Prepare Windows Targets for Agentless Discovery

Improve Windows scan reliability and keep asset data in CMDB current by preparing target systems for agentless discovery. Configure account access, remote management, and firewall rules for the Windows Management Instrumentation (WMI) or PowerShell Remoting probe that you plan to use.

Required Editions

Available in: Lightning Experience

Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service that have Discovery enabled.

User Permissions Needed
To manage Discovery:	IT Service Asset Discovery
To prepare a Windows target:	Local administrator access on the target system

Prepare the Discovery Application host before you configure target systems. For more information about Discovery Application host requirements, see Prepare the Discovery Application Host for Agentless Scans.

The selected probe determines the connectivity and access requirements for the target. For more information about connectivity and access requirements, see Agentless Discovery Network, Port, and Access Requirements.

Windows Management Instrumentation (WMI) and PowerShell Remoting use different Windows services and access settings. Apply only the settings for the probe that you select when you create the discovery target. Agentless discovery doesn't install software on the target system.

Windows discovery collects operating system, hardware, disk, network, service, process, installed software, update, and user profile information. PowerShell Remoting scans can also collect certificate, Internet Information Services (IIS), Network Load Balancing, Hyper-V, and physical disk information when those components are available.

Choose the probe that scans each Windows target.
- Deep Host Scan (WMIC, SSH, SNMP) uses WMI for Windows targets.
- Deep Host Scan (SSH, SNMP, PowerShell) uses PowerShell Remoting for Windows targets.
Note Microsoft has discontinued the Windows Management Instrumentation Command-line (WMIC) utility on recent Windows releases. The Deep Host Scan (WMIC, SSH, SNMP) probe uses Windows Management Instrumentation (WMI), so you don't need to reinstall the WMIC utility. For more information, see Windows Management Instrumentation Command-line (WMIC) removal from Windows.
Create or identify a Windows local or domain account for the scan.
Grant the account the access required by the selected probe.
- For WMI, grant the account local administrator access on the target.
- For PowerShell Remoting, add the account to the Administrators and Remote Management Users groups on the target.
For domain-joined targets, use a domain account that has the required local access. A workgroup target can use a local account after you configure LocalAccountTokenFilterPolicy.
Allow inbound Internet Control Message Protocol version 4 (ICMPv4) Echo Requests from the Discovery Application host.
The Discovery Application checks whether a target is reachable before it runs the selected probe. For Windows Firewall, run this PowerShell command as an administrator:
```
New-NetFirewallRule -DisplayName "Allow ICMPv4 Ping" -Direction Inbound -Action Allow -Protocol ICMPv4 -IcmpType 8
```
If you use a third-party firewall, create an equivalent rule that limits the source to the Discovery Application host.
If the target uses WMI, allow remote service management and file sharing traffic from the Discovery Application host.
For Windows Firewall, run these PowerShell commands as an administrator:
```
Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing"
Enable-NetFirewallRule -DisplayGroup "Remote Service Management"
```
Allow TCP port 135 for RPC endpoint mapping, TCP ports 49152 to 65535 for dynamic RPC, and TCP ports 139 and 445 for SMB traffic from the Discovery Application host.

If you use a third-party firewall, create equivalent rules for remote WMI access from the Discovery Application host.
If a WMI scan uses a local administrator account on a workgroup target, configure the LocalAccountTokenFilterPolicy registry value.
This setting gives the local account its full administrative token during remote access. Review the security impact with your security team. Run this PowerShell command as an administrator, and then restart the target system:
```
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name LocalAccountTokenFilterPolicy -Value 1 -PropertyType DWORD -Force
```
If the target uses PowerShell Remoting, turn on Windows Remote Management (WinRM) on the target.
Run this PowerShell command as an administrator:
```
Enable-PSRemoting -Force
```
Allow TCP port 5985 for WinRM over HTTP or TCP port 5986 for WinRM over HTTPS from the Discovery Application host, based on the transport that you use.

Allow WinRM traffic from the Discovery Application host according to your network and security policies. If you use a third-party firewall, create equivalent rules for the transport that you use.
For a PowerShell Remoting scan of a workgroup target or a target in an untrusted domain, add the target to the TrustedHosts list on the Discovery Application host.
Use a specific host name or IP address.

For example, to trust a target with the IP address 192.168.1.100, run this PowerShell command as an administrator:
```
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "192.168.1.100" -Force
```
To trust multiple approved targets in a subnet, use a scoped pattern such as 192.168.1.*.

Note Setting TrustedHosts to * trusts all hosts. Use the global wildcard only when your organization's security policy permits it.

In a trusted domain, Kerberos provides mutual authentication, so skip the TrustedHosts configuration.
From the Discovery Application host, verify that the target responds to an ICMP Echo Request and accepts a remote connection for the selected probe.

The Windows target is ready for the Discovery Application to authenticate and run the selected WMI or PowerShell Remoting probe.

Create a Windows discovery credential that uses the prepared account. For more information about discovery credentials, see Create Discovery Credentials for Secure Scanning.

Create the discovery target and select the probe that you prepared. For more information about discovery targets, see Create a Discovery Target.