Windows-specific Monitor Permissions
Event Log Monitor
The Application and System event logs can be viewed by the Everyone group by default. To view the Security event log, the account has to have the
"Manage auditing and security log" user right. Note that individual event log default security settings can be changed via registry settings (see
Microsoft KB323076). In order for the complete event description to be created, the account
has to be able to read the remote registry, and map to an admin share to pull resource strings out of DLLs. This implies the Remote Registry service needs to be running
on the remote machine.
Disk-based monitors connect to remote shares just like you do with Explorer. That means typical file/directory level permissions are what controls access. This applies to the following monitors:
- Directory Quote Monitor
- Disk Space Monitor
- File Age Monitor
- File/Directory Size Monitor
- File & Directory Monitor
- File System Analyzer
- Log File Monitor
- User Quota Monitor
The Windows performance counters are read by the Performance Monitor. The account that is going to read performance counters has to generally have read access to the
remote registry. A Microsoft support document explains
specifically what rights are needed to which registry keys. Also note that the Remote Registry service needs to be running.
Note: Occasionally when counters can't be seen (especially when just some counters are missing), this ends up being caused by corrupted registry settings on the target computer. This is not uncommon. Microsoft
has an article on how to repair performance counters. Oddly, this has even been the root cause when counters look good when viewed locally, but are partially missing
when viewed remotely.
According to this Microsoft document, an administrator account or a locally logged in account is
needed to view service status as of Windows 2003 SP1 (or newer presumably). Previous to that anyone that authenticated to the server could check the service status.
Execute Script Monitor
This monitor doesn't require any special permissions, although the resources you might try to access from within the script might. The monitor will run with the login credentials specified for the server that it is attached to.
File Sight Monitor
PA File Sight typically runs as Local System, although if running as a user account, it needs to run as an administrator account so it can start and stop its driver.
This monitor relies on a number of technologies. It will attempt to use WMI if monitoring processes on a remote Windows machine. If that fails, or if the remote machine is not Windows, then SNMP will be used, with the specified SNMP credentials for the target server.