Configuring WMI and PowerShell for Use in Computer Discovery Scanning

This page describes best practices on how to configure and troubleshoot WMI (Windows Management Instrumentation) and Windows PowerShell to use them for Syteca’s Account Discovery feature, so as to maximize the number of privileged accounts the system can find when running Computer Discovery rules (i.e. to find local Windows accounts on the target computers).

NOTE: Either of these tools can be used for scanning, but by default both run concurrently, and accounts found are not duplicated (i.e. only one account is discovered and displayed on the Privileged Accounts tab on the Account Discovery page).

The WMI scanner can only find privileged local accounts that are part of the default Administrators group, whereas the Windows PowerShell scanner can also find all local accounts with any privileged permissions (e.g. Act as part of the operating system (SeTcbPrivilege), Back up files and directories (SeBackupPrivilege), etc.) that were granted via GPO.

Table of Contents

1. Keys in the .config File

The values of the keys can be changed by adding/modifying them in the "EkranServer.Settings.config" file, which can be found in the C:\Program Files\Ekran System\Ekran System\Server folder on the computer where Syteca Application Server is installed.

2. Prerequisites for Computer Discovery

2.1. WMI Scanner Prerequisites

Check the following:

1. Make sure that the value of the "WmiConnectionTimeoutSeconds" key is valid in the EkranServer.Settings.config file (see the table above).

NOTE: The default value of 20 (seconds) should normally be sufficient to find Windows local accounts by the computer where Syteca Application Server is installed, while a high timeout value may increase the time required to scan any target computers in the network that are unreachable.

2. Make sure you have correctly set up the required rules in Windows Firewall on both computers (i.e. on the computer where Syteca Application Server in installed, and on the target endpoint computers that you want to find accounts on). 

a) Press Win+R, and then enter firewall.cpl, and  press Enter.

b) Click the Allow an app or feature through Windows Defender Firewall option (on the left).

c) Click the Change settings button to disable it.

d) In the list of Allowed apps and features, find Windows Management Instrumentation (WMI) and allow it in the Private, Public and Domain columns (or as required).

3. Make sure that the target computers are online (as offline computers cannot be found while scanning), and that the Windows local accounts on these computers have not been disabled.

4. Make sure that the target computers have the latest Windows cumulative updates installed.

2.2. PowerShell Scanner Prerequisites

Check the following:

1. Make sure the value of the "PowerShellConnectionTimeoutSeconds" key is valid in the EkranServer.Settings.config file (see the table above).

NOTE: The default value of 20 (seconds) should normally be sufficient to find Windows local accounts by the computer where Syteca Application Server is installed, while a high timeout value may increase the time required to scan any target computers in the network that are unreachable.

2. Make sure the WinRM service is enabled on both the computer where Syteca Application Server is installed, and the computers to be scanned.

NOTE: The WinRM service is enabled by default only on Windows Server operating systems. If you want to scan computers with OSs such as Windows 10 or 11, you must first turn on this service, which can be done by opening the PowerShell console and running the following command to check that the WinRM service is enabled:

Get-Service WinRM

 If it is not enabled, run the following command to turn on this service:

Enable-PSRemoting -Force

NOTE: The above command also sets the service to be Automatic (i.e. automatically -starts after a reboot) and configures the firewall rules to allow incoming WinRM connections.

3. Make sure the computer where Syteca Application Server is installed and the computers to be scanned are located in the same domain. If they are not, you need to add the hostnames or IP addresses of the computers to be scanned to the list of trusted hosts on the computer where Syteca Application Server is installed, by running the following command:

Set-Item wsman:\localhost\Client\TrustedHosts -Value "<hostname or IP>"

NOTE: Multiple hostnames or IP addresses can be specified, separated by commas (e.g. "10.150.1.1,10.150.2.2,MyCompName") or asterisks can be used for a range of IP addresses (e.g. "10.150.*", or even just "*" to trust them all, although the latter is not recommended).

4. Make sure the firewall rules allow WinRM connections, by checking that the Windows Remote Management (HTTP-In) inbound rule on the computers to be scanned is enabled, and port 5985 also needs to be allowed.

5. Make sure the computer where Syteca Application Server is installed and the target computers to be scanned use the same time. NOTE: Different time zones can be used, but a PowerShell remote session cannot be initiated if, for example, a Client computer is 10+ seconds apart from the Application Server computer, so they must use the same time server. An alternative option to resolve this issue is to add the Client hostname or IP address to the list of trusted hosts.

6. Make sure that the computers to be scanned are online, as offline computers cannot be found by scanning.

7. Make sure that the WMI service is running on the computers to be scanned. It should be always running by default on all Windows computers, but may have been turned off manually.

Additionally, if you want to use an HTTPS connection (instead of the default HTTP) for PowerShell scanning, you need to set up an HTTPS listener on the computers you want to scan, by doing the following:

1. Generate a self-signed certificate on the computer you want to scan, by running the following command:

New-SelfSignedCertificate -DnsName "<machine name>.<domain name>", "<machine name>", "<IP address>" -CertStoreLocation Cert:\LocalMachine\My -KeyUsage KeyEncipherment, DigitalSignature -Type SSLServerAuthentication

2. Use the thumbprint of the certificate created when setting up the listener on the computer you want to scan, by running the following command (where the thumbprint is displayed when generating the certificate above):

winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="<machine name>.<domain name>"; CertificateThumbprint="<thumbprint>"}

NOTE:  Run this command in cmd, as it does not work in the PowerShell console.

3. Configure the firewall on the computer you want to scan to enable port 5986, by running the following command:

New-NetFirewallRule -Name "WinRM HTTPS" -DisplayName "WinRM HTTPS" -Protocol TCP -LocalPort 5986 -Action Allow

4. Export the certificate generated (before copying it to the computer where the Application Server is installed), by running the following command:

Export-Certificate -Cert Cert:\LocalMachine\My\<thumbprint> -FilePath <path>\<certificate name>.cer

5. Import this certificate on the computer where the Application Server is installed, and add it into the Trusted Root Certification Authority, by running the following command:

Import-Certificate -FilePath <path>\<certificate name>.cer -CertStoreLocation Cert:\LocalMachine\Root

NOTE: To set this up for multiple/all computers in the domain, a GPO can be used.

3. Troubleshooting Errors in the Application Server Logs

The Syteca Application Server log files can either be downloaded from the Management Tool or alternatively found in the following folder on the computer where the Application Server is installed: C:\Program Files\Ekran System\Ekran System\ServerLogs.

3.1. Troubleshooting Errors When Using WMI Scanning

3.2. Troubleshooting Errors When Using PowerShell Scanning