Windows discovery probe execution

Adarsh_raj · ‎08-06-2025

We have a requirement to do IIS server discovery and for this we have a dedicated probe "Windows - Get IIS Information". My question is how will this probe be triggered and do we need to make anything active for this discovery.

AJ-TechTrek · ‎08-07-2025

Hi @Adarsh_raj ,

As per my understanding ,Solution Overview will be
1. How the “Windows - Get IIS Information” probe is triggered
This probe is part of the Pattern-based Discovery process, specifically under Application Dependency Mapping (ADM) or Horizontal Discovery, depending on how you're discovering the server.
It is automatically triggered as part of the Windows Server classification pattern, but only when the server is identified as running IIS.
Triggering Conditions:
* Target is identified as a Windows Server.
* Discovery identifies IIS-related registry entries, services, or files.
* If criteria match, the system triggers the "Windows - Get IIS Information" probe.

2. Do you need to activate or configure anything?
Yes, here’s what to check:

Configuration Step	Details
MID Server installed	Ensure a MID server is active and has access to the Windows environment.
WMI/PowerShell credentials	Required for Windows discovery and to query IIS via WMI or PowerShell.
Port 135, WMI, and RPC open	Ensure MID can connect using Windows protocols.
Ensure IIS is installed on target	IIS Manager or services (like w3svc) should exist to trigger the probe.
IIS probe is in active probe list	In Discovery Patterns, ensure IIS probe (Windows - Get IIS Information) is linked correctly under classification or exploration phases.

3. Where to check if the probe is triggered?
Go to:
Discovery → Status → Discovery Log
Search for the target IP/CI, then:
* Click on the Discovery Status entry
* Look for Triggered probes
* You should see Windows - Get IIS Information in the list, if applicable

4. If it's not triggering – What to Do
If the probe isn't triggering:
* Confirm IIS is installed and running on the target server.
* Run a Port Scan and Windows Classification manually to check if the server is classified correctly.
* Check patterns:
* Go to Discovery → Patterns
* Search for “Windows Server”
* Validate that the IIS step exists in the exploration phase
* Check MID logs for access denied or WMI failures.

Please appreciate the efforts of community contributors by marking appropriate response as Mark my Answer Helpful or Accept Solution this may help other community users to follow correct solution in future.

Thank You
AJ - TechTrek with AJ - ITOM Trainer
LinkedIn:- https://www.linkedin.com/in/ajay-kumar-66a91385/
YouTube:- https://www.youtube.com/@learnitomwithaj
Topmate:- https://topmate.io/aj_techtrekwithaj (Connect for 1-1 Session)
ServiceNow Community MVP 2025

View solution in original post

KrushnakumaT · ‎08-06-2025

Hi @Adarsh_raj ,

To discover IIS servers, we use a specific probe called "Windows - Get IIS Information". This probe does not run automatically on its own. Instead, it is triggered by a pattern during the discovery process.

For the probe to run successfully, we need to make sure of the following:

IIS Role must be installed on the target Windows server.

WMI must be enabled, because this probe uses WMI to collect IIS-related data.

We need to ensure that MID Server is set up correctly, and credentials for Windows discovery are working.

The IIS pattern should be active. You can find and activate it from Discovery Patterns (look for "IIS" under the Windows Server pattern).

In short, you don't manually trigger the probe — it's triggered automatically by the pattern if IIS is detected during Windows server discovery.
If this response helped, please mark it as the correct answer so it can help others as well.
Thank you!!

Adarsh_raj · ‎08-06-2025

Hi @KrushnakumaT ,
I have a question after which probe the IIS probe triggered. Do we need to setup anything for this?

KrushnakumaT · ‎08-06-2025

Hi @Adarsh_raj ,

The "Windows - Get IIS Information" probe runs after the "Windows - Classify" probe confirms the server is Windows.

If IIS is installed on the server, the IIS pattern gets triggered, and that’s what calls the IIS probe.

To make this work, you need to:

Activate the IIS pattern in Discovery Patterns.

Make sure WMI is enabled on the server.

Use valid Windows credentials in Discovery.

Ensure the MID Server is working properly.

So yes, some setup is needed, mainly to activate the pattern and check your discovery settings.

If this response helped, please mark it as the correct answer so it can help others as well.
Thank you!!

KrushnakumaT · ‎08-06-2025

Hi @Adarsh_raj ,
If this response helped, please click on "Accept as Solution" so it can help others as well.
Thank you!