Can I use WinRM instead of creating Windows credentials for Discovery?

[DhanarajG]

Hi Team,

We're planning to switch from WMI to WinRM for Windows discovery to avoid the dynamic port and firewall issues that come with WMI.

We came across the MID Server parameter mid.windows.management_protocol and set it to WinRM as per the documentation.

Our question is:

Do we still need to create Windows credentials in ServiceNow when using WinRM? Or can the MID Server service account be used directly without creating a credential record?

From what we’ve read, it looks like WinRM still requires authentication, but we want to confirm whether we can avoid creating separate Windows credentials and instead rely on the MID Server service account

Has anyone used WinRM in production without creating Windows credentials? Any guidance or gotchas would be appreciated.

Thanks!

[Vishnu-K]

Hi @DhanarajG ,

No, you don't strictly need a Windows credential record. If Discovery can't find a Windows credential in the Credentials table, it falls back to the login of the MID Server service account. WinRM still authenticates, just as that account instead of a stored credential.

The catch is that the MID service has to run as a domain account (not LocalSystem) with the right access on the targets, like local admin or Remote Management Users. It also only works where that account is trusted, so for multiple domains or untrusted hosts you'll still want credential records. Also double-check that no Windows credential in the table matches your IP ranges, because Discovery tries those first and a wrong one will fail instead of falling back.

If your real goal is to avoid handing out broad admin rights, JEA is worth a look. This walkthrough covers the setup and failure cases well: https://www.servicenow.com/community/itom-forum/article-jea-discovery-setup-full-walkthrough-and-eve.... Just note that with JEA you'd still need a discovery account on the targets to authenticate the WinRM session, plus the MID service account needing access to the signing certificate's private key.

I'd test on a small IP range first with Enter-PSSession from the MID host, and turn on debug logging if classification misbehaves.

Docs: https://www.servicenow.com/docs/r/australia/it-operations-management/discovery/r_PowerShellForDiscov... and https://www.servicenow.com/docs/r/australia/it-operations-management/discovery/t_EnableDeviceClassWi...

Hope this helps you if it did, please do mark it as helpful and accept the solution.

Thanks,

Vishnu