Windows Management Instrumentation (WMI)

Windows Management Instrumentation (WMI) is a set of specifications from Microsoft for consolidating the management of devices and applications in a Windows network. WMI provides users with information about the status of local or remote computer systems.

The WMI adapter executes Command Prompt commands and WMI queries using the DCOM (Distributed Component Object Model) protocol that interacts with the WMI service.

Related Enforcement Actions:
WMI - Enrich Devices with DNS Records

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices

The WMI scan retrieves important information about the device, including (but not limited to):

• Hostname
• Network Interfaces - including MAC addresses, IP addresses, and subnets
• Operating system, kernel version, and distribution
• List of installed software
• Users and admin users
• Hard drives and file systems
• CPUs and RAM
• Hardware details, including serial numbers

Parameters

1. Hostnames / IPs / CIDRs List (required) - Specify a comma-separated list of hostnames, IP addresses or CIDRs to be scanned.
2. User Name and Password (required) - The credentials for a user account that has the permissions to run a WMI scan on the provided asset list specified in the Hostnames / IPs / CIDRs List field.
3. DNS Servers (optional, default: empty) - Specify a comma-separated list of DNS servers to be used to resolve the hostnames specified in the Hostnames / IPs / CIDRs List field.
   • If supplied, Axonius will use the specified DNS server to resolve the hostnames specified in the Hostnames / IPs / CIDRs List field. For each asset, the first response will be the one to be used.
   • If not supplied or if no response has been received from any of the specified DNS servers, the default DNS server will be used.
4. For details on the common adapter connection parameters and buttons, see Adding a New Adapter Connection.
   
   

Advanced Settings

1. Number of parallel connections (required, default: 5) - Specify the number of connections to be opened to control the performance of the scan.
2. Fetch software licenses information (default: false) - Select this option to fetch software licensing product information from each host. The results are presented in a list field called 'Software Licensing Product Information'.
3. Fetch Remote Desktop client access licensing information (default: false) - Select this option to fetch information from the Remote Desktop Client Access Licensing Server. This setting only works for RDS Licensing Server hosts. Refer to Activate the Remote Desktop Services license server to learn how to activate this on a host.
4. Fetch SQL Server License information - Set this option to search for Microsoft SQL Server license information on the machine’s registries and fetch it.
5. Fetch installed software from Win32_Product class - Select this option to fetch data from the Win32_Product class.
6. Registry keys to get key-value pairs - Enter Registry keys for which the system searches for the values on specific registries of the windows computer and stores them in a field called 'Validated Registry Keys - Existing Values' in the device.

Required Ports

• 135(RPC)
• 445 (SMB)
• Random port in the range 1024-65535 - see Setting Up a Fixed Port for WMI.

Required Permissions

The working directory for the files created via the WMI connection is 'ADMIN$\axonius'.

The value supplied in User Name and Password requires the following permissions:

• Either domain admin permissions or local admin permissions to the user/group that the user belongs to.
• Read/write access to the ADMIN$ share.