Discovery scan for Windows workstations & servers

[MeadowsKath]

We've setup a Discovery scan with a Windows only behavior and using a credential alias. The problem we've got is our Ops teams do not what us to have a single set of credentials with admin access to both servers and workstations. The only option I see at this point is running two different scans; one with workstation credentials and one with server credentials. This is leading to hundreds of credential errors per scan, which is making it difficult to ascertain any true errors. Any suggestions on how to handle the errors or another solution that I'm not seeing?

One individual on an Ops team mentioned they might be okay with a single account IF ServiceNow can handle password rotation on a daily schedule. Has anyone been successful with this type of solution? If so, how did you implement it?

Thank you in advance. Katie

[Christopher Hub]

You can have a separate workstation and server credential and then include both credentials in the credential alias for a single schedule.  On the initial pass you will see failed connection attempts while affinity is established, but from that point on Discovery will know which credential worked with which device.  Remember also to tune the order/precedence of the credentials based on whether you expect to see more of one or the other to reduce credential errors slightly.

Another approach I've seen is if you have automated provisioning of devices you use a flow to pre-establish credential affinity when you know it in advance.

[drbob]

Yes, multiple credentials should work and I'm sure it's a perfectly reasonable ask. Depending on the size of your discovery you could encounter many passwords, I've seen per-host passwords in action before now. ....but that was the "Administrator" account and we didn't use that for discovery.

You could compromise on a discovery account that can only read the data it needs. Then you could use the same one everywhere as there's no danger of it being used maliciously (at least not to alter hosts, of course it could be used to see data on hosts still if it were compromised). This is probably easier to set up for Linux than Windows but I'm pretty sure it _can_ be done for Windows.

You could also push back and ask that if security of servers is so great then maybe they should be on their own subnet so that it can have tighter firewall controls. Then you can use server creds when scanning server IP ranges and client ones for client ranges. It's clearly not needed to solve this issue but if you need to have a discussion rather than just be told it's another point you can talk about.

Models could be anything from one password to as many as devices...

1 password everywhere

1 password per machine (you'd want to be pulling them from the password management system in this case)

1 password per office

1 password per country
1 password per security level (like your clients/servers but could also be admin/tech/dev/HR/finance/sales/etc.)

Any combination of the above and probably other models I haven't thought of

All these would work the only real issue is the management of the credential records - the more passwords the more management required ...unless you're interfacing to a system that manages them.

[matrixtushar]

Hi,

Have you heard of gMSA account? 

Its Windows inherent passwordless authentication. Create a gMSA account on the Active Directory and then get the group policy object created that puts this account into the Administrators Group. If you MID Server is running on Windows, configure the MID Server service to run in the context of this gMSA account. Viola!! Highest level of security available for Windows platform.

This account password is auto-generated and gets changed every day; everywhere! Passwordless authentication for your discovery.