My last post on the subject of using the Nagios NRPE plugin to monitor stuff on Windows. This time I want to be monitor some Window domain user accounts for lockout status.
We run some of our windows services using ordinary domain user accounts instead of the built in local service accounts. This is normally when the service in question needs to read or write to network shares on another server, the built in service accounts don’t seem to pass and username/password along with the request and so the connection fails. When you run the process under a domain account, the name and password are passed along with the connection request and as long as you have set your share and NFS permissions correctly it should work.
We recently had an application stop working and it turned out to be that the domain user account that the service ran under had become locked out.
So I decided it would be a good idea to get a heads up about this sort of thing sooner rather than later. The script needs to run on your AD domain controllers (x1 is probably fine as they all replicate user data, but more might allow detection a little quicker).
The code for the script is below.
' account name supplied as argument
strAccount = Wscript.Arguments.Item(0)
' bind to the MERCURY domain
Set objComputer = GetObject("WinNT://MYDOMAIN")
objComputer.Filter = Array("User")
' for each service compare it’s display name to the current one we are looking for
For each objUser in objComputer
If objUser.Name = strAccount then
If ObjUser.IsAccountLocked <> 0 then
Wscript.echo "Account is locked out"
Wscript.Quit (2)
Else
Wscript.echo "Account is ok"
Wscript.Quit (0)
End if
End if
Next
The script is using WMI to check the IsAccountLocked value of a user object. The user object has quite a lot of key pair values that you can monitor, basically all the fields and check boxes you see in the AD user dialogue box.
In this instance, I am only interested in the ‘Account is locked out’ check box. If it’s checked the value will be something other than 0 (1 in this case)and I want an alert, but if the value is still 0 then it’s not checked and the account is ok.
As with the prior checks I wrote about, the .vbs script file needs to be dropped into the ‘libexec’ folder, and a line like below needs to be added to the nrpe.cfg config file on the windows server.
command[check_windows_account]=cscript.exe //T:30 //NoLogo "C:\Program Files (x86)\NRPE_NT\libexec\check_windows_account.vbs" "$ARG1$"
On the Nagios server you need to add a command definition to the commands.cfg file.
# 'check_windows_account' command definition (using nrpe)
define command{
command_name check_windows_account
command_line $USER1$/check_nrpe -H $HOSTADDRESS$ -t 60 -p 5666 -c check_windows_account -a $ARG1$
}
And finally a service check has to be created in the services.cfg file and a server to be checked needs to be added (in this example I’m checking the account ‘AppUser’ on the server Windows_Server_1.
define service{
service_description Check Windows User Account
servicegroups cust-windows
host_name windows_server_1
check_command check_windows_account!"AppUser"
use generic-service
}
Hopefully these scripts have given you an idea of what you can do with the NRPE plugin. As long as you can write a script to check a known value of something, you can get Nagios to use it as a monitor and fire an alert. And it doesn’t have to be VBScript, Powershell, Perl, Python they all can be used. You can monitor WMI objects, or Windows Perfmon Counters, the list is vast.
Enjoy ;oD
