Troubleshooting Help Needed | Unable to Discovery one specific Windows 10 computer

[cynlink1]

Hello,

I am facing a challenge in discovering a Windows 10 computer. Below are the troubleshooting steps that I have performed so far:

- Ran Ping from mid server host was successful

- Ran Telnet from mid server host to verify which ports are open

    WMI: 135 - Open

    SSH: 22 - failed

    VCenter: 443 - failed

    WinRM: 5985 - Open

    WBEM: 5989 - Open

    LDAP: 389 - failed

- Ran Tracert works using the name and IP - both result in the expected results

- Verified the user account stored in ServiceNow credentials is a member of the local administrator's group on the computer

- Used "Test credentials" link within ServiceNow. The test fails. However, I CAN successfully log into Windows 10 directly on the computer via RDP. I do not believe there is an issue with the credentials stored in ServiceNow because they work on hundreds of other devices.

- Verified that WMI is allowed on the local firewall

- Unable to verify WMI connection via PowerShell command (gwmi) from mid server host. Results in "Access is denied"

- Checked with DNS admin and they stated the DNS entry is correct.

- I am able to discover another on the same network segment without any issues.

There is something different about the configuration of this one specific computer that I can't seem to figure out. I was hoping that someone with a little more experience might be able to help me out with the next steps.

Thanks in advance!

--------------------------------------------------------------------------------------------------------

Discovery Log

08-03-2020 09:20:20 AM Warning Authentication failure(s) with available Windows credentials from the instance. WMIRunner (empty) Windows Classify

08-03-2020 09:20:20 AM  Warning Active, couldn't classify: No WMI connection, now finished
WMIRunner (empty) Windows Classify

---------------------------------------------------------------------------------------------------------

WMIRunner Payload

<results probe_time="7016" result_code="1">

<result>

<error>Authentication failure(s) with available Windows credentials from the instance.</error>

<debug_info>{"debug_info":[{"xx.xx.xxx.xxx":{"credentials_attempted":[{"credential_type":"Windows","credential_name":"Windows OS Credential","credential_matches_affinity":true,"credential_order":"100","credential_success":false,"credential_id":"abced9b68db2ef64071f7d92b5e961xxx"},{"credential_type":"Windows","credential_name":"Windows OS Credential 2","credential_matches_affinity":false,"credential_order":"200","credential_success":false,"credential_id":"def53247db184c14615b3ebf9d96xxx"}],"connection_parameters":{"affinity_credential_id":"a0ed9b68db2ef64071f7d92b5e961900","credential_types":["Windows"],"target":"xx.xx.xxx.xxx"}}}]}</debug_info>

[cynlink1]

2nd attempt (may contain more than you need to see)

Quick discovery

2020-08-04 20:06:53 ALLOW TCP 10.14.XXX.XXX 10.49.XXX.XX4 34549 135 0 - 0 0 0 - - - RECEIVE
2020-08-04 20:06:56 ALLOW UDP 10.49.XXX.XX2 10.49.XXX.255 138 138 0 - - - - - - - RECEIVE
2020-08-04 20:07:02 ALLOW TCP 10.14.XXX.XXX 10.49.XXX.XX4 34720 135 0 - 0 0 0 - - - RECEIVE
2020-08-04 20:07:08 ALLOW ICMP 10.49.XXX.XX4 8.8.8.8 - - 0 - - - - 8 0 - SEND
2020-08-04 20:07:08 ALLOW ICMP 10.49.XXX.XX4 8.8.8.8 - - 0 - - - - 8 0 - SEND
2020-08-04 20:07:08 ALLOW ICMP 10.49.XXX.XX4 8.8.8.8 - - 0 - - - - 8 0 - SEND
2020-08-04 20:07:12 ALLOW UDP 10.49.XXX.XX4 10.14.XXX.XX4 57268 53 0 - - - - - - - SEND
2020-08-04 20:07:12 ALLOW TCP 10.49.XXX.XX4 40.114.XXX.X6 53986 443 0 - 0 0 0 - - - SEND
2020-08-04 20:07:20 ALLOW TCP 127.0.0.1 127.0.0.1 53987 9592 0 - 0 0 0 - - - SEND
2020-08-04 20:07:20 ALLOW TCP 127.0.0.1 127.0.0.1 53987 9592 0 - 0 0 0 - - - RECEIVE
2020-08-04 20:07:20 ALLOW UDP 10.49.XXX.XX4 10.14.XXX.XX4 56679 53 0 - - - - - - - SEND
2020-08-04 20:07:20 ALLOW TCP 10.49.XXX.XX4 10.14.XXX.XX4 53988 80 0 - 0 0 0 - - - SEND

[cynlink1]

Hi Chuck,

Did I provide you with even data to tell what might be happening in my last post?

Many thanks for your assistance!

Cyndi

[Ashutosh Munot1]

Hi,

Is this still not discovering the Server?

have you checked 445 port and admin share access.

Do you use WINRm or WMIcollector

Thanks,
Ashutosh

[cynlink1]

I can telnet to 445 OK.

The user has access to admin share.

We are running Orlando which uses PowerShell for WMI queries, not the ServiceNow WMI collector.

[cynlink1]

I still have not had any luck with discovering this device. I am puzzled to what may be causing the issue. I am focusing on this specific PC but I am concerned that whatever is preventing discovery on this pc may be causing issues on other pcs as well. Any additional guidance would be appreciated. Thanks!