Technical Anshu
Tutorials Blog
PRTG WMI

PRTG WMI Monitoring CPU and RAM Why Credentials and Permissions Decide Everything

Your WMI sensor is red and the error looks technical. It almost never is. WMI monitoring stands or falls on one account, its password, and its permissions - here is the whole story.

By Technical AnshuPaessler PRTGWindows Server and Network
Watch the complete PRTG setup in the video - CPU, RAM, bandwidth and firewall monitoring, step by step

CPU and RAM numbers in PRTG usually come from WMI - Windows Management Instrumentation, the built-in channel Windows offers for exactly this data. When a WMI sensor fails, beginners reinstall things. Experienced admins check three things: the account, the password, and the firewall between probe and target. This page walks the credential reality first, then the honest cost of WMI, because WMI's power and WMI's weight are the same feature.

Typical WMI sensor error and what it usually means (illustration)
Sensor: WMI Memory (SERVER-01) Status: Down Message: "Connection could not be established" (code: PE015) Usual causes, in order: 1. Wrong or expired password for the WMI account 2. Account is not a local admin on SERVER-01 3. Firewall blocks RPC/DCOM between probe and target
Illustrative error - the code matters less than the three checks
1

Give PRTG a Real Monitoring Account

Create a dedicated account for monitoring - in a domain, one service account; in a workgroup, the same username and password on each machine. It needs local administrator rights on every Windows target it queries, because WMI performance counters sit behind admin boundaries. Enter the credentials once at the group or device level in PRTG and let sensors inherit them. Using your own personal admin account works until the day you change your password and every sensor in the office turns red at once - that day teaches this lesson permanently.

2

What Must Be Open Between Probe and Target

WMI rides on DCOM and RPC: the initial connection uses TCP port 135, and the actual conversation continues on dynamically assigned ports. On the same LAN segment with the Windows Firewall's WMI rules enabled, it simply works. Across a firewall or a routed network, that dynamic port behaviour is why WMI "mysteriously" fails - the fix is the proper firewall rule set for WMI, not disabling the firewall. Test from the probe machine: if the probe cannot reach the target's WMI, no sensor setting will save you.

3

The Honest Cost of WMI

WMI queries are not free. Each one is a real conversation with the target machine, and Paessler's own planning guidance caps a probe at roughly 120 WMI sensors at a 60-second interval (about 600 at 300 seconds) before the probe itself becomes the bottleneck. For a handful of servers this is irrelevant. For fifty servers, prefer longer intervals on memory and disk, and take switches and network gear by SNMP instead - SNMP is the light protocol, WMI is the rich one. Rich and heavy are the same thing, priced differently.

4

When WMI Refuses: the Ladder

  1. Confirm the account logs on and is a local admin on that target
  2. Confirm the password in PRTG matches - retype it, do not trust your memory
  3. Check the target's Windows Firewall WMI rule group is enabled
  4. Try the same query from the probe machine with Windows' own WMI tools - if Windows itself cannot connect, PRTG is not the problem
  5. Only then look at the sensor settings themselves

Nine times out of ten the ladder ends at step 1 or 2.

Security note, honestly: a monitoring account with admin rights everywhere is a valuable key. Give it a long password, use it for nothing else, and never type it into random tools. PRTG stores it to do its job - treat the PRTG server itself as a sensitive machine from that day on.

Watch the Complete PRTG Setup in the Video

Every sensor in this guide is created live in the video - installation, discovery, CPU and RAM, bandwidth and firewall status.

Watch Full Video
Frequently Asked Questions

Can PRTG monitor CPU and RAM without admin rights?

Not through WMI - the performance data sits behind administrator boundaries in Windows. Alternatives exist for some data (SNMP on servers that run an SNMP service, or performance counters exposed other ways), but the standard, reliable route is a proper admin monitoring account.

Why do all my WMI sensors fail at the same time?

Shared cause, shared failure: the monitoring account's password expired or changed, the probe lost network access, or a firewall rule changed. Simultaneous failure is a gift - it points at the one thing all sensors share.

Is SNMP better than WMI for Windows servers?

They answer different questions. SNMP on Windows is limited and needs the SNMP service installed; WMI gives full CPU, memory, disk and service detail. Use WMI for Windows depth, SNMP for network devices, and respect WMI's weight on the probe.

This guide is based on the PRTG monitoring video by Technical Anshu - stuck on any step, ask in the video comments and you will get an answer.