Skip to main content
There are two scan modules for Windows systems. They capture the same thing—the difference is where the targets come from: Both ways can run side by side: the domain over Windows (AD), the exceptions over Windows (IP). The component selection is the same for both. In both cases a connected gateway is required, plus an account allowed to sign in to the target systems.

​
Prerequisites

The scan addresses the systems over WMI and additionally queries them through PowerShell.

​
Ports and protocols

​
Permissions

  • On Windows clients and servers the account needs local administrator rights; on domain controllers it needs domain administrator rights.
  • Enter domain accounts with the domain: DOMAIN\user (NetBIOS) or user@domain.local (UPN).
  • Enter a local account for Windows (IP) as .\user. The account and its password must be the same on all target systems.
  • With local administrator accounts, User Account Control (UAC) applies—see Common issues.
  • The Windows Management Instrumentation and Remote Procedure Call (RPC) services run on the target system.
  • If Windows (AD) runs without credentials of its own under the gateway’s service account, that account needs the rights above.

​
Network requirements

  • The firewall allows the ports above. In a domain, enable the predefined rules through Group Policy:
    • File and Printer Sharing (Echo Request - ICMPv4-In)
    • File and Printer Sharing (Echo Request - ICMPv6-In)
    • Windows Management Instrumentation (WMI-In)
    • Windows Management Instrumentation (DCOM-In)
    Systems in workgroups get the same rules in their local firewall.
  • Name resolution is unambiguous: forward and reverse lookup return the same result.
  • With Windows (AD), the systems are members of Active Directory.
  • With Windows (IP) and an address range, the systems respond to ping.
  • For a complete scan, PowerShell can run on the target system. If PowerShell is blocked, only the information that comes through PowerShell is missing, such as certificates; the scan itself succeeds.
The scan of a Windows system may take at most 10 minutes. For systems behind slow links, place a gateway closer to the systems or scan by script.
Systems the gateway cannot reach, such as mobile devices or systems outside Active Directory, you scan with the Discovery-Windows.exe scan script—see Scanning by Script.

​
Path A—Windows (AD)

The wizard shows five steps: Basics › Authentication › Scan Scope › Schedule › Summary Basics, Schedule and Summary are the same for every module—see Creating a Scan Job. Characteristic are the two steps in the middle.

​
Authentication

The step takes the Domain first and the Windows credentials below it: first it is settled which domain is captured, then which credentials are used. If the domain field is visible, it must be filled. After an Active Directory scan the domain is available for selection; without that scan, you enter it manually. You choose the credentials in a searchable picker. In first position stands the entry that lets the scan run under the gateway service’s account. Above it two rows create a new entry: New Credentials… a reusable one, One-Time Credentials… one that applies to this job only.
Windows (AD) and Active Directory are the two modules where credentials are not enforced: the step can be passed without an entry. Whether the scan then succeeds depends on which account the gateway service runs under in your network. For the first job an explicitly stored account is advisable.
Credentials entered once make the job not restartable later—to run it again they have to be entered afresh through Edit. For a recurring scan it is better to store them as a reusable entry in the Vault.

​
Scan Scope

The step carries two sections: System Selection and Windows Components. The initial state of System Selection is the full set: by default all Windows systems from Active Directory are scanned, and the selection can optionally be restricted. For a first job that is enough; the step can be passed without an entry. Restrict Selection… opens the Select Systems dialog, which searches Active Directory. You can narrow it down through the Filter… field, the Servers Only toggle and the state filters Active and Disabled; Select All takes the set found all at once.
The dialog needs three entries from the previous steps: gateway, domain and credentials. If one is missing, go back to Basics or Authentication.
Servers Only together with the state filter Active limits the selection to active servers; clients and disabled accounts stay out. You add the clients later with a second job.

​
Path B—Windows (IP)

Here the wizard follows the standard path through the Targets step: one row per target, with the columns IP/Hostname and Credentials. Into the target column may go a single address, a range, a network in CIDR notation (e.g. /24) or a hostname—a whole network therefore fits into one row. The Credentials for All Targets picker above the table applies to all rows without their own assignment; per row it can be deviated from. The details are in Creating a Scan Job.

​
Windows components

With both paths the most extensive option sits in the Windows Components section behind the Customize button: 22 options, 20 of them preselected. Not preselected are Certificates: Root and Browser Extensions.
Leave the preselection untouched for the first job. Afterwards you see in the job summary under Components how many were selected, and can adjust the selection deliberately—adding Certificates: Root for a compliance record, for instance.

​
Summary

​
Common issues

The registry value for local administrator accounts, set on the target system:
  • Active Directory – captures the directory itself instead of the systems in it. A job of its own, complementing these two.
The job appears in Scan › Active; how you watch and adjust it is in Managing Jobs. You complete the captured systems afterwards with ITAM data.