Discover Domain Controllers without Domain Admin rights.

jcanjura · ‎04-17-2020

How can I discover Domain Controllers without having Domain Admin rights?
We have a GPO that adds a Security Group to the Local Admins group on each Windows server, but for DCs that's similar to having Domain Admins rights (which is a big NO in our environment).
I found this same question at:

https://community.servicenow.com/community?id=community_question&sys_id=3251c329db98dbc01dcaf3231f9619ba

But at the end of the document it mentions "New technology is coming to replace and (vastly) improve the functionality.."
I have a couple of questions:

What's the 'new way' to discover DCs, including relationships?
If we need to use the "Help the Help Desk" script as a logon script, will that apply to every Windows Server in the environment?
- In other words, will the script replace the GPO we have already in place?
- Will the script still NOT create relationships between the server and the running apps?
- How will that impact Top-Down discovery (Service mapping)?

Thanks

DaveHertel · ‎06-16-2020

Hi - to address a couple of your questions

...use the "Help the Help Desk" script as a logon script, ....
>>> I believe this HTH is being phased out. Read more here
How will that impact Top-Down disco (Service mapping)
>>> for these CI's to be auto populated via SM, they have to be in the CMDB. They can get into the CMDB via automation, aka, Discovery or added as CI's manually. Its a bit of a catch-22 for SM because if you want full automation (i.e. no manual entry) then Discovery needs to scan/inventory it... which is blocked by the original point you brought up.

Its fairly common that Domain Controllers are excluded from discovery because of the reasons already noted.

Hope this helps?

View solution in original post

doug_schulze · ‎06-18-2020

That we are...Its in limited availability for event right now but will be widely available for many other parts of the platform here soon.

Ashutosh Munot1 · ‎06-18-2020

This will be interesting.

cynlink1 · ‎08-25-2021

Doug - When you responded to this post about a year ago, where you referring to the Agent Client Collector that is now available?

doug_schulze · ‎08-25-2021

Sure was, just couldn't say at the time.. 🙂 But know we still cant run patterns on the agent (yet), but that is coming so you can consider it just hardware collection for now.

cynlink1 · ‎08-27-2021

Thanks for the quick response!