---
title: "Windows scanning requirements | Lansweeper Platform"
slug: "windows-scanning-requirements"
description: "Review the requirements to scan Windows computers with Lansweeper Network Discovery over WMI, including scan account permissions and firewall ports."
status: "update"
updated: 2026-07-23T19:48:33Z
published: 2026-07-23T19:48:33Z
canonical: "docs.lansweeper.com/windows-scanning-requirements"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lansweeper.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Windows scanning requirements

Network Discovery collects Windows data over Windows Management Instrumentation (WMI) and DCOM, with some details read from the registry. To scan a Windows computer, the sensor needs network access to the machine and a discovery credential for a scan account with the right permissions.

You don't need a local administrator account for most data. A dedicated least-privilege account covers hardware, operating system, software, and services. Local administrator rights unlock the remaining sections, such as logged-on users, printers, and certificates.

              Can't reach a computer over the network?

              

For remote or off-network computers that a sensor can't scan over WMI, use [IT Agent Discovery](/docs/what-is-it-agent-discovery) instead. The agent runs on the endpoint and sends its inventory back to your site.

## How Network Discovery scans Windows

The sensor queries the target computer over WMI and DCOM using a **Windows (WMI/DCOM)** discovery credential assigned to its hub. The Windows Management Instrumentation service must be running on the target.

## Scan account permissions

How much data you collect depends on the permissions you grant the scan account. There are two levels.

### Least-privilege account (recommended)

A dedicated non-admin account returns most inventory when you grant it the following on each target computer:

- Membership of the **Distributed COM Users** and **Performance Monitor Users** local groups.
- WMI read access to the `root\cimv2` namespace (Enable Account and Remote Enable).
- DCOM Local and Remote Launch and Activation permissions.
- Read access to the registry keys Network Discovery reads for OS and software inventory.

This covers hardware, operating system, installed software, services, and event logs. It can't collect logged-on users, printers, per-user software, security event logs, network shares, or certificates.

### Local administrator account

Add the account to the **Administrators** group on the target for a full scan of every section. No other configuration is needed.

## Domain-joined and workgroup computers

The account type differs by environment:

- **Domain-joined**: Use a domain account. One credential can scan many machines at once. To also collect Active Directory data, add an [Active Directory Domain Controller credential](/docs/create-discovery-credentials) with read access to the domain.
- **Workgroup**: Use a local account that exists on each target computer, since workgroup machines don't share domain accounts.

## Firewall requirements

Allow these inbound connections from the sensor to each target computer:

| Port | Purpose |
| --- | --- |
| TCP 135 | RPC endpoint mapper |
| TCP 445 | SMB |
| TCP 49152-65535 | DCOM dynamic port range, unless restricted by policy |
| TCP 5985 / 5986 | WinRM, only for Hyper-V or cluster log collection |

For the full list of protocols and ports across all asset types, see the [Network Discovery requirements](/docs/discovery-hub-and-sensor-requirements).

## Next steps

- [Create discovery credentials](/docs/create-discovery-credentials) for the Windows computers you want to scan.
- [Create a Network Discovery action](/docs/create-a-network-discovery-action) to define what to scan, when, and with which credentials.