---
updatedAt: 2026-10-06T09:21:59.000Z
agentTools:
  projectIndex: https://docs.axonius.com/llms.txt
---

# Active Directory Initial Setup

if your environment requires WMI port configuration or a custom Windows share, complete the following steps before connecting the [Active Directory Certificate Service (AD CS)](/docs/adcs) or [Active Directory Federation Service (AD FS)](/docs/adfs) adapters.

## Setting Up a Fixed Port for WMI

The AD CS and AD FS adapters use WMI. WMI runs as part of a shared service host with ports assigned through DCOM by default. However, you can set up the WMI service to run as the only process in a separate host and specify a fixed port. For more details, see [Microsoft Documentation - Setting Up a Fixed Port for WMI](https://docs.microsoft.com/en-us/windows/win32/wmisdk/setting-up-a-fixed-port-for-wmi?redirectedfrom=MSDN).

To set up a fixed port for WMI:

1. At the command prompt, type:

```
winmgmt -standalonehost
```

2. Stop the WMI service by typing:

```
net stop "Windows Management Instrumentation"
```

or:

```
net stop winmgmt
```

3. Restart the WMI service again in a new service host by typing:

```
net start "Windows Management Instrumentation" 
```

or:

```
net start winmgmt
```

4. Establish a new port number for the WMI service by typing (e.g. the following example will establish port TCP 24158):

```
netsh advfirewall firewall add portopening TCP 24158 WMIFixedPort
```

<Callout icon="📘" theme="info">
  Note

  If you are running an old Windows Server version, it might need to run the deprecated command version (`netsh firewall`).
</Callout>

To undo any changes you make to WMI, type:

```
winmgmt /sharedhost
```

Then stop and start the *winmgmt* service again.

## Creating a Custom Share

You can create a custom share and directory instead of ADMIN$ \ axonius. A custom share that is properly configured enables you to not require full local admin permissions to fetch data.

To create a custom share:

1. Create a local user, such as 'axonius-usr'.

2. Add the user to the following groups:

   * Distributed COM Users
   * Remote Management Users

3. Create a directory for Axonius to use to store temporary files and to serve as a working directory, for example: C:\axonius.
   The name of this directory may be used later in the adapter configuration in Axonius.

4. Grant the following permissions to the local user:

   * Read
   * Write
   * Modify
   * Execute (or full control) permissions on the custom directory, subdirectories, and files

5. Share the directory that you created by using Sharing or Advanced Sharing. Verify that the local user has full permissions for this share. Specify a descriptive name for the shared directory, preferably a name which ends with a dollar-sign, such as: AxoniusShare$
   The name of this share will be used later in the adapter configuration in Axonius.

6. Open WMI Management (wmimgmt.msc). Under **Security**, select **Root (minimal: root/cimv2)** namespace.

7. Click **Security**. Add the local user.

8. Click **Advanced**.

9. From the **Applies to** dropdown, select **This namespace and subnamespaces**.

10. Under the **Allow** column for the local user, select the **Execute Methods**, **Enable Account**, and **Remote Enable** options, and then click **OK**.

11. In Axonius, verify that the **Custom Share Name** and **Custom Files Directory** parameters are configured. The adapter will attempt to create the specified directory under the share.

12. If the above step fails, it means some sharing options are not enabled on the server. In such a case, add the full path to the share under **Custom Working Directory**.

<Callout icon="📘" theme="info">
  Note

  When using Custom Working Directory, this directory must be identical to all adapter connections, and must be specified in all adapter connections, even if using a local admin. Only use this option as a last resort.
</Callout>