---
title: "Windows scanning requirements | Lansweeper Platform"
slug: "windows-scanning-requirements"
description: "Review the requirements to scan Windows computers with Lansweeper Network Discovery over WMI, including scan account permissions and firewall ports."
tags: ["Lansweeper Platform", "Discovery and scanning", "Network Discovery"]
updated: 2026-09-25T16:05:59Z
published: 2026-09-25T16:05:59Z
canonical: "docs.lansweeper.com/windows-scanning-requirements"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lansweeper.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Windows scanning requirements

Network Discovery collects Windows data over Windows Management Instrumentation (WMI) and DCOM, with some details read from the registry. To scan a Windows computer, the sensor needs network access to the machine and a discovery credential for a scan account with the right permissions.

You don't need a local administrator account for most data. A dedicated least-privilege account covers hardware, operating system, software, and services. Local administrator rights unlock the remaining sections, such as logged-on users, printers, and certificates.

              Can't reach a computer over the network?

              

For remote or off-network computers that a sensor can't scan over WMI, use [IT Agent Discovery](/docs/what-is-it-agent-discovery) instead. The agent runs on the endpoint and sends its inventory back to your site.

## How Network Discovery scans Windows

The sensor queries the target computer over WMI and DCOM using a **Windows (WMI/DCOM)** discovery credential assigned to its hub. The Windows Management Instrumentation service must be running on the target.

## Scan account permissions

How much data you collect depends on the permissions you grant the scan account. There are two levels.

### Least-privilege account (recommended)

A dedicated non-admin account returns most inventory when you grant it the following on each target computer:

- Membership of the **Distributed COM Users** and **Performance Monitor Users** local groups.
- WMI read access to the `root\cimv2` namespace (Enable Account and Remote Enable).
- DCOM Local and Remote Launch and Activation permissions.
- Read access to the registry keys Network Discovery reads for OS and software inventory.

This covers hardware, operating system, installed software, services, and event logs. It can't collect logged-on users, printers, per-user software, security event logs, network shares, or certificates.

### Local administrator account

Add the account to the **Administrators** group on the target for a full scan of every section. No other configuration is needed.

## Domain-joined and workgroup computers

The account type differs by environment:

- **Domain-joined**: Use a domain account. One credential can scan many machines at once. To also collect Active Directory data, add an [Active Directory Domain Controller credential](/docs/create-discovery-credentials) with read access to the domain.
- **Workgroup**: Use a local account that exists on each target computer, since workgroup machines don't share domain accounts.

## Firewall requirements

Allow these inbound connections from the sensor to each target computer:

| Port | Purpose |
| --- | --- |
| TCP 135 | RPC endpoint mapper |
| TCP 445 | SMB |
| TCP 49152-65535 | DCOM dynamic port range, unless restricted by policy |
| TCP 5985 / 5986 | WinRM, only for Hyper-V or cluster log collection |

For the full list of protocols and ports across all asset types, see the [IT and OT sensor requirements](/docs/discovery-hub-and-sensor-requirements).

## Next steps

- [Create discovery credentials](/docs/create-discovery-credentials) for the Windows computers you want to scan.
- [Create a discovery action](/docs/create-a-network-discovery-action) to define what to scan, when, and with which credentials.

The Lansweeper Platform capability that discovers IP-connected devices on your network, including IT, OT, and IoT devices, and keeps their data up to date in your site. Network Discovery is made up of the hub, the IT sensor, the OT sensor, and the traffic sensor. The IT Agent and Cloud Discovery are separate discovery methods.

The authentication details Lansweeper uses to access an asset or service during discovery, such as a username and password, an SSH key, or an SNMP community string. Each credential has a type that matches the protocol or service it's used for, for example Windows (WMI/DCOM), SSH, SNMP, Active Directory, or VMware vCenter.