Windows scanning requirements

Network Discovery collects Windows data over Windows Management Instrumentation (WMI) and DCOM, with some details read from the registry. To scan a Windows computer, the sensor needs network access to the machine and a discovery credential for a scan account with the right permissions.

You don't need a local administrator account for most data. A dedicated least-privilege account covers hardware, operating system, software, and services. Local administrator rights unlock the remaining sections, such as logged-on users, printers, and certificates.

How Network Discovery scans Windows

The sensor queries the target computer over WMI and DCOM using a Windows (WMI/DCOM) discovery credential assigned to its hub. The Windows Management Instrumentation service must be running on the target.

Scan account permissions

How much data you collect depends on the permissions you grant the scan account. There are two levels.

Least-privilege account (recommended)

A dedicated non-admin account returns most inventory when you grant it the following on each target computer:

• Membership of the Distributed COM Users and Performance Monitor Users local groups.
• WMI read access to the root\cimv2 namespace (Enable Account and Remote Enable).
• DCOM Local and Remote Launch and Activation permissions.
• Read access to the registry keys Network Discovery reads for OS and software inventory.

This covers hardware, operating system, installed software, services, and event logs. It can't collect logged-on users, printers, per-user software, security event logs, network shares, or certificates.

Local administrator account

Add the account to the Administrators group on the target for a full scan of every section. No other configuration is needed.

Domain-joined and workgroup computers

The account type differs by environment:

• Domain-joined: Use a domain account. One credential can scan many machines at once. To also collect Active Directory data, add an Active Directory Domain Controller credential with read access to the domain.
• Workgroup: Use a local account that exists on each target computer, since workgroup machines don't share domain accounts.

Firewall requirements

Allow these inbound connections from the sensor to each target computer:

For the full list of protocols and ports across all asset types, see the Network Discovery requirements.

Next steps

• Create discovery credentials for the Windows computers you want to scan.
• Create a Network Discovery action to define what to scan, when, and with which credentials.