Skip to main content

Configure WMI in Linewize Filter

Updated

Important

This is only for schools in Australia and New Zealand. Schools and districts in the United States must not enable WMI.

This article is for IT Support. 

Windows Management Instrumentation (WMI) and Linewize Filter can work together to monitor the appliances and devices on your network. This guide explains how to configure WMI so it can communicate security events to Linewize Filter.

Before You Start

WMI will not populate the Users list in Linewize Filter. You will need to sync Linewize Filter with your LDAP or Microsoft Entra ID before adding WMI. This will allow Linewize Filter to associate machine names from WMI with your Users.

Configuring WMI for Linewize Filter

Warning

If you have already created a dedicated Linewize administrator account for LDAP sync, you can use the same account to configure these roles.

There are six steps in this process:

  1. Verifying services are set to start automatically
  2. Assigning permissions to the administrator account
  3. Enabling Component Services
  4. Configuring WMI Settings
  5. Configuring 4768 Event Auditing
  6. Checking Event Viewer Logs

After completing these steps, you can continue Adding a WMI Domain Controller in Linewize Filter.

1. Verify services are set to start automatically

First, you need to check if the 'Server' 'DCOM' and 'WMI' services will automatically start.

  1. Open the Run window.
  2. Type services.msc then select OK.
  3. In the services list, you should see Startup Type of Automatic.
    If the service is a different Startup Type, change it to Automatic.

2. Assigning permissions to the administrator account

  1. Go to Active Directory Users & Groups.
  2. Find your dedicated Linewize administrator account.
  3. Right-click the User, and go to Properties > Member Of .
  4. Add the user to the Event Log Readers & Distributed COM Users groups.

3. Enabling Component Services

    1. Open the Run window.
    2. Type dcomcnfg then select OK.
    3. Right-click My Computer and open Properties.
    4. Go to the Default Properties tab.
      1. Tick the Enable Distributed COM on this computer checkbox.
      2. Tick the Enable COM Internet Services on this computer checkbox.
      3. Using the Default Authentication Level dropdown, select Connect.
      4. Using the Default Impersonation Level dropdown, select Identify.
    5. Go to the COM Security tab.
  • For Access Permissions:
      1. Select Edit Default, then add your administrator account.
      2. Tick the Allow checkbox for Local Access and Remote Access. 
  • For Launch and Activation Permissions:
      1. Select Edit Default, then add your administrator account.
      2. Tick the Allow checkbox for Local Access, Remote Access, Local Activation and Remote Activation.

4. Configuring WMI Settings

  1. Open the Run window.
  2. Type wmimgmt.msc then select OK.
  3. Right-click WMI Control (Local) and open the Properties.
  4. Go to the Security tab, expand the Root folder, select CIMV2 then select Security.
  5. Select Advanced, select Add, then add your administrator account.
  6. Ensure the following Permissions are ticked:
    • Execute Methods
    • Partial Write
    • Provider Write
    • Enable Account
    • Remote Enable
    • Read Security
    • Edit Security

5. Configuring 4768 Event Auditing

This policy should be set up in group policy to ensure it propagates to all domain controllers on the network. Typically, this is the 'Default Domain Controllers Policy'.

  1. Go to Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Account Logon > Kerberos Authentication Service > Account Logon Events > Success.
  2. Check if there are any additional audit policies configured. If there are other policies configured, you will need to disable them as it may cause issues with events.

    Note

    If you have concerns about disabling other policies, contact Linewize Support.

  3. Go to Command Prompt and run gpupdate /force
  4. Next, run auditpol /get /category:*
  5. If the steps were completed correctly. You will see that the only policy enabled is the policy created in Step 1.

6. Checking Event Viewer Logs

Check the Event Viewer to ensure the Domain Controller correctly logs events needed for WMI.

  1. Open the Run window
  2. Type eventvwr and then select OK.
  3. Select Windows Logs > Security.
  4. Select Filter Current Log from the Action menu.
  5. Type 4768 in the <All Event IDs> box, then select OK.
  6. If the events are functioning correctly, you will see the logs.

You can now continue to Add a WMI Domain Controller in Linewize Filter.