--- schema_version: "1" id: 180f15e32ac9a6ddc1555076477e1986e032cbb8b8d329e07707eb0e66719616 title: Prepare Windows Targets for Agentless Discovery collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_discovery_prepare_windows_targets.md canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_prepare_windows_targets.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 23399b1cd88e332108055f37315ab6a095bf2609dfb0e7935e275490c1f53e8c description: Improve Windows scan reliability and keep asset data in CMDB current by preparing target systems for agentless discovery. Configure account access, remote management, and firewall rules for the Windows Management Instrumentation (WMI) or PowerShell Remoting probe that you plan to use. products: - Service Cloud - Agentforce IT Service release: "264" --- # Prepare Windows Targets for Agentless Discovery Improve Windows scan reliability and keep asset data in CMDB current by preparing target systems for agentless discovery. Configure account access, remote management, and firewall rules for the Windows Management Instrumentation (WMI) or PowerShell Remoting probe that you plan to use. ### Required Editions
Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service that have Discovery enabled.
User Permissions Needed
To manage Discovery: IT Service Asset Discovery
To prepare a Windows target: Local administrator access on the target system
Prepare the Discovery Application host before you configure target systems. For more information about Discovery Application host requirements, see [Prepare the Discovery Application Host for Agentless Scans](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_prepare_app_host.htm&release=264.0.0&type=5 "Run reliable agentless scans and keep asset data in CMDB current by preparing a Windows host for the Discovery Application. Provide outbound access to Salesforce, protocol-specific access to target systems, and a service account with local administrator access. Verify connectivity so the application can run scan jobs and return results for processing."). The selected probe determines the connectivity and access requirements for the target. For more information about connectivity and access requirements, see [Agentless Discovery Network, Port, and Access Requirements](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_network_access_requirements.htm&release=264.0.0&type=5 "Improve agentless scan reliability and keep discovered asset data current. Review the connectivity and access requirements for each supported probe before you create discovery targets."). Windows Management Instrumentation (WMI) and PowerShell Remoting use different Windows services and access settings. Apply only the settings for the probe that you select when you create the discovery target. Agentless discovery doesn't install software on the target system. Windows discovery collects operating system, hardware, disk, network, service, process, installed software, update, and user profile information. PowerShell Remoting scans can also collect certificate, Internet Information Services (IIS), Network Load Balancing, Hyper-V, and physical disk information when those components are available. 1. Choose the probe that scans each Windows target. - **Deep Host Scan (WMIC, SSH, SNMP)** uses WMI for Windows targets. - **Deep Host Scan (SSH, SNMP, PowerShell)** uses PowerShell Remoting for Windows targets. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_note.png) Note Microsoft has discontinued the Windows Management Instrumentation Command-line (WMIC) utility on recent Windows releases. The **Deep Host Scan (WMIC, SSH, SNMP)** probe uses Windows Management Instrumentation (WMI), so you don't need to reinstall the WMIC utility. For more information, see [Windows Management Instrumentation Command-line (WMIC) removal from Windows](https://support.microsoft.com/en-us/servicing/os/windows/docs/2025/09/windows-management-instrumentation-command-line-wmic-removal-from-windows). 2. Create or identify a Windows local or domain account for the scan. Grant the account the access required by the selected probe. - For WMI, grant the account local administrator access on the target. - For PowerShell Remoting, add the account to the Administrators and Remote Management Users groups on the target. For domain-joined targets, use a domain account that has the required local access. A workgroup target can use a local account after you configure LocalAccountTokenFilterPolicy. 3. Allow inbound Internet Control Message Protocol version 4 (ICMPv4) Echo Requests from the Discovery Application host. The Discovery Application checks whether a target is reachable before it runs the selected probe. For Windows Firewall, run this PowerShell command as an administrator: ``` New-NetFirewallRule -DisplayName "Allow ICMPv4 Ping" -Direction Inbound -Action Allow -Protocol ICMPv4 -IcmpType 8 ``` If you use a third-party firewall, create an equivalent rule that limits the source to the Discovery Application host. 4. If the target uses WMI, allow remote service management and file sharing traffic from the Discovery Application host. For Windows Firewall, run these PowerShell commands as an administrator: ``` Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing" Enable-NetFirewallRule -DisplayGroup "Remote Service Management" ``` Allow TCP port 135 for RPC endpoint mapping, TCP ports 49152 to 65535 for dynamic RPC, and TCP ports 139 and 445 for SMB traffic from the Discovery Application host. If you use a third-party firewall, create equivalent rules for remote WMI access from the Discovery Application host. 5. If a WMI scan uses a local administrator account on a workgroup target, configure the LocalAccountTokenFilterPolicy registry value. This setting gives the local account its full administrative token during remote access. Review the security impact with your security team. Run this PowerShell command as an administrator, and then restart the target system: ``` New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name LocalAccountTokenFilterPolicy -Value 1 -PropertyType DWORD -Force ``` 6. If the target uses PowerShell Remoting, turn on Windows Remote Management (WinRM) on the target. Run this PowerShell command as an administrator: ``` Enable-PSRemoting -Force ``` Allow TCP port 5985 for WinRM over HTTP or TCP port 5986 for WinRM over HTTPS from the Discovery Application host, based on the transport that you use. Allow WinRM traffic from the Discovery Application host according to your network and security policies. If you use a third-party firewall, create equivalent rules for the transport that you use. 7. For a PowerShell Remoting scan of a workgroup target or a target in an untrusted domain, add the target to the TrustedHosts list on the Discovery Application host. Use a specific host name or IP address. For example, to trust a target with the IP address `192.168.1.100`, run this PowerShell command as an administrator: ``` Set-Item WSMan:\localhost\Client\TrustedHosts -Value "192.168.1.100" -Force ``` To trust multiple approved targets in a subnet, use a scoped pattern such as `192.168.1.*`. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_note.png) Note Setting TrustedHosts to `*` trusts all hosts. Use the global wildcard only when your organization's security policy permits it. In a trusted domain, Kerberos provides mutual authentication, so skip the TrustedHosts configuration. 8. From the Discovery Application host, verify that the target responds to an ICMP Echo Request and accepts a remote connection for the selected probe. The Windows target is ready for the Discovery Application to authenticate and run the selected WMI or PowerShell Remoting probe. Create a Windows discovery credential that uses the prepared account. For more information about discovery credentials, see [Create Discovery Credentials for Secure Scanning](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_create_cred.htm&release=264.0.0&type=5 "Use discovery credentials to securely connect to systems and collect data during agentless scans. Credentials authenticate access to devices, applications, and cloud environments without manual sign-in. Create and manage credentials for supported types such as Windows, SSH, SNMP, or AWS to ensure accurate and authorized discovery results."). Create the discovery target and select the probe that you prepared. For more information about discovery targets, see [Create a Discovery Target](https://help.salesforce.com/s/articleView?id=service.it_srvcs_discovery_create_target.htm&release=264.0.0&type=5 "Create a discovery target to define where and how agentless discovery scans IT environments. Targets define the systems, IP ranges, and environments included in agentless discovery. Each target also specifies probe types that determine how those systems are scanned. When a target runs, it creates a scan job that collects discovery data and updates asset information in Configuration Management Database (CMDB).").