Active Directory Initial Setup

if your environment requires WMI port configuration or a custom Windows share, complete the following steps before connecting the Active Directory Certificate Service (AD CS) or Active Directory Federation Service (AD FS) adapters.

Setting Up a Fixed Port for WMI

The AD CS and AD FS adapters use WMI. WMI runs as part of a shared service host with ports assigned through DCOM by default. However, you can set up the WMI service to run as the only process in a separate host and specify a fixed port. For more details, see Microsoft Documentation - Setting Up a Fixed Port for WMI.

To set up a fixed port for WMI:

1. At the command prompt, type:

winmgmt -standalonehost

2. Stop the WMI service by typing:

net stop "Windows Management Instrumentation"

or:

net stop winmgmt

3. Restart the WMI service again in a new service host by typing:

net start "Windows Management Instrumentation" 

or:

net start winmgmt

4. Establish a new port number for the WMI service by typing (e.g. the following example will establish port TCP 24158):

netsh advfirewall firewall add portopening TCP 24158 WMIFixedPort

To undo any changes you make to WMI, type:

winmgmt /sharedhost

Then stop and start the winmgmt service again.

Creating a Custom Share

You can create a custom share and directory instead of ADMIN$ \ axonius. A custom share that is properly configured enables you to not require full local admin permissions to fetch data.

To create a custom share:

1. Create a local user, such as 'axonius-usr'.

2. Add the user to the following groups:

   • Distributed COM Users
   • Remote Management Users

3. Create a directory for Axonius to use to store temporary files and to serve as a working directory, for example: C:\axonius.
   The name of this directory may be used later in the adapter configuration in Axonius.

4. Grant the following permissions to the local user:

   • Read
   • Write
   • Modify
   • Execute (or full control) permissions on the custom directory, subdirectories, and files

5. Share the directory that you created by using Sharing or Advanced Sharing. Verify that the local user has full permissions for this share. Specify a descriptive name for the shared directory, preferably a name which ends with a dollar-sign, such as: AxoniusShare$
   The name of this share will be used later in the adapter configuration in Axonius.

6. Open WMI Management (wmimgmt.msc). Under Security, select Root (minimal: root/cimv2) namespace.

7. Click Security. Add the local user.

8. Click Advanced.

9. From the Applies to dropdown, select This namespace and subnamespaces.

10. Under the Allow column for the local user, select the Execute Methods, Enable Account, and Remote Enable options, and then click OK.

11. In Axonius, verify that the Custom Share Name and Custom Files Directory parameters are configured. The adapter will attempt to create the specified directory under the share.

12. If the above step fails, it means some sharing options are not enabled on the server. In such a case, add the full path to the share under Custom Working Directory.