I have found loads of information on setting up monitoring via WMI using a non-admin user but with the control of WMI security being convoluted to deploy via GPO we accepted the risk of allowing a local admin user on most of our servers. On specific machines where that is not an acceptable risk like our DCs, we configured WMI to a non admin user (added it to WMI namespace security and included them in the DCOM Users and Performance Monitor Users groups), and it has all worked fine for monitoring CPU, memory, volumes, hardware health, etc, but this will not give us any control over services.
This has become more of an issue now I am trying to set up SAM to monitor things like AD and exchange.
Is there a way granting a user rights to monitor and control processes/services to fill in the gaps in our config. I REALLY don't want to be using a domain admin account for something like this.