Users", and remote WQL requests worked.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.