Clarification needed - Hyper-V-Monitoring using WMI

[guarana]

Hello,

we are dealing with Event ID 4625 on the Hyper-V-servers because of limitations of WMI queries and local users, which results in a "Bad Hyper-V username logon attempt Error for Hyper-V Host XYZ" alarm.

• Disabling a usefull monitoring alarm is not an option.

• Spreading local backup system administrative users credentials to target domain systems the prevent the logon error is obviously violating security policies.

We do not know, how VeeamOne currently connects to the target machine (WMIC, Remote Powershell, ...) and we also do not know, if only WMIC or also Get-CIMInstance causes the same error message.

As a followup to our current support case (#07812527) and since Microsoft has announced depreciation of WMIC, we would consider the R&D team to think about moving from WMIC to Powershell, when it comes to monitoring Hyper-V hosts & guests (in case WMIC is currently used to gather information from the remote machine).

Kind Regards
guarana

[RomanK]

Hello guarana,

Thanks for sharing the case number. As far as I can see, support engineer showed that this is expected behavior and current design so the case was closed.

We fully understand that disabling alarms and expanding local admins can be inconvenient. However, enabling remote PowerShell may also raise security concerns. There is an active internal discussion regarding future improvements to data collection. I cannot say anything specific at the moment but we are aware of it.

Thanks