Authentication on workgroup machines

All SysMan versions make use of Windows Management Instrumentation (WMI) for remote administration. By default, Windows allows inbound WMI queries from members of the Domain Admins group (when the remote machine is in a domain) and the built-in Administrator account (when the remote machine is in a workgroup).

Machines which are in a workgroup by default have inbound queries blocked by User Account Control (UAC), for all user accounts (except the built-in local Administrator account). UAC ensures that even if the account who is conducting the query is a member of the administrator-group, the connection is established in his normal-user-token. As a result, WMI is left with a lower privilege-level than what is needed to gather the requested information.

Below are examples on how remote administration through WMI could be set up for workgroup machines.
(Please note that all examples below involve reducing the overall security of the operating system in a certain way)

More information: User Account Control and WMI.


Method 1: Authenticate as the remote machine's local Administrator

• On the remote machine ensure that the local Administrator is enabled
• On the local machine, in SysMan authenticate as the remote machine's "Administrator" user.
  (Not a user, who is a member of the Administrator's group)

• On the remote machine ensure:
  
  • The local user in question is a member of the local Administrators group
  • Update or add the following D_WORD entry in the registry: 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\LocalAccountTokenFilterPolicy'.
    And set the value of this entry to 1 to disable remote UAC.
    (Should you ever want to re-enable remote UAC, then set this value to zero (0))
• On the local machine, in SysMan, authenticate as the remote machine's local user.

• On the remote machine ensure:
  
  • The local user in question is a member of the local Administrators group
  • UAC is disabled (and machine is rebooted thereafter)
    Howto: Turning User Account Control on or off.
• On the local machine, in SysMan, authenticate as the remote machine's local user.