Multiple Checks don't work after changing Icinga2 Agent Service User

Icinga 2
1

hi,

I have replaced the user for running the Icinga2 agent on all Windows hosts for a customer. Previously, the LOCALSYSTEM user was stored for execution. This needs to be changed because our attack detection system raises an alarm every time a Powershell script is executed with this user. I therefore created an AD user and authorized it to execute Icinga using “Set-IcingaServiceUser -User ‘Domain\service.icinga’ -SetPermission;”. This has worked well so far. But now it no longer wants to perform some checks. These are some legacy checks. For example, the check_load command returns the following error: “Failed to format error message, last error was: 2147485648”. As soon as I change the user back, everything works again.

Does anyone have an idea how I can solve this?

2

That’s easy to answer: Your AD user simply does not have enough access rights to perform some of your checks. Fixing it is quite challenging e.g. use sysinternals’ process monitor to identify access errors and grant you AD user accordingly.