---
schema_version: "1"
id: 3e25cdb4c75de3a34076ab0cf3e7a5e2b07ef486e5fd3c5133d709312fd98188
title: Prepare the Discovery Application Host for Agentless Scans
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_discovery_prepare_app_host.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_prepare_app_host.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 8f09af38b2f80cf634e08e68f0e159c1419d5f1ae8baeca1ca6fa417e321f7c3
description: Run reliable agentless scans and keep asset data in CMDB current by preparing a Windows host for the Discovery Application. Provide outbound access to Salesforce, protocol-specific access to target systems, and a service account with local administrator access. Verify connectivity so the application can run scan jobs and return results for processing.
products:
  - Service Cloud
  - Agentforce IT Service
release: "264"
---
# Prepare the Discovery Application Host for Agentless Scans

Run reliable agentless scans and keep asset data in CMDB current by preparing a Windows host for the Discovery Application. Provide outbound access to Salesforce, protocol-specific access to target systems, and a service account with local administrator access. Verify connectivity so the application can run scan jobs and return results for processing.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions with Agentforce IT Service that have Discovery enabled.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d38335e74">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d38335e74 ">Manage Discovery Application</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d38335e74 ">IT Service Asset Discovery</td>

          </tr>
        </tbody>
      </table>

The Discovery Application uses an outbound HTTPS connection to Salesforce and protocol-specific connections to target systems. For more information, see [How the Discovery Application Connects Salesforce and Target Systems](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_app_communication.htm&release=264.0.0&type=5 "Keep asset data in CMDB accurate and current with reliable agentless scans. Understand how the Discovery Application receives scan instructions from Salesforce, collects asset details from target systems through supported protocols, and returns scan results to Salesforce for processing. Use this communication flow to plan network access.").

Use a Discovery Application host that meets these requirements:

- Windows Server 2019 or later. Windows Server 2022 is recommended.
- An x86-64 processor with 12 to 16 CPU cores. ARM-based processors, including AWS Graviton processors, aren't supported.
- 16 GB of RAM.
- 50 GB of disk space.
- Google Chrome.

Prepare the Windows host before you install the Discovery Application. The host location, network access, and service account determine which target systems the application can reach and scan.

1. Choose a dedicated physical or virtual Windows host that stays powered on and connected to the network.
2. Place the host in the network domain that contains the target systems.
    
    To scan target systems in another domain, work with your network and security teams to establish the required trust between the domains.
3. Allow persistent outbound HTTPS traffic on port 443 from the host to Salesforce.
4. Allow protocol-specific traffic from the host to each target network.
    
    The selected probes determine the required access:
    
    - Windows Management Instrumentation (WMI) or PowerShell Remoting for Windows
    - Secure Shell (SSH) for Linux and macOS
    - Simple Network Management Protocol (SNMP) for network devices
    - HTTPS APIs for supported virtualization targets
5. Create or identify the Windows account that the Discovery Application service uses.
    
    Grant the account local administrator access on the Discovery Application host. The service uses this account to initiate connections to target systems. After you install the Discovery Application, configure the Salesforce Discovery Application Windows service to run with this account, and then restart the service.
6. If you plan to use PowerShell Remoting scans, turn on Windows Remote Management (WinRM) on the Discovery Application host.
    
    Run this PowerShell command as an administrator:
    
    ```
    Enable-PSRemoting -Force
    ```
    
    To verify that WinRM is running and starts automatically, run:
    
    ```
    Get-Service WinRM | Select-Object Status, StartType
    ```
7. Verify that the host can connect to Salesforce and to a representative target in each network segment that you plan to scan.

Download and install the Discovery Application on the prepared host. For more information, see [Download and Install the Discovery Application](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_create_disc_app.htm&release=264.0.0&type=5 "Use the Discovery Application to perform agentless scans and collect asset data without installing software on each device. The Discovery Application runs on a Windows host and securely connects with your network to detect systems, identify configurations, and send discovery data to Configuration Management Database (CMDB) for processing.").