# OS Monitoring

## The Domotz OS Monitoring Feature

The Domotz Operating System (OS) Monitoring Feature extracts additional information about your devices, including OS name, version, vendor, architecture, serial number, and build number. Compatible devices will be marked as locked in the device list view. Domotz will mark computers, servers, and notebooks having the SSH (22) or WINRM (5986) ports open as locked, so you can unlock the OS Monitoring feature.

For security reasons, SSH has priority over WINRM if a Windows machine has both services enabled:

Device connectivity status and information display.

1. The first device is "Domotz’s Mac mini" with a connectivity time of 2 days. Its response time is 2 milliseconds. The manufacturer is Apple, and the IP address is 192.168.5.81. A prompt to set a location or zone is available.

2. The second device "raspberrypi-2" shows 3 days of connectivity. The response time is 1 millisecond. The manufacturer is Raspberry, with an IP address of 192.168.5.92. There is an option to set a location or zone.

3. The third device, "Windows Desktop," displays connectivity for 4 days. The response time is not available. The manufacturer is REALTEK, and the IP address is 192.168.5.236. A location or zone can be set.

Whenever possible, we recommend using the SSH configuration.

The OS Monitoring feature has been tested on the following systems:

- Windows 10 (or newer)
- macOS Catalina (or newer)
- Debian/Ubuntu Linux
- Centos 8
- VMWare/ESXi
- Dell iDRAC
- HP iLO (HP iLO 4 is not supported)
- Raspberry Pi OS

**Note**: After enabling SSH or WinRM on your machine, it might take up to 3 hours to see the possibility to unlock this functionality on the device.

## Unlock the Domotz OS Monitoring feature

You can unlock this feature through your Credentials Manager by inserting a user’s credentials (no administrator privileges are required).

- SSH unlocked example:

Credentials Manager Interface for Device Credentials

1. The interface is titled "Credentials Manager" and is used to manage device credentials.
2. Under "Device Credentials," there is a section for "SSH."
3. The "OS Monitoring" credential is listed, with an indicator that it is unlocked using the user "sshuser."
4. A description notes that OS Monitoring is used to gather information about the operating system.

- WINRM locked example:

Credentials Manager - Device Credentials Screen

1. Header displays "Credentials Manager."
2. Under "Device Credentials," the section labeled "WINRM" is visible.
3. A listed item shows "OS Monitoring" with a lock icon next to it, indicating access is locked.
4. Descriptive text below reads: "Use OS Monitoring to get info about the Operating System."

After unlocking the device the OS information will be available from the device info view:

System Information and Disk Details

1. Navigate to the top menu and select "System" for system information.
2. Under "System Information," view the details such as Architecture (x86_64), Build Number (20G165), Family (macos), Name (macOS), Vendor (Apple, Inc.), and Version (11.6).
3. In the "Physical Disks" section, one disk is listed with ID "APPLE SSD SM0256G," Status "Verified," Media type "ssd," and labeled as internal.
4. In the "Logical Disks" section, two disks are shown. Both have usage at 96% with a size of 250.8 GB. The first disk has ID "517CBD16-7D03-4565...” and is named "Macintosh HD." The second disk has ID "F4612F6-8BDB-33D0...” and is named "Macintosh HD - Data."

## VMWare ESXi

### Virtual Machine Data

On a VMWare ESXi server, Domotz will also retrieve information related to Virtual Machines (VM):

_[Image]_

The following information for each VM will be presented:

- Name of the VM
- Power Status
- Guest Full Name and OS
- Memory Size
- Virtual CPUs (number)
- Ethernet Cards attached to the VM (number)
- Virtual Disks attached to the VM (number)
- Path Name for the VM disk
- UUID
- Boot-Time

### Unlock VMware ESXi

To unlock a VMware ESXi host you need to:

- Enable sshd
- Edit /etc/ssh/sshd_config, search for a line called PasswordAuthentication, uncomment is and set it to yes. For example:   PasswordAuthentication yes   **If you made this modification, please save and exit the file, and then restart the sshd service on your ESXI host.**
- Use the root user to unlock the device

## Microsoft Windows - WINRM

### Enable an WinRM using Domotz PowerShell script

#### Creating users

Create a local domotz user or a domain user and place it in a local group or in an domain group.
Please download the latest version of the "WIRNM Enable ps script" from here:

[https://github.com/domotz/support_scripts/raw/main/os_monitoring/enable_winrm_os_monitoring.zip](https://github.com/domotz/support_scripts/raw/main/os_monitoring/enable_winrm_os_monitoring.zip)

#### Run the script for Local users

Please open the Powershell terminal with administrative privileges and issue the following command:

```
Set-ExecutionPolicy Bypass -Scope Process
```

and then enter

```
Y
```

After the above command, please run the script using the below parameters:

```
.\enable_winrm_os_monitoring.ps1 -Username $username -GroupName $usergroup -LogFilePath c:\Windows\temp
```

where $username is the local user you would like to use to unlock the windows computer and $usergroup is the group the user belongs to.
 
In general we do suggest our users to run the script like this:

```
.\enable_winrm_os_monitoring.ps1 -Username domotz -GroupName domotzGroup -LogFilePath c:\Windows\temp
```

Basically, what the script does is:
- check if the local domotzuser username exists, if not it creates it
- check if the local DomotzWinRM group, if not creates it and gives the right permissions to this group
- a log file will be generated in c:\Windows\temp

**Please note** that if the user does not exists, after the user creation a password will be autogenerated and displayed in the output of the script on your screen (this will be not shown in the log file). In such cases **we recommend changing the user password** by following the below instructions:

**A:** Open the Powershell terminal with administrative privileges and run the below command to open the Windows settings for users and groups:

```
lusrmgr.msc
```

**B:** Click on the Users tab on the left side, right click on domotz user and change its password:

Changing a user's password in Local Users and Groups.

1. In the left pane, select "Users" under "Local Users and Groups."
2. Right-click on the desired user in the central list and choose "Set Password."
3. Enter the new password and confirm it in the pop-up dialog.
4. Click "OK" to apply the new password. Be aware that doing so may result in loss of access to encrypted files and stored credentials.

Once the script has been executed successfully, Domotz may take some time before showing the **Unlock OS Monitoring**option under the **Access Manager** section of the target device.
**Important:** while unlocking the device please enter the username in the format of **hostname\username**otherwise the unlock procedure will fail with authentication error.

#### Run the script for Domain users

At first, please make sure that the user and the group you would like to use exist already in the AD (this is very important).

Run the script with administrative privileges on a standard Powershell console (NOT ISE) with the following parameters:

```
.\enable_winrm_os_monitoring.ps1 -Username $DOMAINNAME\$USERNAME -GroupName $DOMAINNAME\$USERGROUPNAME -LogFilePath c:\Windows\temp
```

For example, if you created the user domotz and the group domotzGroup in the AD the command would be this one where $DOMAINNAME  the name of you windows Domain in the old NT format:

```
.\enable_winrm_os_monitoring.ps1 -Username $DOMAINNAME\domotz-GroupName $DOMAINNAME\domotzGroup -LogFilePath c:\Windows\temp
```

Please note that the domain name should be used in the **old format** when specifying username and Groupname.
 
**RIGHT:**-Username DOMOTZLAB\domotz -GroupName DOMOTZLAB\domotzGroup 
 
**WRONG: **-Username [domotzlab.com](http://domotzlab.com/)\domotzGroup -GroupName domotzlab.com\domotzGroup
Basically, what the script does is:
- check if the group exists in AD and the user is a member of the group, if not it terminates (no attempt to create objects in AD are made by the script).
- gives the right permissions to the group
- a log file will be generated in c:\Windows\temp

If you would like to configure WIRM on multiple Windows endpoints please see this guide on our to do it by using GPOs: [https://help.domotz.com/monitoring-management/enable-winrm-with-ad-gpo/](https://help.domotz.com/monitoring-management/enable-winrm-with-ad-gpo/)

## Microsoft Windows - SSH

### Enable an SSH Server using Domotz PowerShell script

Please download the script from here: [https://github.com/domotz/support_scripts/raw/main/os_monitoring/enable_ssh_os_monitoring.zip](https://github.com/domotz/support_scripts/raw/main/os_monitoring/enable_ssh_os_monitoring.zip)

and run it with administrative privileges.

### Enable SSH Server (Manual Install)

Open a PowerShell prompt, using the Run as Administrator option and apply the following commands:

- Check the availability of the server:

`Get-WindowsCapability -Online | ? Name -like 'OpenSSH*'`

- Install the server:

`Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0`

- Start the _sshd_ service:

`Start-Service sshd`

- Optional but recommended, configure the service to start automatically:

`Set-Service -Name sshd -StartupType 'Automatic'`

- Confirm the firewall rule is configured. It should be created automatically by setting up:

`Get-NetFirewallRule -Name *ssh*`

- There should be a firewall rule named "OpenSSH-Server-In-TCP", which should be enabled. In case the firewall does not exist, please create one:

`New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22`

## MacOs

You need a normal user that can log in to a shell.

If you have verified that you are logging in as a user with shell access, then open the terminal and enter the following command:

```
sudo systemsetup -setremotelogin on
```

You will be required to input your user password when you run the command. Provide the password and press enter.

To check if SSH is enabled, run the following command:

```
sudo systemsetup -getremotelogin
```

If SSH is on, you will get a message that reads “Remote Login: On”.

## How to allow non-admin users to access a device with WinRM or SSH (on Windows)

#### SSH (Windows)

When using SSH, the following steps need to be executed to allow a non-admin user to extract the OS information:

1. Select **Start > Run**.
2. On the Run dialog, type **wmimgmt.msc** in the **Open** field.
3. Click **OK** to display the Windows Management Infrastructure (WMI) Control Panel.
4. In the left pane of the WMI Control Panel, highlight the **WMI Control (local)** entry, right-click, and select the **Properties** menu option. This displays the WMI Control (Local) Properties dialog box.
5. Select the **Security** tab in the WMI Control (Local) Properties dialog box.
6. In the namespace tree within the Security tab, expand the **Root** folder. This action lists the available WMI namespaces.
7. Select the **CIMV2** namespace to highlight it.
8. Click **Security** to display the Security for ROOT\CIMV2 dialog box.
9. Click **Add** in the Security for ROOT\CIMV2 dialog box to display the Select Users or Groups dialog box.
10. Add the domain user account that will be used as your proxy data collection user account. This should be a domain account (not a local computer account), but it does not need to be an account with administrative access.
11. Click **OK** to close the Select Users or Groups dialog box and return to the Security for ROOT\CIMV2 dialog box. The user account you selected should now be listed in the **Name** list at the top of the dialog box.
12. Select the newly added user (if it is not already selected) and enable the following permissions:  - Enable Account - Remote Enable   Enable the permissions by clicking the **Allow** box, if it is not already checked for that specific permission. The **Enable Account** permission should already be selected, but you'll need to select the **Remote Enable** permission.
13. Click **OK** to close the Security for ROOT\CIMV2 dialog box.

**Note:** The above steps are sufficient to allow an SSH user to extract basic information about an Operating System. However, in addition to this, Domotz is also able to extract status information about "Disks". In particular, you can use Domotz to identify whether or not a disk has **BitLocker** enabled. To allow Domotz to extract this information, repeat steps 7-13 above but instead of the ‘CIMV2’ block, navigate the tree until the ‘root/CIMV2/Security/MicrosoftVolumeEncryption’ section is highlighted.

#### WinRM

To allow non-admin users to access a device with WinRM, add the following additional commands:

`(Get-PSSessionConfiguration -Name Microsoft.PowerShell).Permission`

Get the name of the group 'Remote Management Users' (The exact phrase may differ if your Windows version is not in English).

`Net localgroup "Remote Management Users" /add username`

The 'username' is the account you will use on Domotz.
Then you have to grant permissions to connect to WinRM and execute WMI commands to groups or users:

1 - Open a privileged command prompt or PowerShell window

2 - Assign the permissions for WinRM to the user, to open the security applet run the following:

```
winrm configsddl default
```

Add your user and grant it Read and Execute permissions:

Permissions configuration for a user in Windows.

1. In the "Group or user names" section, locate and select "Your User."
2. Under "Permissions," focus on the "Allow" column.
3. Ensure the box for "Read (Get, Enumerate, Subscribe)" is checked to grant read permissions.
4. Ensure the box for "Execute (Invoke)" is checked to allow execution permissions.
5. Adjust permissions as needed. Use "Add" to include new users or "Remove" to delete existing ones.
6. Click "Advanced" for more detailed permissions settings.
7. Confirm changes with "OK" or cancel with "Cancel."

3 - Assign the user WMI remote permissions from the WMI management console.
To open the console run:

```
winmgmt.msc
```

- Right ‘WMI Control’ and select ‘Properties’
- Navigate to the Security tab, expand ‘Root’ and select ‘CIMV2’
- Click ‘Advanced’
- Verify that inheritance is enabled
- Click ‘Add’
- Select your user and grant it ‘Remote Enable’ and 'Execute'

Accessing WMI Control Properties and Security Settings

1. In the WMI Management console, right-click on "WMI Control (Local)" under "Console Root."
2. Select "Properties" from the context menu to open the WMI Control Properties dialog.
3. In the Properties window, navigate to the "Security" tab where you will find a tree structure of namespaces. Expand the nodes to select "CIMV2."
4. Click on the "Advanced" button in the Security dialog to configure detailed security permissions for users or groups.

Configuring Security Permissions for CIMV2

1. Open the "Advanced Security Settings for CIMV2" dialog.
2. Click "Add" to include a new permission entry.
3. In the "Permission Entry for CIMV2" window, select a principal by clicking "Select a principal."
4. Ensure the "Type" is set to "Allow" and "Applies to" is set to "This namespace and subnamespaces."
5. Under "Permissions," check "Execute Methods" and "Remote Enable" to enable these permissions.
6. Optionally, check "Enable Account" if needed, but leave "Full Write," "Partial Write," "Provider Write," "Read Security," and "Edit Security" unchecked unless additional permissions are required.
7. Check "Only apply these permissions to objects and/or containers within this container" if applicable.
8. Finally, click "OK" to save changes.

#### First Login to enable a user

For both the SSH or WinRM methodology, if you are using a non-Admin user, we recommend logging in to the machine with the non-admin user at least once. This should be done following the Windows initialization process. We recommend this because the full profile will be created and it will be possible for Domotz to discover the Applications installed via the Windows Store.

## How to allow non-admin users to access the device with SSH (on Linux)

You would only need a normal user that can log in to a shell (/bin/bash).