Discovery with UAC Enabled

[masahironaka]

We are attempting to discover Windows Server A from the MID Server.

Windows Server A has UAC enabled.
For security reasons, we would like to perform the discovery while keeping UAC enabled.
If we use a domain user with administrative privileges, would it be possible to perform discovery with UAC enabled?

Note:
We attempted to use a newly created user belonging to the "Administrators" group, but due to UAC being enabled, the discovery was unsuccessful.

[DaveMerrett]

Unfortunately, it's not something that can be done - 
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1638330

Q. Why does the User Access Control (UAC) need to be disabled for Windows Discovery? 

• The User Access Control (UAC) is a security feature present in the Windows operating system that is designed to prevent unauthorized changes to the system, even if the user account is part of the local Administrator group.
  
  
• However, during the discovery process, if the UAC is enabled on the Windows operating system where the discovery is being run, and the user account is part of the local Administrator group, we will not be able to perform any of the administrator tasks. This is because a prompt will appear to confirm if you wish to use admin privileges to complete the task. Since the discovery is run non-interactively, it will be unable to confirm a UAC prompt. Therefore, we recommend disabling the UAC to complete the job smoothly and retrieve the information we need without any interruptions.

For more details related to Windows Discovery, Please click here.

Now here is the kicker 😄 

ServiceNow Discovery errors often occur when User Account Control (UAC) is enabled on Windows machines because the automated discovery process cannot handle UAC prompts. To resolve this, it's recommended to disable UAC. If UAC is disabled, Discovery can then proceed without interruption to gather the necessary information from the target machine.

Now there are also three separate ways to potentially get around this.

• Group Policy:

  If the "Disabled" option for UAC is grayed out in Local Security Policy, it might be due to Group Policy or other configuration management tools that are blocking the change. You'll need to adjust the Group Policy settings to allow disabling UAC. 
• Windows Server 2019:

  Some customers have reported issues where disabling UAC through the Control Panel didn't fully disable it. In this case see https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1698519

• Alternative: JEA Profile:
  
  If you cannot disable UAC for security reasons, consider using a Just Enough Administration (JEA) profile on the target machine. JEA allows you to grant specific permissions to the discovery account without giving it full administrator privileges, according to ServiceNow. 

Sorry this isn't overly helpful, but it is a fundamental restriction within the Discovery Process