The allow this agent to act as a proxy and discover managed objects on other computers is used for several purposes. In general it is one entity talking on behalf of another one. For instance...
Cluster nodes talking on behalf of virtual resources. domain controlelrs talking on behalf of domain. ISA/CSS/TMG servers on behalf of the array. Exchange on behalf of organizational entities, SQL, scom management server on behalf of agents, citrix for the
farm. So there are a lot of roles that would need this setting. In every management pack guide (so for every mp guide) it states whether or not this setting is needed. For an example check this page
http://technet.microsoft.com/en-us/library/dd491041.aspx for the clustering MP.
The potential risk this poses is that an agent that has this setting enabled could be flooded by a hack or whatever and thus pass everything on to the scom servers and flood that one as well. Potentially generating alerts coming from another server (proxy)
or flooding the boxes. I have never seen or heard anything like this happening. It is just mentioned as a possibility.
There are environments where they run a script every day or week that just enables all agents for proxy. I would not be too worried about it in most cases.
I think for Hyper-v it is not needed as that MP does not say much about the guests, but is more targetted at the host itself, its role, performance, events and things like that. However it doesnt hurt to enable the proxy.
Bob Cornelissen - BICTT (
My BICTT Blog)
