Ad account for scanning whole domain forest

[mschoene]

We must run the inventory throughout the whole domain forest with a lot of child domains. Up to now one LS Server with one LS service is running and we have a lot of "WMI - Access denied" perhaps because the service-account has no admin rights on many clients.
In which AD group we must generate a administrative user for running the LS service with admin privileges on every client in the child domains? Or do we have to install different LS services in the child domains?

[Hemoco]

By default the group "Domain admins" has administrative permissions on all clients in a domain.

Adding the service account to this group solves your problem.

Unfortunately it is not possible to add accounts from other domains to the "Domain admins group"

Lets say your service account is : mydomain\scanner

To scan domaincontrollers : add mydomain\scanner to the "administrators" group in this domain
To scan "mydomain" : add mydomain\scanner to the "domain admins"
To scan clients and memberservers in other domains : add the mydomain\scanner to the local "administrators" group on all clients and servers. (easiest be would be to script this)

[mschoene]

Well, we are a little bit under time pressure. How complex is it :-)?

[Hemoco]

At this moment it's a bit complex to setup.
I suggest to wait till version 3.5 (beta should be released by the end of the month)

There it will be possible to specify username/password for each domain.