Windows Management Instrumentation (WMI)

Windows Management Instrumentation (WMI) is a set of specifications from Microsoft for consolidating the management of devices and applications in a Windows network. WMI provides users with information about the status of local or remote computer systems.

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices
  
  

Parameters

1. Hostnames / IPs / CIDRs List (required) - Specify a comma-separated list of hostnames, IP addresses or CIDRs to be scanned.
2. User Name and Password (required) - The credentials for a user account that has the permissions to run a WMI scan on the provided asset list specified in the Hostnames / IPs / CIDRs List field.
3. DNS Servers (optional, default: empty) - Specify a comma-separated list of DNS servers to be used to resolve the hostnames specified in the Hostnames / IPs / CIDRs List field.
   • If supplied, Axonius will use the specified DNS server to resolve the hostnames specified in the Hostnames / IPs / CIDRs List field. For each asset, the first response will be the one to be used.
   • If not supplied or if no response has been received from any of the specified DNS servers, the default DNS server will be used.
4. For details on the common adapter connection parameters and buttons, see Adding a New Adapter Connection.
   
   

Advanced Settings

1. Number of parallel connections (required, default: 5) - Specify the number of connections to be opened to control the performance of the scan.

Required Ports

• 135(RPC)
• 445 (SMB)
• Random port in the range 1024-65535

Setting up a fixed port for WMI

WMI runs as part of a shared service host with ports assigned through DCOM by default. However, you can set up the WMI service to run as the only process in a separate host and specify a fixed port. For more details, see Microsoft Documentation - Setting Up a Fixed Port for WMI.

To set up a fixed port for WMI:

1. At the command prompt, type:

winmgmt -standalonehost

2. Stop the WMI service by typing:

net stop "Windows Management Instrumentation"

or:

 net stop winmgmt

3. Restart the WMI service again in a new service host by typing:

net start "Windows Management Instrumentation" 

or:

net start winmgmt

4. Establish a new port number for the WMI service by typing (e.g. the following example will establish port TCP 24158):

netsh firewall add portopening TCP 24158 WMIFixedPort

To undo any changes you make to WMI, type:

winmgmt /sharedhost

Then stop and start the winmgmt service again.

Required Permissions

The value supplied in User Name and Password must be able to execute PowerShell code which queries the provided asset list specified in the Hostnames / IPs / CIDRs List field.