Discovery issues

[Joe Huizar]

Hi All,

I have a question when it comes to Discovery. Our Security team and Infra mgrs make it hard for Discovery to scan the network for assets. So, my questions is Discovery Agent (client) Base, Remote unauthenticated scanning  Authentication, or authenticated scanning? 

Is there away for a non-administrator to run Discovery on a machine?

if Discovery is not executed on an asset, where can i find the error or problem as to why Discovery was not able to scan an asset?

thanks,

J 

[harun_isakovic]

At minimum you need role "agent_client_collector_admin" to run discoveries on demand, otherwise some admin can setup a Discovery Schedule.

As for where to find discovery errors, this can be found in the Discovery Status record there is a related list in them. Theyre numbered like DISxxxxxx if I remember correctly.

[Jim Palmer]

Joe,

I assume under this question "Is there away for a non-administrator to run Discovery on a machine?" you're asking about  non-admin credentials on the discovery target (Windows/*nix).

There are a lot of resources on the web available on how to get non administrative accounts working for Windows discovery purposes. You can use either WinRM (recommended) or WMI, and it requires a bit of setup on each target, that's why it's generally easier just to ask for local Administrative credentials, because admins get all the required access by default (though this does encourage giving admin where it's not strictly required, violating the security principle of 'least privilege').

Adding the user to the group "Remote Management Users" might allow access, but there will probably be more access limitations as you get further into the discovery stack as their privileges will be restricted to the rights they have on the corresponding machine. But it's a good place to start.

For *nix I find it easier (as I'm a *nix person), because it's just a normal user using SSH keys with additional sudo rights to the commands you want. Again, you can be specific and use an allow list of commands or just open everything up.

Talk to your platform admins about this, they should have experience setting up accounts this way.

Also:

There's this in Rome for Windows: https://docs.servicenow.com/bundle/rome-it-operations-management/page/product/discovery/concept/microsoft-jea-discovery.html

There's also this to test individual commands as part of discovery: https://docs.servicenow.com/bundle/rome-it-operations-management/page/product/it-operations-management/task/validate-discovery-commands.html