Windows (WinRM, no agent)

1. On the server, in an elevated PowerShell, enable WinRM.

   Enable-PSRemoting -SkipNetworkProfileCheck -Force

2. Create the HTTPS listener with a certificate named after the server (use your own certificate instead of this self-signed one if you have one), then open its port.

   $cert = New-SelfSignedCertificate -DnsName "srv01.corp.example.com" -CertStoreLocation Cert:\LocalMachine\My
   New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $cert.Thumbprint -Force
   New-NetFirewallRule -DisplayName "WinRM HTTPS" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow

3. Create the account with a long random password, then add it to the groups listed below.

   net user dumbmonit * /add
   net localgroup "Remote Management Users" dumbmonit /add
   net localgroup "Performance Monitor Users" dumbmonit /add
   net localgroup "Event Log Readers" dumbmonit /add

4. Give the account access to the WMI namespace: wmimgmt.msc → right-click WMI Control → Properties → Security → Root → CIMV2 → Security, add it and tick Enable Account and Remote Enable.

5. In DumbMonit, enter the server name as its certificate names it (srv01.corp.example.com) and log in as dumbmonit, or DOMAIN\dumbmonit for a domain account.

注意. The account runs no command on the server, it only reads WMI. NTLM and Basic (HTTPS only) are supported, Kerberos is not. Pending Windows updates cannot be read this way. A self-signed certificate needs the option Accept an unverifiable certificate.