Host is active, but unable to classify - Discovery Error - CI still updated

[Steven Morse]

Hi

I have a large amount of discovery errors and I am trying to resolve the larger groups with the same error.

I have a huge amount of 'Host is active, but unable to classify' errors. I searched for the effected IPs in the CMDB to see if Discovery was still successful despite the error - in many cases it was. 

Therefore I am receiving this error message despite Discovery finding and populating the CI at the effected IP. 

I am looking to establish 

a) why this happens?

b) how I can remediate/prevent these error moving forward

Thanks

[Runjay Patel]

Hi @Steven Morse ,

The error message you are getting could be a credential issue or blocked port issue. I would suggest 2 troubleshooting steps to help resolve this error. First, validate the Credential using RDP and 2) check the WMI port 135 and port ranges 49152 - 65535 are open.

Troubleshooting Steps:

• Run a Quick Discovery for One IP
  Start by performing a quick discovery for a single IP address.

• Check for Recurring Errors
  See if the same error reappears during the discovery process.

• Validate Credentials Using RDP
  Use Remote Desktop Protocol (RDP) from the MID Server to the remote Windows host to validate the Windows credentials. This step checks the credentials independently of ServiceNow Discovery. Note that RDP communicates over port 3389 for login, whereas ServiceNow Discovery uses a different range of ports for its communication.

• Verify WMI Ports Are Open
  Ensure that the necessary WMI ports are open between the MID Server and the Remote Windows host. These include port 135 and the port range 49152 - 65535. Check both the Windows firewall and any other firewalls between the MID Server and the target Windows host. ServiceNow Discovery relies on WMI for communication, so port 135 must be open for the initial connection, and the high range of ports (49152 - 65535) must be open for subsequent communication. Although this is a wide port range, only a subset of these ports will be dynamically allocated.

You may look to this video for complete guidance on discovery module: https://www.youtube.com/watch?v=Zsctx5qJMsA&t=11600s

-------------------------------------------------------------------------

If you found my response helpful, please consider selecting "Accept as Solution" and marking it as "Helpful." This not only supports me but also benefits the community.

Regards
Runjay Patel - ServiceNow Solution Architect
YouTube: https://www.youtube.com/@RunjayP
LinkedIn: https://www.linkedin.com/in/runjay

-------------------------------------------------------------------------

[Steven Morse]

Hi Runjay

Thank you for the response  - but I am not sure it answers my question.

Discovery is successful on the IP addresses I am referring to. But the error is generated regardless. Surely the correct credentials and ports must be being used because Discovery is successful - CIs are populated and updated. 

Apologies if I am not making myself clear 

[Runjay Patel]

Hi @Steven Morse ,

If device is updated then you supposed to not get the error. Run quick discovery for a ip and check.

[mike533mike]

The "Host is active, but unable to classify" error typically occurs when Discovery can ping the device and identify its status but cannot classify it correctly due to issues such as missing or incorrect classification rules, network/firewall restrictions, or misconfigurations on the device itself. This error can still appear even if Discovery successfully populates the CI, as the classification step is a separate process. To resolve and prevent these errors, ensure that your classification rules are correctly defined and cover all necessary device types, check for network/firewall issues that could block certain discovery probes, and verify that the devices are correctly configured to support classification. Regularly reviewing and updating your discovery profiles and rules will help reduce these errors over time.