Can I install, manage, or uninstall the agent on a Domain Controller without a Domain Administrator account?

To install or uninstall the agent on a domain controller, a Domain Administrator account is required. This limitation is intentionally designed by Microsoft so that lower account privileges cannot use escalation loopholes on the domain controller to obtain Domain Administrator rights and modify the domain.

Once the agent is installed, you can use an account that is a member of the Server Operators group to push the new configuration as well as for upgrading, stopping, or starting the agent. Some changes are required for this to work:

• Find the "C:\Windows\System32\eventsentry" folder on the domain controller and change the folder permissions to add the "Server Operators" group and give that group full control.

• Open the registry editor on the comain controller and locate the "HKEY_LOCAL_MACHINE\SOFTWARE\netikus.net\EventSentry" folder. Right-click the folder and choose Permissions, and add the "Server Operators" group and give that group full control.

Now if you use an account from the "Server Operators" group to launch the EventSentry console, or as the stored authentication for your domain controller in EventSentry, you can perform every management function on domain controller agents, aside from installing or uninstalling the agent.