Browse documentation

Preparing a Windows server for agentless scanning

↩ Servers

Agentless Windows collection talks to the server over WinRM. The account you store in the WMI credential has to be set up a particular way — if it isn't, you get a 401 or, worse, a successful connection that quietly returns only part of the data.

⚠ The account must be a LOCAL account, not a domain account

JOATOS authenticates to WinRM using Basic authentication. WinRM checks Basic credentials against the target machine's own account database, so a domain account cannot sign in this way at all — it is refused with a 401 no matter what permissions you give it.

Create a local account on each Windows server you want to scan (a GPO or a short script can do this across a fleet).

The credential form's Domain field is a trap here. It exists because the username is sent as DOMAIN\user, but a real domain name will always fail. Leave it blank, or put the machine's own name in it — SERVER01\svc-joatos is a local account and is valid.

What the account needs

Requirement	Why
A local account on the target	Basic auth cannot authenticate a domain account
Member of the local Administrators group	Roles, WMI classes and Hyper-V queries all need an admin token
`LocalAccountTokenFilterPolicy = 1`	See below — without it, login succeeds and admin queries still fail

The one that catches everyone

A local account in Administrators that is not the built-in Administrator gets a filtered, standard-user token when it connects over the network. Windows does this on purpose (UAC remote restrictions). The effect is confusing: the credential tests fine, then stats and roles come back empty with access-denied errors.

Run this once on each target, as an administrator:

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ^
  /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

Enabling WinRM on the server

Run as an administrator on the target:

winrm quickconfig -quiet
winrm set winrm/config/service/auth @{Basic="true"}

HTTPS (port 5986) is the default and the recommended setting. To create the listener:

$cert = New-SelfSignedCertificate -DnsName $env:COMPUTERNAME -CertStoreLocation cert:\LocalMachine\My
winrm create winrm/config/listener?Address=*+Transport=HTTPS @{Hostname="$env:COMPUTERNAME";CertificateThumbprint="$($cert.Thumbprint)"}
netsh advfirewall firewall add rule name="WinRM-HTTPS" dir=in localport=5986 protocol=TCP action=allow

With a self-signed certificate, leave Verify SSL certificate unchecked on the credential — see Credential types.

Using plain HTTP (port 5985) also needs winrm set winrm/config/service @{AllowUnencrypted="true"} on the server, and the credential must have both HTTPS turned off and the insecure-HTTP option explicitly enabled. Basic over HTTP sends the password in a trivially reversible form, so this is for lab use only.

If some data is missing rather than everything

Each query is independent, so an under-privileged account produces partial data and no error. Use this to work out what's missing:

What's missing	What the account needs
Nothing works, 401	Account isn't local, or Basic auth isn't enabled on the server
Services and software arrive, stats don't	WMI permissions on `root\cimv2` — normally means not an admin
Roles and features are empty	Local administrator and a Server OS — the command doesn't exist on Windows 10/11
Security events missing, System and Application present	Add the account to Event Log Readers
Hyper-V guests missing	Add the account to Hyper-V Administrators
Everything empty after a successful test	`LocalAccountTokenFilterPolicy` — see above

Notes & tips

TrustedHosts is not involved. It's a setting on the connecting machine for Windows' own WinRM client, and JOATOS doesn't use that client. It's the first thing most people try; it won't help.
Where the site has a Site Collector, it does the polling, so port 5986 only needs to be reachable from the collector, not from the internet.
A failed poll records an error against the server and leaves its up/down status alone — see Choosing a collection method.

PreviousChoosing a collection method NextReading server stats and disks