Help with creating ADM file to add SNMP community name, trap destinantion & RW permissions

You can configure SNMP settings already without an ADM. They are under:

Computer Configuration > Admin Templates > Network > SNMP

So the GPO only allows you to set whats listed below:
1.      Trap destination server (server name) under the traps tab in the SNMP services
2.      Accepted community names under the security tab can be set but with only read only rights
3.      Under the traps tab, the community name is still set to public and cannot be changed in a GPO

I need to change the community name from public to what I have set in IT assistant, but the SNMP gpo doesnt allow that option

Hi There
I have an ADM file that may help you in your quest. Quite  about a year ago i had a similar situation and managed to develop this ADM with the help of samples from a variety of sources. (i havve no names to pass credit to for bits i used unfortunately).
Anyway, If you add this ADM to a test GPO in a test OU for a Test Server that has SNMP installed from Windows Components, See if it helps you or enables you a starting point to develop further for your own requirments.
You will need to amend the ADM to suit your own Communities names and you CAN set their permissions with it too, and their Agent info (this is hidden by default - let me know if you want to use it)
I did some test to refresh myself on it and it works as i expected.

Copy exactly as is, to Notepad (word wrap turned off) and save as .ADM
Then:
Change the NAME1 and KRYSADMIN names to your own and add more blocks of PART if you want more than 2 communities.
It is recommended that you don't use comflicting stuff in the Original SNMP GPO under Administrative Templates - Network - SNMP but you can play with it all to see how it all works and what happens etc. :-)

Interested to know how you get on with it if it suits your needs. (and to give feedback for future techies on here with the same requirements).

Regards
Krystian
Hope it helps

CLASS MACHINE
 
	CATEGORY "Custom Windows Settings"
 
		CATEGORY "SNMP"
 
		POLICY "Communities"
			KEYNAME "Software\Policies\SNMP\Parameters\ValidCommunities"
 
			EXPLAIN !!SNMP_ListCommunities_Help
 
			PART "NAME1 Community" DROPDOWNLIST NOSORT
 
			VALUENAME "NAME1"
				ITEMLIST
					NAME "Remove NAME1 community" VALUE DELETE DEFAULT
					NAME "NONE" VALUE NUMERIC 1
					NAME "NOTIFY" VALUE NUMERIC 2
					NAME "READ-ONLY" VALUE NUMERIC 4
				END ITEMLIST
			END PART        
 
			PART "KRYSADMIN Community" DROPDOWNLIST NOSORT
 
			VALUENAME "KRYSADMIN"
				ITEMLIST
					NAME "Not added" VALUE DELETE DEFAULT
					NAME "NONE" VALUE NUMERIC 1
					NAME "NOTIFY" VALUE NUMERIC 2
					NAME "READ ONLY" VALUE NUMERIC 4
					NAME "READ WRITE" VALUE NUMERIC 8
				END ITEMLIST
			END PART
 
		END POLICY
		
		POLICY "Agent Service"
			KEYNAME "System\CurrentControlSet\Services\SNMP\Parameters\RFC1156Agent"
			
			EXPLAIN !!SNMP_AgentServices_Help
			
			PART "Agent Service List" DROPDOWNLIST NOSORT
			
			VALUENAME "sysServices"
				ITEMLIST
					NAME "Applications, Internet, End-to-End (DEFAULT)" VALUE NUMERIC 76 DEFAULT
					NAME "Physical, Applications, Internet, End-to-End" VALUE NUMERIC 77
					NAME "Physical, Applications, Datalink and Subnetwork, Internet, End-to-End" VALUE NUMERIC 79
					NAME "Physical, Applications, End-to-End" VALUE NUMERIC 73
				END ITEMLIST
			END PART
		
		END POLICY
		
	END CATEGORY
END CATEGORY
 
[strings]
SNMP_ListCommunities_Help="Enables a pre-defined list of communities (public & admin) to be given permissions.\n\nNote: This setting will 'Enable' the Communities policy found under Administrative Templates -> Network -> SNMP. Do not amend this or anything else to that policy if you use this one.\n\nSNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events.\n\nA valid community is a community recognized by the SNMP service, while a community is a group of hosts (servers, workstations, hubs, and routers) that are administered together by SNMP. The SNMP service is a managed network node that receives SNMP packets from the network.\n\nIf you enable this setting, the SNMP agent only accepts requests from management systems within the communities it recognizes and gives them the relevant permissions you specify.\n\nIf you disable or do not configure this setting, the SNMP service takes the Valid Communities configured on the local computer instead.\n\nBest Practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control.\n\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\n\nAlso, see the other two SNMP settings: "Permitted Managers" and "Trap Configuration" found under Administrative Templates -> Network -> SNMP."
SNMP_AgentServices_Help="Sets which services are enabled on the SNMP Agent.\n\nPhysical = Manages physical devices such as Hard Disk Partitions\n\nApplication = Should always be Enabled\n\nDatalink Subnetwork = Computer manages a Bridge\n\nInternet = Computer functions as an IP Gateway (router)\n\nEnd-to-End = Computer functions as an IP Host. Should always be Enabled\n\nSNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events.\n\nBest Practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control.\n\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\n\nAlso, see the other two SNMP settings: "Permitted Managers" and "Trap Configuration" found under Administrative Templates -> Network -> SNMP."

Select allOpen in new window

Hello

Thanks for your help with this! I do have a question though, so my community name is itassist so for NAME1 & KRYSADMIN names I should change to itassist?

Well, yes

But in the case i presented, you would have 2 communities, so you may want to remove one of the PART.. END PART  blocks

My use was to have an Admin community with read/write and a another with read only.

Sounds like you just want the one.

What you could do is add my ADM as it is and see what is happening. It may help you to understand it better.

Hope this helps

Krystan

Ok so I added this template to a test gpo, added my PC & a couple of servers to that OU that the GPo/ADM file is set to & I checked the SNMP settings and dont see the community name set to itassist, all other settings applied that the SNMP GPO pushed. Checked registry settings with no changes

Any suggestions?

Code listed below

CLASS MACHINE
 
        CATEGORY "Custom Windows Settings"
 
                CATEGORY "SNMP"
 
                POLICY "Communities"
                        KEYNAME "Software\Policies\SNMP\Parameters\ValidCommunities"
 
                        EXPLAIN !!SNMP_ListCommunities_Help
 
                        PART "itassist Community" DROPDOWNLIST NOSORT
 
                        VALUENAME "itassist"
                                ITEMLIST
                                        NAME "Remove itassist community" VALUE DELETE DEFAULT
                                        NAME "NONE" VALUE NUMERIC 1
                                        NAME "NOTIFY" VALUE NUMERIC 2
                                        NAME "READ-ONLY" VALUE NUMERIC 4
                                END ITEMLIST
                        END PART        
 
                END POLICY
                
                POLICY "Agent Service"
                        KEYNAME "System\CurrentControlSet\Services\SNMP\Parameters\RFC1156Agent"
                        
                        EXPLAIN !!SNMP_AgentServices_Help
                        
                        PART "Agent Service List" DROPDOWNLIST NOSORT
                        
                        VALUENAME "sysServices"
                                ITEMLIST
                                        NAME "Applications, Internet, End-to-End (DEFAULT)" VALUE NUMERIC 76 DEFAULT
                                        NAME "Physical, Applications, Internet, End-to-End" VALUE NUMERIC 77
                                        NAME "Physical, Applications, Datalink and Subnetwork, Internet, End-to-End" VALUE NUMERIC 79
                                        NAME "Physical, Applications, End-to-End" VALUE NUMERIC 73
                                END ITEMLIST
                        END PART
                
                END POLICY
                
        END CATEGORY
END CATEGORY
 

Select allOpen in new window

ok
i will try your code in my AD quickly to see what is happening

Thanks
Krystian

Hi
OK I copied your script and added the STRINGS section to the bottom and added it to my GPO
Did a gpupdate on my Server 2003 R2 and under SNMP service Security tab i got your ITAssist which i set to ReadOnly

Is this not what you get?

Krystian

Yes it will add itassist under the security tab under SNMP service, but what about under the traps tab? Instead of public it should be itassist under Community

Yes i just realised that
I'm working it now for you :)

Krystian

Thanks really appreciate your help!!!!!!!!!!!!!

Hi There

I think i've cracked it! :)

Add this ADM "as is" to your GPO and see what you think.
You CANNOT use the default SNMP settings under Network once you decide to use this otherwise conflicts will occur.

You may want change the Help section to suit your own wants for the new Policy i added

Hope it works for you

Krystian

CLASS MACHINE
 
        CATEGORY "Custom Windows Settings"
 
                CATEGORY "SNMP"
 
                POLICY "Communities"
                        KEYNAME "Software\Policies\SNMP\Parameters\ValidCommunities"
 
                        EXPLAIN !!SNMP_ListCommunities_Help
 
                        PART "itassist Community" DROPDOWNLIST NOSORT
 
                        VALUENAME "itassist"
                                ITEMLIST
                                        NAME "Remove itassist community" VALUE DELETE DEFAULT
                                        NAME "NONE" VALUE NUMERIC 1
                                        NAME "NOTIFY" VALUE NUMERIC 2
                                        NAME "READ-ONLY" VALUE NUMERIC 4
                                END ITEMLIST
                        END PART        
 
                END POLICY
 
 
                POLICY "Traps for itassist community"
                        KEYNAME "Software\Policies\SNMP\Parameters\TrapConfiguration\itassist"
 
                        EXPLAIN !!SNMP_TrapConfig_Help
			
			PART "Trap Destination" EDITTEXT
			
			VALUENAME ""
			DEFAULT ""
					
			END PART
 
                END POLICY
                 
 
               POLICY "Agent Service"
                        KEYNAME "System\CurrentControlSet\Services\SNMP\Parameters\RFC1156Agent"
                        
                        EXPLAIN !!SNMP_AgentServices_Help
                        
                        PART "Agent Service List" DROPDOWNLIST NOSORT
                        
                        VALUENAME "sysServices"
                                ITEMLIST
                                        NAME "Applications, Internet, End-to-End (DEFAULT)" VALUE NUMERIC 76 DEFAULT
                                        NAME "Physical, Applications, Internet, End-to-End" VALUE NUMERIC 77
                                        NAME "Physical, Applications, Datalink and Subnetwork, Internet, End-to-End" VALUE NUMERIC 79
                                        NAME "Physical, Applications, End-to-End" VALUE NUMERIC 73
                                END ITEMLIST
                        END PART
                
                END POLICY
                
        END CATEGORY
END CATEGORY
 
 
[strings]
SNMP_ListCommunities_Help="Enables a pre-defined list of communities (public & admin) to be given permissions.\n\nNote: This setting will 'Enable' the Communities policy found under Administrative Templates -> Network -> SNMP. Do not amend this or anything else to that policy if you use this one.\n\nSNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events.\n\nA valid community is a community recognized by the SNMP service, while a community is a group of hosts (servers, workstations, hubs, and routers) that are administered together by SNMP. The SNMP service is a managed network node that receives SNMP packets from the network.\n\nIf you enable this setting, the SNMP agent only accepts requests from management systems within the communities it recognizes and gives them the relevant permissions you specify.\n\nIf you disable or do not configure this setting, the SNMP service takes the Valid Communities configured on the local computer instead.\n\nBest Practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control.\n\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\n\nAlso, see the other two SNMP settings: "Permitted Managers" and "Trap Configuration" found under Administrative Templates -> Network -> SNMP."
SNMP_AgentServices_Help="Sets which services are enabled on the SNMP Agent.\n\nPhysical = Manages physical devices such as Hard Disk Partitions\n\nApplication = Should always be Enabled\n\nDatalink Subnetwork = Computer manages a Bridge\n\nInternet = Computer functions as an IP Gateway (router)\n\nEnd-to-End = Computer functions as an IP Host. Should always be Enabled\n\nSNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events.\n\nBest Practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control.\n\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\n\nAlso, see the other two SNMP settings: "Permitted Managers" and "Trap Configuration" found under Administrative Templates -> Network -> SNMP."
SNMP_TrapConfig_Help="Sets the Trap Configuration to something other than Public, however, you need to change the ADM file to put what name you want. You can also add the Trap Destination Hostname using the this policy"

Select allOpen in new window

Thanks I will try it out now, i was so busy yesterday.

I will keep you posted.

Hello Krystian

So that adm file works great, the only thing is I notice some of the servers under the security tab have listed accept SNMP packets from these host and it only has the local host selected, is there a way to add usflfsa4 to that area?

Again

Thanks for your help!!!

I'll check/work on it for you

Krystian

Hi

OK here goes.
The ADm file i gave you will cater for adding your own Trap and trap destination and also the Security tabs accepted communities.

To get your "permitted Managers" part working you can use the default SNMP settings under Network - SNMP - Permitted Managers

I tested this and it works a treat. :)

Just don't use the other 2 options in the default SNMP as we have customised them with our own ADM

Hope this helps

Krystian

Krystian

I have a question, for the traps for itassist community, if I put 2 server names into the text box seperated by a comma it doesnt seem to work. Do you know if there is a way to add two servers without any issues?

I'll have a look for you.

Krystian

Hi There

I have a quick and possibly dirty way (there may be better ways, but i've yet to discover them) in achieving your request.

See the attached code
Basically, i added the additional PARTS... END PRTS for as many trap Destinations you  want. add/remove what you do/don't want. (I've put 4 but you may want more or less)

Hope this helps :)
Krystian

PS. Its important to keep the PART statements as they are, just add or remove what you want and add more numbers if you add more.
Use as Is to see how it works :)

CLASS MACHINE
 
        CATEGORY "Custom Windows Settings"
 
                CATEGORY "SNMP"
 
                POLICY "Communities"
                        KEYNAME "Software\Policies\SNMP\Parameters\ValidCommunities"
 
                        EXPLAIN !!SNMP_ListCommunities_Help
 
                        PART "itassist Community" DROPDOWNLIST NOSORT
 
                        VALUENAME "itassist"
                                ITEMLIST
                                        NAME "Remove itassist community" VALUE DELETE DEFAULT
                                        NAME "NONE" VALUE NUMERIC 1
                                        NAME "NOTIFY" VALUE NUMERIC 2
                                        NAME "READ-ONLY" VALUE NUMERIC 4
                                END ITEMLIST
                        END PART        
 
                END POLICY
 
 
                POLICY "Traps for itassist community"
                        KEYNAME "Software\Policies\SNMP\Parameters\TrapConfiguration\itassist"
 
                        EXPLAIN !!SNMP_TrapConfig_Help
			
			PART "Trap Destination 1" EDITTEXT
				VALUENAME "1"
			END PART
 
			PART "Trap Destination 2" EDITTEXT
				VALUENAME "2"
			END PART
 
			PART "Trap Destination 3" EDITTEXT
				VALUENAME "3"
			END PART
 
			PART "Trap Destination 4" EDITTEXT
				VALUENAME "4"
			END PART
 
                END POLICY
                 
 
               POLICY "Agent Service"
                        KEYNAME "System\CurrentControlSet\Services\SNMP\Parameters\RFC1156Agent"
                        
                        EXPLAIN !!SNMP_AgentServices_Help
                        
                        PART "Agent Service List" DROPDOWNLIST NOSORT
                        
                        VALUENAME "sysServices"
                                ITEMLIST
                                        NAME "Applications, Internet, End-to-End (DEFAULT)" VALUE NUMERIC 76 DEFAULT
                                        NAME "Physical, Applications, Internet, End-to-End" VALUE NUMERIC 77
                                        NAME "Physical, Applications, Datalink and Subnetwork, Internet, End-to-End" VALUE NUMERIC 79
                                        NAME "Physical, Applications, End-to-End" VALUE NUMERIC 73
                                END ITEMLIST
                        END PART
                
                END POLICY
                
        END CATEGORY
END CATEGORY
 
 
[strings]
SNMP_ListCommunities_Help="Enables a pre-defined list of communities (public & admin) to be given permissions.\n\nNote: This setting will 'Enable' the Communities policy found under Administrative Templates -> Network -> SNMP. Do not amend this or anything else to that policy if you use this one.\n\nSNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events.\n\nA valid community is a community recognized by the SNMP service, while a community is a group of hosts (servers, workstations, hubs, and routers) that are administered together by SNMP. The SNMP service is a managed network node that receives SNMP packets from the network.\n\nIf you enable this setting, the SNMP agent only accepts requests from management systems within the communities it recognizes and gives them the relevant permissions you specify.\n\nIf you disable or do not configure this setting, the SNMP service takes the Valid Communities configured on the local computer instead.\n\nBest Practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control.\n\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\n\nAlso, see the other two SNMP settings: "Permitted Managers" and "Trap Configuration" found under Administrative Templates -> Network -> SNMP."
SNMP_AgentServices_Help="Sets which services are enabled on the SNMP Agent.\n\nPhysical = Manages physical devices such as Hard Disk Partitions\n\nApplication = Should always be Enabled\n\nDatalink Subnetwork = Computer manages a Bridge\n\nInternet = Computer functions as an IP Gateway (router)\n\nEnd-to-End = Computer functions as an IP Host. Should always be Enabled\n\nSNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events.\n\nBest Practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control.\n\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\n\nAlso, see the other two SNMP settings: "Permitted Managers" and "Trap Configuration" found under Administrative Templates -> Network -> SNMP."
SNMP_TrapConfig_Help="Sets the Trap Configuration to something other than Public, however, you need to change the ADM file to put what name you want. You can also add the Trap Destination Hostname using the this policy"

Select allOpen in new window

Hi mmiller3442

Ok I've cracked it... i knew there was a better way than my last attempt :)
Try this ADM code
Let me know how you get on.

Krystian


Side Note: Be aware that SNMP community names are case sensitive.
Right i'm off to bed now :)

CLASS MACHINE
 
        CATEGORY "Custom Windows Settings"
 
                CATEGORY "SNMP"
 
                POLICY "Communities"
                        KEYNAME "Software\Policies\SNMP\Parameters\ValidCommunities"
 
                        EXPLAIN !!SNMP_ListCommunities_Help
 
                        PART "itassist Community" DROPDOWNLIST NOSORT
 
                        VALUENAME "itassist"
                                ITEMLIST
                                        NAME "Remove itassist community" VALUE DELETE DEFAULT
                                        NAME "NONE" VALUE NUMERIC 1
                                        NAME "NOTIFY" VALUE NUMERIC 2
                                        NAME "READ-ONLY" VALUE NUMERIC 4
                                END ITEMLIST
                        END PART        
 
                END POLICY
 
 
                POLICY "Traps for itassist community"
			KEYNAME "Software\Policies\SNMP\Parameters\TrapConfiguration\itassist"
 
                        EXPLAIN !!SNMP_TrapConfig_Help
 
			PART "Trap Configuration"	LISTBOX
				VALUEPREFIX ""
			END PART
 
                END POLICY
                 
 
               POLICY "Agent Service"
                        KEYNAME "System\CurrentControlSet\Services\SNMP\Parameters\RFC1156Agent"
                        
                        EXPLAIN !!SNMP_AgentServices_Help
                        
                        PART "Agent Service List" DROPDOWNLIST NOSORT
                        
                        VALUENAME "sysServices"
                                ITEMLIST
                                        NAME "Applications, Internet, End-to-End (DEFAULT)" VALUE NUMERIC 76 DEFAULT
                                        NAME "Physical, Applications, Internet, End-to-End" VALUE NUMERIC 77
                                        NAME "Physical, Applications, Datalink and Subnetwork, Internet, End-to-End" VALUE NUMERIC 79
                                        NAME "Physical, Applications, End-to-End" VALUE NUMERIC 73
                                END ITEMLIST
                        END PART
                
                END POLICY
                
        END CATEGORY
END CATEGORY
 
 
[strings]
SNMP_ListCommunities_Help="Enables a pre-defined list of communities (public & admin) to be given permissions.\n\nNote: This setting will 'Enable' the Communities policy found under Administrative Templates -> Network -> SNMP. Do not amend this or anything else to that policy if you use this one.\n\nSNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events.\n\nA valid community is a community recognized by the SNMP service, while a community is a group of hosts (servers, workstations, hubs, and routers) that are administered together by SNMP. The SNMP service is a managed network node that receives SNMP packets from the network.\n\nIf you enable this setting, the SNMP agent only accepts requests from management systems within the communities it recognizes and gives them the relevant permissions you specify.\n\nIf you disable or do not configure this setting, the SNMP service takes the Valid Communities configured on the local computer instead.\n\nBest Practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control.\n\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\n\nAlso, see the other two SNMP settings: "Permitted Managers" and "Trap Configuration" found under Administrative Templates -> Network -> SNMP."
SNMP_AgentServices_Help="Sets which services are enabled on the SNMP Agent.\n\nPhysical = Manages physical devices such as Hard Disk Partitions\n\nApplication = Should always be Enabled\n\nDatalink Subnetwork = Computer manages a Bridge\n\nInternet = Computer functions as an IP Gateway (router)\n\nEnd-to-End = Computer functions as an IP Host. Should always be Enabled\n\nSNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events.\n\nBest Practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control.\n\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\n\nAlso, see the other two SNMP settings: "Permitted Managers" and "Trap Configuration" found under Administrative Templates -> Network -> SNMP."
SNMP_TrapConfig_Help="Sets the Trap Configuration to something other than Public, however, you need to change the ADM file to put what name you want. You can also add the Trap Destination Hostname using the this policy"

Select allOpen in new window

Thanks that worked

Appreciate all your help with this!!!!!!!!!!!!!!!!!!

Hi There

Just wondered if you are happy to close this question if it all works ok for you.
Glad to have helped. :)

Krystian

Hello Krys

Im happy with the ADM file, thanks for your assistance with this. I will close the question

Thanks again!!!

HI

Just checking if you mean to close it without "accepting solution"
By closing it no one else will ever see this post and won't benefit from it. :)
Also, just so that you're aware in future, Experts don't get paid to help, their only currency is the points system which means a lot to them. If a solution was found for you then its only couteous to accept it as the solution and give them the points/grade you offered in asking your question.
Just some friendly advice :)

Glad it sorted your problem out anyway.
With regards
Krystian

Weird I chose to give you 500 points, let me try again

My apologies for any confusions or otherwise. I was informed that the post was going to be closed in 4 days and took that as permanently removed.

Regards
Krystian

And many thanks for points and grade mmiller3442. Its much appreciated. :)