--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # PowerShell remoting for Discovery # PowerShell remoting for Discovery {#ariaid-title1} Release version: Australia Updated March 24, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of PowerShell remoting for Discovery The PowerShell remote execution framework in ServiceNow's Discovery enables probe developers to run PowerShell scripts automatically and consistently on remote target devices. This unified approach simplifies remote script execution, improves efficiency, and enhances stability by handling the complexities of remote operations transparently. Show full answer Show less ## Requirements * The MID Server must have read/write access to the network share of the target device. * The remote target must have PowerShell version 3 or higher (up to version 7). * For MID Servers using WinRM or WMI that copy the script to the target, MachinePolicy and UserPolicy scopes must be set to Undefined; otherwise, execution policies can be set up to Restrictive. ## Application Discovery and Script Execution The framework supports copying scripts to remote targets, which is essential for certain probes like Windows --- File discovery, where the script needs to invoke itself on the target to spawn new processes. Copying scripts also resolves errors that can occur with long scripts when using WMI and launchProcess. Be aware that copying scripts may trigger antivirus software on the remote target. To prevent disruptions, scripts should be added to the antivirus software's permitted list. ## Probe Configuration Within probe configurations---such as the Windows --- Active Connections probe---the following options are available when the ECC queue topic is WMIRunner or PowerShell: * **Execute script remotely:** When enabled, scripts run directly on the remote target; otherwise, they run on the MID Server. * **Copy script to target:** When enabled alongside remote execution, scripts are copied to the target before execution; if disabled, scripts execute remotely without copying. ## PowerShell Probe Development This framework abstracts remote execution complexities from probe developers, allowing them to write scripts as if running locally. It supports both WMI and WinRM methods for remote execution. WMI-based execution uses launchProcess, which can be less stable and more error-prone, especially with long scripts. In contrast, WinRM-based execution avoids launchProcess, delivering improved efficiency and reliability. Probe developers can use the PowerShell remote execution framework to automatically handle remote execution of scripts on target devices. The unified framework removes inconsistencies in remote execution, increases efficiency, and improves stability. ## Requirements {#powershell-remoting__section_ldm_dbm_fhb} To use PowerShell remote execution framework, the following requirements must be met: * The MID Server must be able to write to and read from the network share of the target. * The remote target must have PowerShell 3 or higher (up to 7). * For MID Servers using WinRM or WMI that choose to copy the script to the remote target, the MachinePolicy and UserPolicy scopes must be set to Undefined. If the script isn't copied, the execution policy can be any other setting up to Restrictive. {#powershell-remoting__ul_ypd_ptm_fhb} See [Set up MID Servers to use PowerShell](https://www.servicenow.com/docs/_F4TkrXWngCOkYjPgHPWRA "Configure MID Servers in your organization to use PowerShell for horizontal and top-down discovery of Windows servers.") for more information. ## Application discovery {#powershell-remoting__section_cln_qs1_ghb} The PowerShell remote execution framework has options for copying files to the remote target when executing a scan. Copying files to the target is important for probes like Windows --- File discovery because its script invokes itself on the remote target to spawn off a new process. MID Servers using WMI to execute scripts remotely can experience an error with launchProcess if the script is too long. Copying the script to the remote target resolves this error. Copying a script to a remote target may result in anti-virus software on the target flagging the script. To avoid issues with anti-virus software, add the scripts to the permitted list in the anti-virus app. ## Probe configuration {#powershell-remoting__section_x31_v1m_fhb} The following is the configuration page for the Windows --- Active Connections probe, which is included in the Windows --- ADM multiprobe. The Execute script remotely check box is visible when the ECC queue topic is WMIRunner or PowerShell. When checked, the script executes on the remote target. Otherwise the script executes on the MID Server. The Copy script to target check box is visible when Execute script remotely is checked. If Copy script to target is checked, then the script is copied to, and run on, the target. If Copy script to target is unchecked, then the script is executed on the target without copying it. ## PowerShell probe development {#powershell-remoting__section_myj_t1m_fhb} PowerShell remote execution framework is a unified method of executing PowerShell scripts, contained in a probe parameter, on a remote target server. The framework removes the need for probe developers to write their own remote execution code, which can cause inconsistencies between developers. The probe developer writes the script as if the probe was collecting information locally because the remote execution framework automatically handles remote script execution. The framework handles remote execution whether the MID Server is configured to use WMI or WinRM. If the MID Server is configured for WMI, the probe uses launchProcess to execute commands on the remote target. Using launchProcess complicates remote execution and can cause failures. However, a MID Server configured for WinRM does not use launchProcess, and so is more efficient and stable.