Open Internet by MindsNet

Least Privilege DCOM Access for Windows Exporter

The windows_exporter in Grafana's Alloy service requires DCOM access to retrieve metrics from Windows VMs. However, running as a gMSA with Event Log Readers and Performance Log Readers group membership results in an Access Denied error when calling GetTotalHistoryCount against wuauserv. Adding the gMSA to Local Admins resolves the issue, but this is excessive privilege for read-only access.

Computing & Technology, Information Technology, IT Security