Requirements for authenticated scan targets running Windows

Views:

Review the port, account privilege, and service requirements a target device must meet before Network Vulnerability Scanner can run an authenticated vulnerability scan using Windows (SMB/WMI) credentials.

TrendAI Vision One™ can use SMB and WMI to remotely query installed software, Windows Update history, and system configuration on target devices. No files are placed on the target device during scanning.

Before TrendAI Vision One™ can run an authenticated vulnerability scan against a target device using Windows (SMB/WMI) credentials, the target device must meet the following requirements.

Required ports

The target device must allow inbound access on the following ports from the Service Gateway running the Network Vulnerability Scanner service. Required ports support Windows Management Instrumentation (WMI) and Distributed Component Object Model (DCOM) communication.

Port	Protocol	Purpose
445	SMB	File and printer sharing; used to connect to administrative shares
135	WMI/DCOM	Remote Procedure Call (RPC) endpoint mapper
49152–65535	WMI/DCOM	Dynamic port range used for DCOM communication

Account privileges

The scan account must have administrative privileges on the target device. The configuration required depends on the account type.

Built-in Administrator account (RID-500): Can be used directly for SMB/WMI remote access. No additional configuration is required.
Local account (non-built-in Administrator): Add the account to the Administrators group on the target device, and set the following registry value to allow remote access for the account:
```
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
LocalAccountTokenFilterPolicy = 1 (DWORD)
```
You can apply the setting using Group Policy, or run the following command with administrator privileges:
```
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
```
Domain account: Add the domain account or corresponding domain group to the local Administrators group on the target device. Setting LocalAccountTokenFilterPolicy is not required. Confirm that no domain Group Policy overrides the local security setting.

WMI service

The Windows Management Instrumentation service (Winmgmt) must be running on the target device. To verify the service status, run the following command:

sc query Winmgmt

If the service is not running, enable it with administrator privileges:

sc config Winmgmt start= auto
sc start Winmgmt

Important

When the scan account establishes WMI connections to multiple target devices and accesses administrative shares within a short period, the behavior might trigger lateral movement or network reconnaissance detection rules in endpoint security products.

To avoid triggering rules, add the source IP address of the Service Gateway running the Network Vulnerability Scanner service to your endpoint security and SIEM allow lists or exclusion rules. An increase in Windows security event volume on target devices during scanning is expected.

Some installed applications and Windows Update history might not appear in full in the scan results. Incomplete inventory data does not affect the accuracy of vulnerability detection.