Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

External Systems Configuration Guide

Microsoft Windows Server

Support Added: FortiSIEM 4.7.2

Last Modification: FortiSIEM 6.3.3

Supported Versions/OS

  • Windows 2008 and 2008 R2 (via SNMP, WMI, OMI, Agent)
  • Windows 2012 and 2012 R2 (via SNMP, WMI, OMI, Agent)
  • Windows 2016 (via SNMP, WMI, OMI, Agent)
  • Windows 2019 (via SNMP, WMI, OMI, Agent)
  • Windows 2022 (via SNMP, OMI, Agent)

    Note: Starting with FortiSIEM 6.3.3, you can use Open Management Initiative (OMI) to discover and monitor and collect logs from Windows Servers. OMI uses a different API to collect data from the same WMI classes as WMI. So no changes to the Windows Server side is required to accommodate the OMI based communication. In other words, Windows Servers have to be configured identically for both WMI and OMI, and same restrictions apply for both.

 

Vendor: Microsoft

Product Information: https://www.microsoft.com/en-us/windows-server

 

What is Discovered and Monitored

Metrics in bold are unique to Microsoft Windows Server monitoring.

Installed Software Monitored via SNMP

Although information about installed software is available via both SNMP and WMI/OMI, FortiSIEM uses SNMP to obtain installed software information to avoid an issue in Microsoft's WMI implementation for the Win32_Product WMI class - see Microsoft KB 974524 article for more information. Because of this bug, WMI/OMI calls to the Win32_Product class create many unnecessary Windows event log messages indicating that the Windows Installer has reconfigured all installed applications. 

Winexe execution and its effect

FortiSIEM uses the winexe command during discovery and monitoring of Windows servers for the following purposes

  1. Windows domain controller diagnostic (dcdiag) and replication monitoring (repadmin /replsummary)
  2. HyperV Performance Monitoring
  3. Windows Custom performance monitoring – to run a command (e.g. powershell) remotely on windows systems

Note: Running the winexe command remotely will automatically install the winexesvc command on the windows server.

Protocol

Information Discovered

Metrics collected

Used for

SNMP Host name, generic hardware (cpu, memory, network interface, disk), software (operating system version, installed software, running processes, open TCP/UDP ports) Uptime, Overall CPU/Memory/Network Interface/Disk space utilization, Network Interface Errors, Running Process Count, Installed Software change, Running process CPU/memory utilization, Running process start/stop, TCP/UDP port up/down Performance Monitoring
SNMP Vendor specific server hardware (hardware model, hardware serial number, fans, power supply, disk, raid battery). Currently supported vendors include HP and Dell  Hardware module status - fan, power supply, thermal status, battery, disk, memory . Currently supported vendors include HP and Dell

WMI or OMI Win32_ComputerSystem: Host name, OS Win32_WindowsProductActivation: OS Serial Number Win32_OperatingSystem: Memory, Uptime Win32_BIOS: Bios Win32_Processor: CPU Win32_LogicalDisk: Disk info Win32_NetworkAdapterConfiguration: network interface Win32_Service: Services Win32_Process: Running processes Win32_QuickFixEngineering: Installed Patches Win32_OperatingSystem: Uptime Win32_PerfRawData_PerfOS_Processor: Detailed CPU utilization Win32_PerfRawData_PerfOS_Memory: Memory utilization, paging/swapping metrics Win32_LogicalDisk: Disk space utilization Win32_PerfRawData_PerfOS_PagingFile: Paging file utilization Win32_PerfRawData_PerfDisk_LogicalDisk: Disk I/O metrics Win32_PerfRawData_Tcpip_NetworkInterface: Network Interface utilization Win32_Service: Running process uptime, start/stop status Win32_Process, Win32_PerfRawData_PerfProc_Process: Process CPU/memory/I/O utilization Performance Monitoring
WMI or OMI

Security, Application and System Event Logs  including logon, file/folder edits, network traffic (Win32_NTLogEvent) Security and Compliance
Snare agent Security, Application and System Event Logs  including logon, file/folder edits, network traffic (Win32_NTLogEvent) Security and Compliance
Correlog agent Security, Application and System Event Logs ncluding logon, file/folder edits, network traffic (Win32_NTLogEvent) Security and Compliance
FortiSIEM Agent Security, Application and System Event Logs, DNS, DHCP, IIS, DFS logs, Custom log files, File Integrity Monitoring, Registry Change Monitoring, Installed Software Change Monitoring, WMI and Powershell output monitoring  Security and Compliance

Windows Server Monitoring Summary

Log Collection Features

WMI (Windows Mgmt Instrumentation)

FortiSIEM Windows Agent
Security, Application, System Event Logs Yes Yes
File/Folder Edits Yes Yes
File Integrity Monitoring (FIM) No Yes
IIS Audit Logs No Yes
DNS Analytical Logs No Yes
Detailed DHCP Audit Logging No Yes
Support for all Windows Log Channels No Yes
Custom Log Sources No Yes

Windows Event Collector (WEC) Support

No

Yes

Sysmon Event Support

No

Yes

Registry Change Monitoring

No

Yes

Installed Software Change Monitoring

No

Yes

WMI and Powershell Output Monitoring

No

Yes

Supports UEBA Telemetry Data

No

Yes

Performance Features

WMI (Windows Mgmt Instrumentation)

FortiSIEM Windows Agent

Scalable for Large Environments

No

Yes

EPS Performance

100 EPS max

5K EPS

Performance Monitoring

Yes

No

Administrative Features

WMI (Windows Mgmt Instrumentation)

FortiSIEM Windows Agent

Simplified Network Policies

No (TCP 135,1024-65535 inbound)

Yes (443 outbound)

Requires Domain or Local Service Account

Yes

No

Requires Install on Server or Workstation

No

Yes

FIPS Compliant Capable

No

Yes

Log Buffering Upon Connectivity Loss

No

Yes

Supports On and Off Network Monitoring

No

Yes

Secure Log Transmission

Yes

Yes

Event Types

In ADMIN > Device Support > Event Types, search for "windows server" to see the event types associated with this application or device. 

Rules

In RESOURCES > Rules, search for "windows server" in the main content panel Search... field to see the rules associated with this application or device. 

Reports

In RESOURCES > Reports, search for "windows server" in the main content panel Search... field to see the reports associated with this application or device. 

Windows Server Configuration

WinRM Configuration

WinRM is used for some FortiSIEM Remediation actions. If Windows Remediation actions are not used in FortiSIEM, this configuration step is not required.

Enable WinRM and Set Authentication

Use the commands below to enable WinRM and set authentication on the target Windows Servers:

  1. To configure Windows Server:

    winrm quickconfig

    winrm set winrm/config/service/auth ‘@{Basic="true"}’

    winrm set winrm/config/service ‘@{AllowUnencrypted="true"}’

    winrm enumerate winrm/config/listener

    Notes:

    • If HTTPS is not enabled, then open Windows PowerShell console as an administrator, and run the following commands.

    New-SelfSignedCertificate -Subject 'CN=<windows host name>' -TextExtension '2.5.29.37={text}1.3.6.1.5.5.7.3.1'

    winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname="<windows host name>"; CertificateThumbprint="<thumbprint received by New-Self Signed Certificate>"}

    winrm quickconfig -transport:https

    winrm enumerate winrm/config/listener

    • Single quotes are needed for Windows 2016 and later.

  2. To configure FortiSIEM Client (Super or Collector):

    pip install pywinrm

SNMP Configuration
Enabling SNMP on Windows Server 2012R2, Server 2016, Server 2019, Server 2022

SNMP is typically enabled by default on Windows Server 2012R2, Server 2016, and Server 2019. But you must still add FortiSIEM to the hosts that are authorized to accept SNMP packets. First, you should check that SNMP Services have been enabled for your server.

  1. Log in to the Windows 2016 Server where you want to enable SNMP as an administrator.
  2. In the Start menu, select Control Panel.
  3. Under Programs, click Turn Windows features on/off.
  4. The Add Roles and Features Wizard will open automatically.
  5. Select Role-based or feature-based installation. Click Next until the Features option appears.
  6. Under Features, see if SNMP Services is installed.

    If not, check the checkbox before the SNMP Service and click Next to install the service.

  7. From the Start menu, select Services. Go to Services > SNMP Services.
  8. Select and open SNMP Service.
  9. Click the Security tab.
  10. Select Send authentication trap.
  11. Under Accepted communities, make sure there is an entry for public that is set to read-only.
  12. Select Accept SNMP packets from these hosts.
  13. Click Add.
  14. Enter the IP address for your FortiSIEM virtual appliance that will access your device over SNMP.
  15. Click Add.
  16. Click Apply.
  17. Under SNMP Service, click Restart service.
  18. 18. Go to Control Panel > Windows Firewall.
  19. 19. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
  20. 20. Select SNMP Service, and the click OK.
Enabling SNMP on Windows 7 or Windows Server 2008 R2

SNMP is typically enabled by default on Windows Server 2008, but you must still add FortiSIEM to the hosts that are authorized to accept SNMP packets. First you should check that SNMP Services have been enabled for your server.

  1. Log in to the Windows 2008 Server where you want to enable SNMP as an administrator.
  2. In the Start menu, select Control Panel.
  3. Under Programs, click Turn Windows features on/off.
  4. Under Features, see if SNMP Services is installed. 
    If not, click Add Feature, then select SMNP Service and click Next to install the service.
  5. In the Server Manager window, go to Services > SNMP Services.
  6. Select and open SNMP Service.
  7. Click the Security tab. 
  8. Select Send authentication trap
  9. Under Accepted communities, make sure there is an entry for public that is set to read-only.
  10. Select Accept SNMP packets from these hosts.
  11. Click Add.
  12. Enter the IP address for your FortiSIEM virtual appliance that will access your device over SNMP. 
  13. Click Add.
  14. Click Apply.
  15. Under SNMP Service, click Restart service.
  16. 18. Go to Control Panel > Windows Firewall.
  17. 19. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
  18. 20. Select SNMP Service, and the click OK.
Enabling SNMP on Windows Server 2003

SNMP is typically enabled by default on Windows Server 2003, but you must still add FortiSIEM to the hosts that are authorized to accept SNMP packets. First you must make sure that the SNMP Management tool has been enabled for your device. 

  1. In the Start menu, go to Administrative Tools > Services.
  2. Go to Control Panel > Add or Remove Programs.
  3. Click Add/Remove Windows Components.
  4. Select Management and Monitoring Tools and click Details.
    Make sure that Simple Network Management Tool is selected. 
    If it isn't selected, select it, and then click Next to install. 
  5. Go to Start >   Administrative Tools > Services.
  6. Select and open SNMP Service.
  7. Click the Security tab. 
  8. Select Send authentication trap
  9. Under Accepted communities, make sure there is an entry for public that is set to read-only.
  10. Select Accept SNMP packets from these hosts.
  11. Click Add.
  12. Enter the IP address for your FortiSIEM virtual appliance that will access your device over SNMP. 
  13. Click Add.
  14. Click Apply.
  15. Under SNMP Service, click Restart service.
  16. 18. Go to Control Panel > Windows Firewall.
  17. 19. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
  18. 20. Select SNMP Service, and the click OK.
WMI Configuration

These configurations are needed if you are using either WMI or OMI to monitor Windows Servers.

WMI Configuration for Windows 2012, 2012R2, 2016, 2019, 2022

To configure WMI on your device so that FortiSIEM can discover and monitor it, you must create a user who has access to WMI objects on the device. There are two ways to do this:

Creating a Generic User Who Does Not Belong to the Local Administrator Group

Log in to the machine you want to monitor with an administrator account.

Step 1. Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
  1. Go to Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups.
  2. Right-click Users and select New User.
  3. Create a user.
  4. Select this user and right-click to select Properties > Member of tab.
  5. Click Add > Advanced > Find Now.
  6. Select and add the following groups:

    Note: To select multiple groups, hold down the CTRL key and click the desired groups.

    • Distributed COM Users group.
    • Performance Monitor Users group.
    • Remote Desktop Users group.
  7. Click OK to save.
Step 2. Enable DCOM Permissions for the Monitoring Account
  1. Go to Start > Control Panel > Administrative Tools > Component Services > Computers > My Computer.
  2. Right-click My Computer, and then Properties.
  3. Select the COM Security tab, and then under Access Permissions, click Edit Limits.
  4. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to Allowed.
  5. Click OK.
  6. Under Access Permissions, click Edit Default.
  7. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to Allowed. If the Distributed COM Users group and Performance Monitor Users group are not present, then click Add to add these two groups as described in Step 1.
  8. Click OK.
  9. Under Launch and Activation Permissions, click Edit Limits.
  10. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.
  11. Click OK.
  12. Under Launch and Activation Permissions, click Edit Defaults.
  13. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation. If the Distributed COM Users group and Performance Monitor Users group are not present, then click Add to add these two groups as described in Step 1.
  14. Click OK.
Step 3. See the sections on Enabling WMI Privileges and Allowing WMI Access through the Windows Firewall in the Domain Admin User set up instructions for the remaining steps to configure WMI.
Step 4. Configuring Log Monitoring for Non-Administrative User

To configure the non-administrative user to monitor windows event logs, follow the steps below:

  1. Go to Start > Control Panel > Administrative Tools > Active Directory Users and Computers (Computer Management > Local Users and Groups for servers that are not a domain controller).
  2. Right-click the non-admin user and select Properties.
  3. Select the Member of tab.
  4. Select the group Event Log Reader and click Add.
  5. Click Apply.
  6. Click OK to complete the configuration.
  7. The following groups should be applied to the user:
    • Distributed COM Users
    • Domain Users
    • Event Log Reader
Creating a User Who Belongs to the Domain Administrator Group

Log in to the Domain Controller with an administrator account.

Step 1. Enable Remote WMI requests by adding a Monitoring Account to the Domain Administrators Group
  1. Go to Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users.
  2. Right-click Users and select New > User.
  3. Create a user for the @accelops.com domain.

    For example, YJTEST@accelops.com.

  4. Right-click Domain Admins in Users and select Properties.
  5. In the Domain Admins Properties dialog, select the Members tab, and then click Add.
  6. Click Advanced > Find Now, add the Administrator and the user which you created in Step 3.
  7. Click OK to close the User select dialog.
  8. Click OK to close the Domain Admins Properties dialog.
Step 2. Enable the Monitoring Account to Access the Monitored Device

Log in to the machine you want to monitor with an administrator account.

Enable DCOM Permissions for the Monitoring Account 
  1. Go to Start > Control Panel > Administrative Tools > Component Services.
  2. Right-click My Computer, and then select Properties.
  3. Select the COM Security tab, and then under Access Permissions, click Edit Limits.
  4. Find the user you created for the monitoring account, and make sure that user has the permission Allow for both Local Access and Remote Access.
  5. Click OK.
  6. In the COM Security tab, under Access Permissions, click Edit Defaults.
  7. Find the user you created for the monitoring account, and make sure that the user has the permission Allow for both Local Access and Remote Access. If the Distributed COM Users group and Performance Monitor Users group are not present, then click Add to add these two groups as described in Step 1.
  8. Click OK.
  9. In the COM Security tab, under Launch and Activation Permissions, click Edit Limits.
  10. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation. If the Distributed COM Users group and Performance Monitor Users group are not present, then click Add to add these two groups as described in Step 1.
  11. In the COM Security tab, under Launch and Activation Permissions, click Edit Limits.
  12. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation. If the Distributed COM Users group and Performance Monitor Users group are not present, then click Add to add these two groups as described in Step 1.
  13. Click OK.
Enable Account Privileges in WMI

The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.

  1. Go to Start > Control Panel > Administrative Tools > Computer Management > Services and Applications.
  2. Select WMI Control, and then right-click and select Properties.
  3. Select the Security tab.
  4. Expand the Root directory and select CIMV2.
  5. Click Security.
  6. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Enable Account and Remote Enable. If the user is not present, then click Add to add the user you created.
  7. Click Advanced.
  8. Select the user you created for the monitoring account, and then click Edit.
  9. In the Applies onto menu, select This namespace and subnamespaces.
  10. Click OK to close the Permission Entry for CIMV2 dialog.
  11. Click OK to close the Advanced Security Settings for CIMV2 dialog.
  12. In the left-hand navigation, under Services and Applications, select Services.
  13. Select Windows Management Instrumentation, and then click Restart.
Allow WMI through Windows Firewall (Windows Server 2012, 2016, 2019, 2022)
  1. Go to Control Panel > Windows Firewall.
  2. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
  3. Select Windows Management Instrumentation, and the click OK. You can configure FortiSIEM to communicate with your device. For more information, refer to sections "Discovery Settings" and "Setting Credentials" in the User Guide.
Differences Between Administrator and Non-Administrator Account

Windows allows certain WMI classes to be pulled only via Administrator account. The following table shows this clearly.

WMI Class Administrator Non-Administrator
Win32_BIOS Yes No
Win32_ComputerSystem Yes Yes
Win32_LogicalDisk Yes No
Win32_NetworkAdapter Yes Yes
Win32_NetworkAdapterConfiguration Yes Yes
Win32_NTLogEvent Yes Yes
Win32_OperatingSystem Yes Yes
Win32_Process Yes Yes
Win32_Processor Yes Yes
Win32_Product Yes Yes
Win32_QuickFixEngineering Yes No
Win32_Service Yes No
Win32_UserAccount Yes No
win32_Volume Yes Yes
Win32_PerfFormattedData_DHCPServer_DHCPServer Yes Yes
Win32_PerfFormattedData_DNS_DNS Yes Yes
Win32_PerfFormattedData_W3SVC_WebService Yes Yes
Win32_PerfRawData_DirectoryServices_DirectoryServices Yes Yes
Win32_PerfRawData_NTDS_NTDS Yes Yes
Win32_PerfRawData_PerfDisk_LogicalDisk Yes Yes
Win32_PerfRawData_PerfDisk_PhysicalDisk Yes Yes
Win32_PerfRawData_PerfOS_Memory Yes Yes
Win32_PerfRawData_PerfOS_PagingFile Yes Yes
Win32_PerfRawData_PerfOS_Processor Yes Yes
Win32_PerfRawData_PerfProc_Process Yes Yes
Win32_PerfRawData_Tcpip_NetworkInterface Yes Yes
WMI Configuration for Windows 2008 and 2008R2

To configure WMI on your device so that FortiSIEM can discover and monitor it, you must create a user who has access to WMI objects on the device. There are two ways to do this:

Creating a Generic User Who Does Not Belong to the Local Administrator Group

Log in to the machine you want to monitor with an administrator account.

Step 1. Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
  1. Go to Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups.
  2. Right-click Users and select New User.
  3. Create a user.
  4. Select this user and right-click to select Properties > Member of tab.
  5. Select Distributed COM Users and click Add.
  6. Click OK to save. 
    This is the account you must use to set up the Performance Monitor Users group permissions. 
  7. Repeat steps 4 through 6 for the Performance Monitor Users group.
Step 2. Enable DCOM Permissions for the Monitoring Account
  1. Go to Start > Control Panel > Administrative Tools > Component Services.
  2. Right-click My Computer, and then Properties.
  3. Select the COM Security tab, and then under Access Permissions, click Edit Limits.
  4. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to Allowed.
  5. Click OK.
  6. Under Access Permissions, click Edit Default.
  7. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to Allowed.
  8. Click OK.
  9. Under Launch and Activation Permissions, click Edit Limits
  10. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local LaunchRemote LaunchLocal Activation, and Remote Activation.
  11. Click OK
  12. Under Launch and Activation Permissions, click Edit Defaults
  13. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local LaunchRemote LaunchLocal Activation, and Remote Activation.

See the sections on Enabling WMI Privileges and Allowing WMI Access through the Windows Firewall in the Domain Admin User set up instructions for the remaining steps to configure WMI.

Configuring Log Monitoring for Non-Administrative User

To configure the non-administrative user to monitor windows event logs, follow the steps below:

  1. Go to Start > Control Panel > Administrative Tools > Active Directory Users and Computers (Computer Management > Local Users and Groups for servers that are not a domain controller).
  2. Right-click the non-admin user and select Properties.
  3. Select the Member of tab.
  4. Select the group Event Log Reader and click Add.
  5. Click Apply.
  6. Click OK to complete the configuration.

The following groups should be applied to the user:

  • Distributed COM Users
  • Domain Users
  • Event Log Reader
Creating a User Who Belongs to the Domain Administrator Group

Log in to the Domain Controller with an administrator account.

Step 1. Enable Remote WMI Requests by Adding a Monitoring Account to the Domain Administrators Group
  1. Go to Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users.
  2. Right-click Users and select Add User.
  3. Create a user for the @accelops.com domain.
    For example, YJTEST@accelops.com.
  4. Go to Groups, right-click Administrators, and then click Add to Group.
  5. In the Domain Admins Properties dialog, select the Members tab, and then click Add.
  6. For Enter the object names to select, enter the user you created in step 3. 
  7. Click OK to close the Domain Admins Properties dialog.
  8. Click OK
Step 2. Enable the Monitoring Account to Access the Monitored Device

Log in to the machine you want to monitor with an administrator account.

Enable DCOM Permissions for the Monitoring Account 
  1. Go to Start > Control Panel > Administrative Tools > Component Services.
  2. Right-click My Computer, and then select Properties.
  3. Select the Com Security tab, and then under Access Permissions, click Edit Limits
  4. Find the user you created for the monitoring account, and make sure that user has the permission Allow for both Local Access and Remote Access
  5. Click OK.
  6. In the Com Security tab, under Access Permissions, click Edit Defaults
  7. Find the user you created for the monitoring account, and make sure that user has the permission Allow for both Local Access and Remote Access
  8. Click OK.
  9. In the Com Security tab, under Launch and Activation Permissions, click Edit Limits
  10. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.
  11. In the Com Security tab, under Launch and Activation Permissions, click Edit Defaults
  12. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local LaunchRemote LaunchLocal Activation, and Remote Activation.
Enable Account Privileges in WMI

The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device. 

  1. Go to Start > Control Panel > Administrative Tools > Computer Management > Services and Applications.
  2. Select WMI Control, and then right-click and select Properties.
  3. Select the Security tab.
  4. Expand the Root directory and select CIMV2.
  5. Click Security
  6. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Enable Account and Remote Enable.
  7. Click Advanced.
  8. Select the user you created for the monitoring account, and then click Edit.
  9. In the Apply onto menu, select This namespace and subnamespaces
  10. Click OK to close the Permission Entry for CIMV2 dialog. 
  11. Click OK to close the Advanced Security Settings for CIMV2 dialog. 
  12. In the left-hand navigation, under Services and Applications, select Services
  13. Select Windows Management Instrumentation, and then click Restart.
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
  1. In the Start menu, select Run
  2. Run gpedit.msc.
  3. Go to Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections > Windows Firewall
  4. Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
  5. Select Windows Firewall: Allow remote administration exception.
  6. Run cmd.exe and enter these commands:
    netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135"netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP 
    
  7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
  1. Go to Control Panel > Windows Firewall.
  2. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
  3. Select Windows Management Instrumentation, and the click OK.You can configure FortiSIEM to communicate with your device. For more information, refer to sections "Discovery Settings" and "Setting Credentials" in the User Guide.
Differences Between Administrator and Non-Administrator Account

Windows allows certain WMI classes to be pulled only via Administrator account. The following table shows this clearly.

WMI Class Administrator Non-Administrator
Win32_BIOS Yes No
Win32_ComputerSystem Yes Yes
Win32_LogicalDisk Yes No
Win32_NetworkAdapter Yes Yes
Win32_NetworkAdapterConfiguration Yes Yes
Win32_NTLogEvent Yes Yes
Win32_OperatingSystem Yes Yes
Win32_Process Yes Yes
Win32_Processor Yes Yes
Win32_Product Yes Yes
Win32_QuickFixEngineering Yes No
Win32_Service Yes No
Win32_UserAccount Yes No
win32_Volume Yes Yes
Win32_PerfFormattedData_DHCPServer_DHCPServer Yes Yes
Win32_PerfFormattedData_DNS_DNS Yes Yes
Win32_PerfFormattedData_W3SVC_WebService Yes Yes
Win32_PerfRawData_DirectoryServices_DirectoryServices Yes Yes
Win32_PerfRawData_NTDS_NTDS Yes Yes
Win32_PerfRawData_PerfDisk_LogicalDisk Yes Yes
Win32_PerfRawData_PerfDisk_PhysicalDisk Yes Yes
Win32_PerfRawData_PerfOS_Memory Yes Yes
Win32_PerfRawData_PerfOS_PagingFile Yes Yes
Win32_PerfRawData_PerfOS_Processor Yes Yes
Win32_PerfRawData_PerfProc_Process Yes Yes
Win32_PerfRawData_Tcpip_NetworkInterface Yes Yes
Windows Agent Configuration

For information on configuring Windows Agent, see Windows Agent Installation Guide.

Syslog Configuration

See the Windows Agent Installation Guide for information on configuring the sending of syslog from your device to FortiSIEM.

Sample Windows Server Syslog

<108>2014 Dec 17 15:05:47 CorreLog_Win_Agent 1NDCITVWCVLT05.tsi.lan Login Monitor: Local Console User Login: User Name: weighalll-admin
Configuring the Security Audit Logging Policy

Because Windows generates a lot of security logs, you should specify the categories of events that you want logged and available for monitoring by FortiSIEM.

  1. Log in the machine where you want to configure the policy as an administrator.
  2. Go to Programs > Administrative Tools > Local Security Policy.
  3. Expand Local Policies and select Audit Policy.
    You will see the current security audit settings. 
  4. Select a policy and edit the Local Security Settings for the events you want audited. Recommended settings are:
  5. Policy Description Settings
    Audit account logon events and Audit logon events For auditing logon activity Select Success and Failure
    Audit object access events For auditing access to files and folders. There is an additional configuration requirement for specifying which files and folders, users and user actions will be audited. See the next section, Configuring the File Auditing Policy. Select Success and Failure
    Audit system events Includes system up/down messages
Configuring the File Auditing Policy

When you enable the policy to audit object access events, you also must specify which files, folders, and user actions will be logged. You should be very specific with these settings, and set their scope to be as narrow as possible to avoid excessive logging. For this reason you should also specify system-level folders for auditing. 

  1. Log in the machine where you want to set the policy with administrator privileges.
    On a domain computer, a Domain administrator account is needed
  2. Open Windows Explorer, select the file you want to set the auditing policy for, right-click on it, and select Properties.
  3. In the Security tab, click Advanced.
  4. Select the Auditing tab, and then click Add.
    This button is labeled Edit in Windows 2008.
  5. In the Select User or Group dialog, click Advanced, and then find and select the users whose access to this file you want to monitor.
  6. Click OK when you are done adding users. 
  7. In the Permissions tab, set the permissions for each user you added.

The configuration is now complete. Windows will generate audit events when the users you specified take the actions specified on the files or folders for which you set the audit policies.

Disabling Audit Token Right Adjusted Success Events

As per Microsoft, it is recommended to Disable "Success" auditing for "Audit Token Right Adjusted".

Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703#security-monitoring-recommendations.

By enabling "Success Auditing" for Audit Token Right Adjusted (Detailed Tracking ), 800+ (4703) events can be generated in a second, resulting in this high volume event impacting system performance.

Complete these steps to disable "Success" for "Audit Token Right Adjusted".

  1. Log in, with administrator privileges, to the machine where you want to set the policy.

    On a domain computer, you must have a Domain administrator account.

  2. Go to Programs > Administrative Tools > Local Security Policy.
  3. Expand to Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object > Detailed Tracking.
  4. Go to the Detailed Tracking subcategory, and select Audit Token Right Adjusted.
  5. Double click Audit Token Right Adjusted, select the Configure the following audit events: checkbox.
  6. Uncheck the Success checkbox if needed to disable.
  7. Click Apply.
Configuring Print Log

FortiSIEM supports pull Windows print log from Windows agent. To configure, take the following steps.

Enabling Logging Print Log after WMI Configuration

After WMI Configuration is completed, enable logging print log by taking the following steps.

  1. Open the Event Viewer window and navigate to Applications and Services Logs > Microsoft > Windows > PrintService.
  2. Click Operational.
  3. Right click, and select Properties.
  4. Add a checkmark to the Enable logging checkbox.
  5. Click Apply.
  6. Click OK.

    All print activities will be logged by Event Viewer through WMI. Event logs can be viewed under Applications and Services Logs -> Microsoft -> Windows -> PrintService -> Operational.
Setup in FortiSIEM

Take the following steps to access print logs in FortiSIEM.

  1. Log on to your Windows Server and navigate to Event viewer > App and Service logs > Microsoft > windows > printservice > properties.
  2. Copy the full name from log properties.
  3. Log onto FortiSIEM in super global.
  4. Navigate to ADMIN > Setup > Windows Agent.
  5. Under Windows Agent Monitor Templates, click New to create a Monitor Template.
  6. In the Name field, enter a name for the template.
  7. Click the Event tab.
  8. In the Event Log row, click on New.
  9. In the Type drop-down list, select Other.
  10. In the Event Name field, enter/paste the full name from step 2.
  11. Click < Save.
  12. Click Save.
  13. Under Host to Template Associations, create a host to template association by clicking New.
  14. In the Name field, enter a name.
  15. Choose an organization.
  16. Select the monitor template you created through steps 5-12.
  17. Select a collector.
  18. Click Save.
  19. Click Apply.

FortiSIEM now automatically parses events received via WMI or FortiSIEM Windows Agent.

 

Setting Access Credentials on FortiSIEM

 

SNMP, Telnet and SSH Access Credentials

See Access Credentials.

LDAP, LDAPS, LDAP Start TLS / OpenLDAP Access Credentials
Settings Value
Name <set name>
Device Type Microsoft Windows Server *
Access Protocol LDAP / LDAPS / LDAP Start TLS
Used For OpenLDAP
Server Port 389 for LDAP, LDAP Start TLS; 636 for LDAPS
Base DN Specify the root of the LDAP tree as the Base DN. For example: dc=companyABC,dc=com
Password Config See Password Configuration
User Name For user discoveries from an OpenLDAP directory, specify the full DN as the user name. For example: uid=jdoe,ou=hr,ou=unit,dc=companyABC,dc=com
Password Password of the user able to access this system

 

LDAP, LDAPS, LDAP Start TLS / Microsoft Active Directory Access Credentials
Settings Value
Name <set name>
Device Type Microsoft Windows Server *
Access Protocol LDAP / LDAPS / LDAP Start TLS
Used For Microsoft Active Directory
Server Port 389 for LDAP, LDAP Start TLS; 636 for LDAPS
Base DN Specify the root of the LDAP tree as the Base DN. For example: dc=companyABC,dc=com
NetBIOS/Domain The domain name or NetBIOS name attribute
Password Config See Password Configuration
User Name For Microsoft Active Directory, the user name can be just the login name.
Password Password of the user able to access this system

 

WMI Access Credentials
Settings Value
Name <set name>
Device Type Microsoft Windows Server *
Access Protocol WMI
Pull Interval 1 minute
NetBIOS/Domain The domain name or NetBIOS name attribute
Password Config See Password Configuration
User Name Name of the user able to access this system
Password Password of the user able to access this system

 

OMI Access Credentials
Settings Value
Name <set name>
Device Type Microsoft Windows Server *
Access Protocol OMI
Pull Interval 1 minute
NetBIOS/Domain The domain name or NetBIOS name attribute
Password Config See Password Configuration
User Name Name of the user able to access this system
Password Password of the user able to access this system

Microsoft Windows Server

Support Added: FortiSIEM 4.7.2

Last Modification: FortiSIEM 6.3.3

Supported Versions/OS

  • Windows 2008 and 2008 R2 (via SNMP, WMI, OMI, Agent)
  • Windows 2012 and 2012 R2 (via SNMP, WMI, OMI, Agent)
  • Windows 2016 (via SNMP, WMI, OMI, Agent)
  • Windows 2019 (via SNMP, WMI, OMI, Agent)
  • Windows 2022 (via SNMP, OMI, Agent)

    Note: Starting with FortiSIEM 6.3.3, you can use Open Management Initiative (OMI) to discover and monitor and collect logs from Windows Servers. OMI uses a different API to collect data from the same WMI classes as WMI. So no changes to the Windows Server side is required to accommodate the OMI based communication. In other words, Windows Servers have to be configured identically for both WMI and OMI, and same restrictions apply for both.

 

Vendor: Microsoft

Product Information: https://www.microsoft.com/en-us/windows-server

 

What is Discovered and Monitored

Metrics in bold are unique to Microsoft Windows Server monitoring.

Installed Software Monitored via SNMP

Although information about installed software is available via both SNMP and WMI/OMI, FortiSIEM uses SNMP to obtain installed software information to avoid an issue in Microsoft's WMI implementation for the Win32_Product WMI class - see Microsoft KB 974524 article for more information. Because of this bug, WMI/OMI calls to the Win32_Product class create many unnecessary Windows event log messages indicating that the Windows Installer has reconfigured all installed applications. 

Winexe execution and its effect

FortiSIEM uses the winexe command during discovery and monitoring of Windows servers for the following purposes

  1. Windows domain controller diagnostic (dcdiag) and replication monitoring (repadmin /replsummary)
  2. HyperV Performance Monitoring
  3. Windows Custom performance monitoring – to run a command (e.g. powershell) remotely on windows systems

Note: Running the winexe command remotely will automatically install the winexesvc command on the windows server.

Protocol

Information Discovered

Metrics collected

Used for

SNMP Host name, generic hardware (cpu, memory, network interface, disk), software (operating system version, installed software, running processes, open TCP/UDP ports) Uptime, Overall CPU/Memory/Network Interface/Disk space utilization, Network Interface Errors, Running Process Count, Installed Software change, Running process CPU/memory utilization, Running process start/stop, TCP/UDP port up/down Performance Monitoring
SNMP Vendor specific server hardware (hardware model, hardware serial number, fans, power supply, disk, raid battery). Currently supported vendors include HP and Dell  Hardware module status - fan, power supply, thermal status, battery, disk, memory . Currently supported vendors include HP and Dell

WMI or OMI Win32_ComputerSystem: Host name, OS Win32_WindowsProductActivation: OS Serial Number Win32_OperatingSystem: Memory, Uptime Win32_BIOS: Bios Win32_Processor: CPU Win32_LogicalDisk: Disk info Win32_NetworkAdapterConfiguration: network interface Win32_Service: Services Win32_Process: Running processes Win32_QuickFixEngineering: Installed Patches Win32_OperatingSystem: Uptime Win32_PerfRawData_PerfOS_Processor: Detailed CPU utilization Win32_PerfRawData_PerfOS_Memory: Memory utilization, paging/swapping metrics Win32_LogicalDisk: Disk space utilization Win32_PerfRawData_PerfOS_PagingFile: Paging file utilization Win32_PerfRawData_PerfDisk_LogicalDisk: Disk I/O metrics Win32_PerfRawData_Tcpip_NetworkInterface: Network Interface utilization Win32_Service: Running process uptime, start/stop status Win32_Process, Win32_PerfRawData_PerfProc_Process: Process CPU/memory/I/O utilization Performance Monitoring
WMI or OMI

Security, Application and System Event Logs  including logon, file/folder edits, network traffic (Win32_NTLogEvent) Security and Compliance
Snare agent Security, Application and System Event Logs  including logon, file/folder edits, network traffic (Win32_NTLogEvent) Security and Compliance
Correlog agent Security, Application and System Event Logs ncluding logon, file/folder edits, network traffic (Win32_NTLogEvent) Security and Compliance
FortiSIEM Agent Security, Application and System Event Logs, DNS, DHCP, IIS, DFS logs, Custom log files, File Integrity Monitoring, Registry Change Monitoring, Installed Software Change Monitoring, WMI and Powershell output monitoring  Security and Compliance

Windows Server Monitoring Summary

Log Collection Features

WMI (Windows Mgmt Instrumentation)

FortiSIEM Windows Agent
Security, Application, System Event Logs Yes Yes
File/Folder Edits Yes Yes
File Integrity Monitoring (FIM) No Yes
IIS Audit Logs No Yes
DNS Analytical Logs No Yes
Detailed DHCP Audit Logging No Yes
Support for all Windows Log Channels No Yes
Custom Log Sources No Yes

Windows Event Collector (WEC) Support

No

Yes

Sysmon Event Support

No

Yes

Registry Change Monitoring

No

Yes

Installed Software Change Monitoring

No

Yes

WMI and Powershell Output Monitoring

No

Yes

Supports UEBA Telemetry Data

No

Yes

Performance Features

WMI (Windows Mgmt Instrumentation)

FortiSIEM Windows Agent

Scalable for Large Environments

No

Yes

EPS Performance

100 EPS max

5K EPS

Performance Monitoring

Yes

No

Administrative Features

WMI (Windows Mgmt Instrumentation)

FortiSIEM Windows Agent

Simplified Network Policies

No (TCP 135,1024-65535 inbound)

Yes (443 outbound)

Requires Domain or Local Service Account

Yes

No

Requires Install on Server or Workstation

No

Yes

FIPS Compliant Capable

No

Yes

Log Buffering Upon Connectivity Loss

No

Yes

Supports On and Off Network Monitoring

No

Yes

Secure Log Transmission

Yes

Yes

Event Types

In ADMIN > Device Support > Event Types, search for "windows server" to see the event types associated with this application or device. 

Rules

In RESOURCES > Rules, search for "windows server" in the main content panel Search... field to see the rules associated with this application or device. 

Reports

In RESOURCES > Reports, search for "windows server" in the main content panel Search... field to see the reports associated with this application or device. 

Windows Server Configuration

WinRM Configuration

WinRM is used for some FortiSIEM Remediation actions. If Windows Remediation actions are not used in FortiSIEM, this configuration step is not required.

Enable WinRM and Set Authentication

Use the commands below to enable WinRM and set authentication on the target Windows Servers:

  1. To configure Windows Server:

    winrm quickconfig

    winrm set winrm/config/service/auth ‘@{Basic="true"}’

    winrm set winrm/config/service ‘@{AllowUnencrypted="true"}’

    winrm enumerate winrm/config/listener

    Notes:

    • If HTTPS is not enabled, then open Windows PowerShell console as an administrator, and run the following commands.

    New-SelfSignedCertificate -Subject 'CN=<windows host name>' -TextExtension '2.5.29.37={text}1.3.6.1.5.5.7.3.1'

    winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname="<windows host name>"; CertificateThumbprint="<thumbprint received by New-Self Signed Certificate>"}

    winrm quickconfig -transport:https

    winrm enumerate winrm/config/listener

    • Single quotes are needed for Windows 2016 and later.

  2. To configure FortiSIEM Client (Super or Collector):

    pip install pywinrm

SNMP Configuration
Enabling SNMP on Windows Server 2012R2, Server 2016, Server 2019, Server 2022

SNMP is typically enabled by default on Windows Server 2012R2, Server 2016, and Server 2019. But you must still add FortiSIEM to the hosts that are authorized to accept SNMP packets. First, you should check that SNMP Services have been enabled for your server.

  1. Log in to the Windows 2016 Server where you want to enable SNMP as an administrator.
  2. In the Start menu, select Control Panel.
  3. Under Programs, click Turn Windows features on/off.
  4. The Add Roles and Features Wizard will open automatically.
  5. Select Role-based or feature-based installation. Click Next until the Features option appears.
  6. Under Features, see if SNMP Services is installed.

    If not, check the checkbox before the SNMP Service and click Next to install the service.

  7. From the Start menu, select Services. Go to Services > SNMP Services.
  8. Select and open SNMP Service.
  9. Click the Security tab.
  10. Select Send authentication trap.
  11. Under Accepted communities, make sure there is an entry for public that is set to read-only.
  12. Select Accept SNMP packets from these hosts.
  13. Click Add.
  14. Enter the IP address for your FortiSIEM virtual appliance that will access your device over SNMP.
  15. Click Add.
  16. Click Apply.
  17. Under SNMP Service, click Restart service.
  18. 18. Go to Control Panel > Windows Firewall.
  19. 19. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
  20. 20. Select SNMP Service, and the click OK.
Enabling SNMP on Windows 7 or Windows Server 2008 R2

SNMP is typically enabled by default on Windows Server 2008, but you must still add FortiSIEM to the hosts that are authorized to accept SNMP packets. First you should check that SNMP Services have been enabled for your server.

  1. Log in to the Windows 2008 Server where you want to enable SNMP as an administrator.
  2. In the Start menu, select Control Panel.
  3. Under Programs, click Turn Windows features on/off.
  4. Under Features, see if SNMP Services is installed. 
    If not, click Add Feature, then select SMNP Service and click Next to install the service.
  5. In the Server Manager window, go to Services > SNMP Services.
  6. Select and open SNMP Service.
  7. Click the Security tab. 
  8. Select Send authentication trap
  9. Under Accepted communities, make sure there is an entry for public that is set to read-only.
  10. Select Accept SNMP packets from these hosts.
  11. Click Add.
  12. Enter the IP address for your FortiSIEM virtual appliance that will access your device over SNMP. 
  13. Click Add.
  14. Click Apply.
  15. Under SNMP Service, click Restart service.
  16. 18. Go to Control Panel > Windows Firewall.
  17. 19. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
  18. 20. Select SNMP Service, and the click OK.
Enabling SNMP on Windows Server 2003

SNMP is typically enabled by default on Windows Server 2003, but you must still add FortiSIEM to the hosts that are authorized to accept SNMP packets. First you must make sure that the SNMP Management tool has been enabled for your device. 

  1. In the Start menu, go to Administrative Tools > Services.
  2. Go to Control Panel > Add or Remove Programs.
  3. Click Add/Remove Windows Components.
  4. Select Management and Monitoring Tools and click Details.
    Make sure that Simple Network Management Tool is selected. 
    If it isn't selected, select it, and then click Next to install. 
  5. Go to Start >   Administrative Tools > Services.
  6. Select and open SNMP Service.
  7. Click the Security tab. 
  8. Select Send authentication trap
  9. Under Accepted communities, make sure there is an entry for public that is set to read-only.
  10. Select Accept SNMP packets from these hosts.
  11. Click Add.
  12. Enter the IP address for your FortiSIEM virtual appliance that will access your device over SNMP. 
  13. Click Add.
  14. Click Apply.
  15. Under SNMP Service, click Restart service.
  16. 18. Go to Control Panel > Windows Firewall.
  17. 19. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
  18. 20. Select SNMP Service, and the click OK.
WMI Configuration

These configurations are needed if you are using either WMI or OMI to monitor Windows Servers.

WMI Configuration for Windows 2012, 2012R2, 2016, 2019, 2022

To configure WMI on your device so that FortiSIEM can discover and monitor it, you must create a user who has access to WMI objects on the device. There are two ways to do this:

Creating a Generic User Who Does Not Belong to the Local Administrator Group

Log in to the machine you want to monitor with an administrator account.

Step 1. Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
  1. Go to Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups.
  2. Right-click Users and select New User.
  3. Create a user.
  4. Select this user and right-click to select Properties > Member of tab.
  5. Click Add > Advanced > Find Now.
  6. Select and add the following groups:

    Note: To select multiple groups, hold down the CTRL key and click the desired groups.

    • Distributed COM Users group.
    • Performance Monitor Users group.
    • Remote Desktop Users group.
  7. Click OK to save.
Step 2. Enable DCOM Permissions for the Monitoring Account
  1. Go to Start > Control Panel > Administrative Tools > Component Services > Computers > My Computer.
  2. Right-click My Computer, and then Properties.
  3. Select the COM Security tab, and then under Access Permissions, click Edit Limits.
  4. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to Allowed.
  5. Click OK.
  6. Under Access Permissions, click Edit Default.
  7. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to Allowed. If the Distributed COM Users group and Performance Monitor Users group are not present, then click Add to add these two groups as described in Step 1.
  8. Click OK.
  9. Under Launch and Activation Permissions, click Edit Limits.
  10. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.
  11. Click OK.
  12. Under Launch and Activation Permissions, click Edit Defaults.
  13. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation. If the Distributed COM Users group and Performance Monitor Users group are not present, then click Add to add these two groups as described in Step 1.
  14. Click OK.
Step 3. See the sections on Enabling WMI Privileges and Allowing WMI Access through the Windows Firewall in the Domain Admin User set up instructions for the remaining steps to configure WMI.
Step 4. Configuring Log Monitoring for Non-Administrative User

To configure the non-administrative user to monitor windows event logs, follow the steps below:

  1. Go to Start > Control Panel > Administrative Tools > Active Directory Users and Computers (Computer Management > Local Users and Groups for servers that are not a domain controller).
  2. Right-click the non-admin user and select Properties.
  3. Select the Member of tab.
  4. Select the group Event Log Reader and click Add.
  5. Click Apply.
  6. Click OK to complete the configuration.
  7. The following groups should be applied to the user:
    • Distributed COM Users
    • Domain Users
    • Event Log Reader
Creating a User Who Belongs to the Domain Administrator Group

Log in to the Domain Controller with an administrator account.

Step 1. Enable Remote WMI requests by adding a Monitoring Account to the Domain Administrators Group
  1. Go to Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users.
  2. Right-click Users and select New > User.
  3. Create a user for the @accelops.com domain.

    For example, YJTEST@accelops.com.

  4. Right-click Domain Admins in Users and select Properties.
  5. In the Domain Admins Properties dialog, select the Members tab, and then click Add.
  6. Click Advanced > Find Now, add the Administrator and the user which you created in Step 3.
  7. Click OK to close the User select dialog.
  8. Click OK to close the Domain Admins Properties dialog.
Step 2. Enable the Monitoring Account to Access the Monitored Device

Log in to the machine you want to monitor with an administrator account.

Enable DCOM Permissions for the Monitoring Account 
  1. Go to Start > Control Panel > Administrative Tools > Component Services.
  2. Right-click My Computer, and then select Properties.
  3. Select the COM Security tab, and then under Access Permissions, click Edit Limits.
  4. Find the user you created for the monitoring account, and make sure that user has the permission Allow for both Local Access and Remote Access.
  5. Click OK.
  6. In the COM Security tab, under Access Permissions, click Edit Defaults.
  7. Find the user you created for the monitoring account, and make sure that the user has the permission Allow for both Local Access and Remote Access. If the Distributed COM Users group and Performance Monitor Users group are not present, then click Add to add these two groups as described in Step 1.
  8. Click OK.
  9. In the COM Security tab, under Launch and Activation Permissions, click Edit Limits.
  10. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation. If the Distributed COM Users group and Performance Monitor Users group are not present, then click Add to add these two groups as described in Step 1.
  11. In the COM Security tab, under Launch and Activation Permissions, click Edit Limits.
  12. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation. If the Distributed COM Users group and Performance Monitor Users group are not present, then click Add to add these two groups as described in Step 1.
  13. Click OK.
Enable Account Privileges in WMI

The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.

  1. Go to Start > Control Panel > Administrative Tools > Computer Management > Services and Applications.
  2. Select WMI Control, and then right-click and select Properties.
  3. Select the Security tab.
  4. Expand the Root directory and select CIMV2.
  5. Click Security.
  6. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Enable Account and Remote Enable. If the user is not present, then click Add to add the user you created.
  7. Click Advanced.
  8. Select the user you created for the monitoring account, and then click Edit.
  9. In the Applies onto menu, select This namespace and subnamespaces.
  10. Click OK to close the Permission Entry for CIMV2 dialog.
  11. Click OK to close the Advanced Security Settings for CIMV2 dialog.
  12. In the left-hand navigation, under Services and Applications, select Services.
  13. Select Windows Management Instrumentation, and then click Restart.
Allow WMI through Windows Firewall (Windows Server 2012, 2016, 2019, 2022)
  1. Go to Control Panel > Windows Firewall.
  2. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
  3. Select Windows Management Instrumentation, and the click OK. You can configure FortiSIEM to communicate with your device. For more information, refer to sections "Discovery Settings" and "Setting Credentials" in the User Guide.
Differences Between Administrator and Non-Administrator Account

Windows allows certain WMI classes to be pulled only via Administrator account. The following table shows this clearly.

WMI Class Administrator Non-Administrator
Win32_BIOS Yes No
Win32_ComputerSystem Yes Yes
Win32_LogicalDisk Yes No
Win32_NetworkAdapter Yes Yes
Win32_NetworkAdapterConfiguration Yes Yes
Win32_NTLogEvent Yes Yes
Win32_OperatingSystem Yes Yes
Win32_Process Yes Yes
Win32_Processor Yes Yes
Win32_Product Yes Yes
Win32_QuickFixEngineering Yes No
Win32_Service Yes No
Win32_UserAccount Yes No
win32_Volume Yes Yes
Win32_PerfFormattedData_DHCPServer_DHCPServer Yes Yes
Win32_PerfFormattedData_DNS_DNS Yes Yes
Win32_PerfFormattedData_W3SVC_WebService Yes Yes
Win32_PerfRawData_DirectoryServices_DirectoryServices Yes Yes
Win32_PerfRawData_NTDS_NTDS Yes Yes
Win32_PerfRawData_PerfDisk_LogicalDisk Yes Yes
Win32_PerfRawData_PerfDisk_PhysicalDisk Yes Yes
Win32_PerfRawData_PerfOS_Memory Yes Yes
Win32_PerfRawData_PerfOS_PagingFile Yes Yes
Win32_PerfRawData_PerfOS_Processor Yes Yes
Win32_PerfRawData_PerfProc_Process Yes Yes
Win32_PerfRawData_Tcpip_NetworkInterface Yes Yes
WMI Configuration for Windows 2008 and 2008R2

To configure WMI on your device so that FortiSIEM can discover and monitor it, you must create a user who has access to WMI objects on the device. There are two ways to do this:

Creating a Generic User Who Does Not Belong to the Local Administrator Group

Log in to the machine you want to monitor with an administrator account.

Step 1. Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group
  1. Go to Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups.
  2. Right-click Users and select New User.
  3. Create a user.
  4. Select this user and right-click to select Properties > Member of tab.
  5. Select Distributed COM Users and click Add.
  6. Click OK to save. 
    This is the account you must use to set up the Performance Monitor Users group permissions. 
  7. Repeat steps 4 through 6 for the Performance Monitor Users group.
Step 2. Enable DCOM Permissions for the Monitoring Account
  1. Go to Start > Control Panel > Administrative Tools > Component Services.
  2. Right-click My Computer, and then Properties.
  3. Select the COM Security tab, and then under Access Permissions, click Edit Limits.
  4. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to Allowed.
  5. Click OK.
  6. Under Access Permissions, click Edit Default.
  7. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to Allowed.
  8. Click OK.
  9. Under Launch and Activation Permissions, click Edit Limits
  10. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local LaunchRemote LaunchLocal Activation, and Remote Activation.
  11. Click OK
  12. Under Launch and Activation Permissions, click Edit Defaults
  13. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local LaunchRemote LaunchLocal Activation, and Remote Activation.

See the sections on Enabling WMI Privileges and Allowing WMI Access through the Windows Firewall in the Domain Admin User set up instructions for the remaining steps to configure WMI.

Configuring Log Monitoring for Non-Administrative User

To configure the non-administrative user to monitor windows event logs, follow the steps below:

  1. Go to Start > Control Panel > Administrative Tools > Active Directory Users and Computers (Computer Management > Local Users and Groups for servers that are not a domain controller).
  2. Right-click the non-admin user and select Properties.
  3. Select the Member of tab.
  4. Select the group Event Log Reader and click Add.
  5. Click Apply.
  6. Click OK to complete the configuration.

The following groups should be applied to the user:

  • Distributed COM Users
  • Domain Users
  • Event Log Reader
Creating a User Who Belongs to the Domain Administrator Group

Log in to the Domain Controller with an administrator account.

Step 1. Enable Remote WMI Requests by Adding a Monitoring Account to the Domain Administrators Group
  1. Go to Start > Control Pane > Administrative Tools > Active Directory Users and Computers > Users.
  2. Right-click Users and select Add User.
  3. Create a user for the @accelops.com domain.
    For example, YJTEST@accelops.com.
  4. Go to Groups, right-click Administrators, and then click Add to Group.
  5. In the Domain Admins Properties dialog, select the Members tab, and then click Add.
  6. For Enter the object names to select, enter the user you created in step 3. 
  7. Click OK to close the Domain Admins Properties dialog.
  8. Click OK
Step 2. Enable the Monitoring Account to Access the Monitored Device

Log in to the machine you want to monitor with an administrator account.

Enable DCOM Permissions for the Monitoring Account 
  1. Go to Start > Control Panel > Administrative Tools > Component Services.
  2. Right-click My Computer, and then select Properties.
  3. Select the Com Security tab, and then under Access Permissions, click Edit Limits
  4. Find the user you created for the monitoring account, and make sure that user has the permission Allow for both Local Access and Remote Access
  5. Click OK.
  6. In the Com Security tab, under Access Permissions, click Edit Defaults
  7. Find the user you created for the monitoring account, and make sure that user has the permission Allow for both Local Access and Remote Access
  8. Click OK.
  9. In the Com Security tab, under Launch and Activation Permissions, click Edit Limits
  10. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.
  11. In the Com Security tab, under Launch and Activation Permissions, click Edit Defaults
  12. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local LaunchRemote LaunchLocal Activation, and Remote Activation.
Enable Account Privileges in WMI

The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device. 

  1. Go to Start > Control Panel > Administrative Tools > Computer Management > Services and Applications.
  2. Select WMI Control, and then right-click and select Properties.
  3. Select the Security tab.
  4. Expand the Root directory and select CIMV2.
  5. Click Security
  6. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Enable Account and Remote Enable.
  7. Click Advanced.
  8. Select the user you created for the monitoring account, and then click Edit.
  9. In the Apply onto menu, select This namespace and subnamespaces
  10. Click OK to close the Permission Entry for CIMV2 dialog. 
  11. Click OK to close the Advanced Security Settings for CIMV2 dialog. 
  12. In the left-hand navigation, under Services and Applications, select Services
  13. Select Windows Management Instrumentation, and then click Restart.
Allow WMI to Connect Through the Windows Firewall (Windows 2003)
  1. In the Start menu, select Run
  2. Run gpedit.msc.
  3. Go to Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections > Windows Firewall
  4. Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
  5. Select Windows Firewall: Allow remote administration exception.
  6. Run cmd.exe and enter these commands:
    netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135"netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP 
    
  7. Restart the server.
Allow WMI through Windows Firewall (Windows Server 2008, 2012)
  1. Go to Control Panel > Windows Firewall.
  2. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
  3. Select Windows Management Instrumentation, and the click OK.You can configure FortiSIEM to communicate with your device. For more information, refer to sections "Discovery Settings" and "Setting Credentials" in the User Guide.
Differences Between Administrator and Non-Administrator Account

Windows allows certain WMI classes to be pulled only via Administrator account. The following table shows this clearly.

WMI Class Administrator Non-Administrator
Win32_BIOS Yes No
Win32_ComputerSystem Yes Yes
Win32_LogicalDisk Yes No
Win32_NetworkAdapter Yes Yes
Win32_NetworkAdapterConfiguration Yes Yes
Win32_NTLogEvent Yes Yes
Win32_OperatingSystem Yes Yes
Win32_Process Yes Yes
Win32_Processor Yes Yes
Win32_Product Yes Yes
Win32_QuickFixEngineering Yes No
Win32_Service Yes No
Win32_UserAccount Yes No
win32_Volume Yes Yes
Win32_PerfFormattedData_DHCPServer_DHCPServer Yes Yes
Win32_PerfFormattedData_DNS_DNS Yes Yes
Win32_PerfFormattedData_W3SVC_WebService Yes Yes
Win32_PerfRawData_DirectoryServices_DirectoryServices Yes Yes
Win32_PerfRawData_NTDS_NTDS Yes Yes
Win32_PerfRawData_PerfDisk_LogicalDisk Yes Yes
Win32_PerfRawData_PerfDisk_PhysicalDisk Yes Yes
Win32_PerfRawData_PerfOS_Memory Yes Yes
Win32_PerfRawData_PerfOS_PagingFile Yes Yes
Win32_PerfRawData_PerfOS_Processor Yes Yes
Win32_PerfRawData_PerfProc_Process Yes Yes
Win32_PerfRawData_Tcpip_NetworkInterface Yes Yes
Windows Agent Configuration

For information on configuring Windows Agent, see Windows Agent Installation Guide.

Syslog Configuration

See the Windows Agent Installation Guide for information on configuring the sending of syslog from your device to FortiSIEM.

Sample Windows Server Syslog

<108>2014 Dec 17 15:05:47 CorreLog_Win_Agent 1NDCITVWCVLT05.tsi.lan Login Monitor: Local Console User Login: User Name: weighalll-admin
Configuring the Security Audit Logging Policy

Because Windows generates a lot of security logs, you should specify the categories of events that you want logged and available for monitoring by FortiSIEM.

  1. Log in the machine where you want to configure the policy as an administrator.
  2. Go to Programs > Administrative Tools > Local Security Policy.
  3. Expand Local Policies and select Audit Policy.
    You will see the current security audit settings. 
  4. Select a policy and edit the Local Security Settings for the events you want audited. Recommended settings are:
  5. Policy Description Settings
    Audit account logon events and Audit logon events For auditing logon activity Select Success and Failure
    Audit object access events For auditing access to files and folders. There is an additional configuration requirement for specifying which files and folders, users and user actions will be audited. See the next section, Configuring the File Auditing Policy. Select Success and Failure
    Audit system events Includes system up/down messages
Configuring the File Auditing Policy

When you enable the policy to audit object access events, you also must specify which files, folders, and user actions will be logged. You should be very specific with these settings, and set their scope to be as narrow as possible to avoid excessive logging. For this reason you should also specify system-level folders for auditing. 

  1. Log in the machine where you want to set the policy with administrator privileges.
    On a domain computer, a Domain administrator account is needed
  2. Open Windows Explorer, select the file you want to set the auditing policy for, right-click on it, and select Properties.
  3. In the Security tab, click Advanced.
  4. Select the Auditing tab, and then click Add.
    This button is labeled Edit in Windows 2008.
  5. In the Select User or Group dialog, click Advanced, and then find and select the users whose access to this file you want to monitor.
  6. Click OK when you are done adding users. 
  7. In the Permissions tab, set the permissions for each user you added.

The configuration is now complete. Windows will generate audit events when the users you specified take the actions specified on the files or folders for which you set the audit policies.

Disabling Audit Token Right Adjusted Success Events

As per Microsoft, it is recommended to Disable "Success" auditing for "Audit Token Right Adjusted".

Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703#security-monitoring-recommendations.

By enabling "Success Auditing" for Audit Token Right Adjusted (Detailed Tracking ), 800+ (4703) events can be generated in a second, resulting in this high volume event impacting system performance.

Complete these steps to disable "Success" for "Audit Token Right Adjusted".

  1. Log in, with administrator privileges, to the machine where you want to set the policy.

    On a domain computer, you must have a Domain administrator account.

  2. Go to Programs > Administrative Tools > Local Security Policy.
  3. Expand to Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object > Detailed Tracking.
  4. Go to the Detailed Tracking subcategory, and select Audit Token Right Adjusted.
  5. Double click Audit Token Right Adjusted, select the Configure the following audit events: checkbox.
  6. Uncheck the Success checkbox if needed to disable.
  7. Click Apply.
Configuring Print Log

FortiSIEM supports pull Windows print log from Windows agent. To configure, take the following steps.

Enabling Logging Print Log after WMI Configuration

After WMI Configuration is completed, enable logging print log by taking the following steps.

  1. Open the Event Viewer window and navigate to Applications and Services Logs > Microsoft > Windows > PrintService.
  2. Click Operational.
  3. Right click, and select Properties.
  4. Add a checkmark to the Enable logging checkbox.
  5. Click Apply.
  6. Click OK.

    All print activities will be logged by Event Viewer through WMI. Event logs can be viewed under Applications and Services Logs -> Microsoft -> Windows -> PrintService -> Operational.
Setup in FortiSIEM

Take the following steps to access print logs in FortiSIEM.

  1. Log on to your Windows Server and navigate to Event viewer > App and Service logs > Microsoft > windows > printservice > properties.
  2. Copy the full name from log properties.
  3. Log onto FortiSIEM in super global.
  4. Navigate to ADMIN > Setup > Windows Agent.
  5. Under Windows Agent Monitor Templates, click New to create a Monitor Template.
  6. In the Name field, enter a name for the template.
  7. Click the Event tab.
  8. In the Event Log row, click on New.
  9. In the Type drop-down list, select Other.
  10. In the Event Name field, enter/paste the full name from step 2.
  11. Click < Save.
  12. Click Save.
  13. Under Host to Template Associations, create a host to template association by clicking New.
  14. In the Name field, enter a name.
  15. Choose an organization.
  16. Select the monitor template you created through steps 5-12.
  17. Select a collector.
  18. Click Save.
  19. Click Apply.

FortiSIEM now automatically parses events received via WMI or FortiSIEM Windows Agent.

 

Setting Access Credentials on FortiSIEM

 

SNMP, Telnet and SSH Access Credentials

See Access Credentials.

LDAP, LDAPS, LDAP Start TLS / OpenLDAP Access Credentials
Settings Value
Name <set name>
Device Type Microsoft Windows Server *
Access Protocol LDAP / LDAPS / LDAP Start TLS
Used For OpenLDAP
Server Port 389 for LDAP, LDAP Start TLS; 636 for LDAPS
Base DN Specify the root of the LDAP tree as the Base DN. For example: dc=companyABC,dc=com
Password Config See Password Configuration
User Name For user discoveries from an OpenLDAP directory, specify the full DN as the user name. For example: uid=jdoe,ou=hr,ou=unit,dc=companyABC,dc=com
Password Password of the user able to access this system

 

LDAP, LDAPS, LDAP Start TLS / Microsoft Active Directory Access Credentials
Settings Value
Name <set name>
Device Type Microsoft Windows Server *
Access Protocol LDAP / LDAPS / LDAP Start TLS
Used For Microsoft Active Directory
Server Port 389 for LDAP, LDAP Start TLS; 636 for LDAPS
Base DN Specify the root of the LDAP tree as the Base DN. For example: dc=companyABC,dc=com
NetBIOS/Domain The domain name or NetBIOS name attribute
Password Config See Password Configuration
User Name For Microsoft Active Directory, the user name can be just the login name.
Password Password of the user able to access this system

 

WMI Access Credentials
Settings Value
Name <set name>
Device Type Microsoft Windows Server *
Access Protocol WMI
Pull Interval 1 minute
NetBIOS/Domain The domain name or NetBIOS name attribute
Password Config See Password Configuration
User Name Name of the user able to access this system
Password Password of the user able to access this system

 

OMI Access Credentials
Settings Value
Name <set name>
Device Type Microsoft Windows Server *
Access Protocol OMI
Pull Interval 1 minute
NetBIOS/Domain The domain name or NetBIOS name attribute
Password Config See Password Configuration
User Name Name of the user able to access this system
Password Password of the user able to access this system