PowerShell for Discovery and Service Mapping

  • Release version: Xanadu
  • Updated August 1, 2024
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of PowerShell for Discovery and Service Mapping

    ServiceNow MID Servers leverage PowerShell and PowerShell Remoting to access configuration items (CIs) during horizontal and top-down discovery of Windows servers and applications. PowerShell enables direct communication with Windows servers using WMI and WinRM protocols, providing a secure and efficient method for querying and automating administration tasks. It is the preferred approach for discovering assets across multiple Windows domains by using stored credentials on the ServiceNow instance.

    Show full answer Show less

    If PowerShell and PowerShell Remoting are not configured, MID Servers default to using WMI for discovery.

    How PowerShell Discovery Works

    • Probes and Sensors: When a Windows machine is classified with PowerShell and a Microsoft SQL instance is detected, a specific probe (Windows - MSSQL) is launched to retrieve database catalogs and version data, which is then passed to a sensor.
    • Probe Parameters: For example, the WMIActiveConnections.ps1 script runs netstat.exe remotely to gather active connection details such as process IDs, ports, and IP addresses.
    • Credentials: Discovery utilizes Windows PowerShell credentials stored in the discoverycredentials table or falls back to the MID Server service’s domain administrator credentials if explicit PowerShell credentials are absent.
    • MID Server Script Includes: Scripts such as GenerateWMIScriptJS and GenerateWMIScriptPS1 run on MID Servers to generate the necessary WMI and PowerShell scripts used during discovery.

    MID Server Configuration and Parameters

    MID Servers can be configured with optional PowerShell-specific parameters to control discovery behavior. Changes to these settings require a MID Server service restart to take effect.

    PowerShell Version Support and Requirements

    • Supported PowerShell versions for MID Servers include 3.0, 4.0, and 5.0. These versions support Regular Discovery, Application Dependency Mapping (ADM), and File-based Discovery.
    • PowerShell 3.0 does not support Windows Server 2003.
    • PowerShell 6.0 is not supported due to removal of many cmdlets required by discovery, especially related to remote operations.
    • MID Servers must run on a supported Windows operating system compatible with the PowerShell version used.

    Windows PowerShell Execution Policies

    PowerShell execution policies control script execution security and can be set via Group Policy:

    • Restricted: No scripts run; PowerShell only interactive.
    • AllSigned: Only scripts signed by trusted publishers run.
    • RemoteSigned: Downloaded scripts must be signed.
    • Unrestricted: No restrictions; all scripts can run.

    For policies other than Unrestricted, scripts must be signed to execute. Customers should configure execution policies accordingly to enable discovery scripts.

    PowerShell Remoting and Discovery Efficiency

    PowerShell remoting establishes a secure, persistent PSSession for querying Windows servers via WinRM, improving efficiency and stability of remote script execution. This unified framework handles remote execution consistently across target devices.

    Practical Benefits for ServiceNow Customers

    • Enable accurate and secure discovery of Windows servers and MSSQL instances across multiple domains using centralized credential management.
    • Improve discovery performance and reliability by leveraging PowerShell remoting sessions over traditional WMI calls.
    • Customize discovery behavior through MID Server parameters and script includes tailored for PowerShell operations.
    • Ensure compliance and security by aligning PowerShell execution policies with organizational standards.
    • Gain deeper visibility into Windows server connections and services to support configuration management and service mapping efforts.

    MID Servers use PowerShell and PowerShell Remoting for accessing configuration items (CIs) during horizontal and top-down discovery. Review MID Server parameters and script includes, probe parameters, and credentials for using PowerShell.

    PowerShell is used to control and automate the administration of Windows servers and applications.

    MID Servers can use PowerShell to directly communicate with Windows servers using both WMI and WinRM protocols. For Windows services using the WinRM protocol, the PowerShell process establishes a secure PSSession (PowerShell Remoting session) that stays open until the MID Server finishes querying a Windows server. For Windows servers using the WMI protocol, the PowerShell process sends every PowerShell command with credentials.

    PowerShell is also the preferred method for performing discovery over multiple Windows domains. PowerShell allows a single MID Server to authenticate on servers on different domains using credentials stored on the instance.

    If you do not configure MID Servers to use PowerShell and PowerShell Remoting, MID Servers use WMI.

    How PowerShell Discovery works

    The following descriptions explain how MID Servers use PowerShell to deploy probes.
    Probe and sensor

    When a Windows machine is classified with PowerShell, and an MSSQL instance is detected, a probe called Windows - MSSQL is launched. The probe returns the SQL database catalogs and version to a matching sensor.

    Probe parameter

    The WMI_ActiveConnections.ps1 probe parameter contains a script that runs netstat.exe on a target server when PowerShell is enabled. This script extracts the information on Windows server connections, such as process IDs, ports, and IP addresses.

    Credentials

    Discovery uses Windows PowerShell credentials from the Credentials [discovery_credentials] table or the domain administrator credentials of the MID Server service. If Discovery cannot find PowerShell credentials in the Credentials table of the type (Windows) it uses the login credentials of the MID Server service.

    MID Server Script Includes
    The following script includes were added for PowerShell discoveries. These scripts run on the MID Server to generate the scripts that Discovery uses for WMIRunner and PowerShell.
    • GenerateWMIScriptJS: Generates a Javascript script for the WMIRunner probe.
    • GenerateWMIScriptPS1: Generates a PowerShell script for PowerShell discovery.
    MID Server parameters for PowerShell
    Optional parameters for the MID Server can be found at MID Server parameters for PowerShell. After changing the setting for any parameter, be sure to restart the MID Server service.

    PowerShell version requirements

    MID Servers using PowerShell must be installed on a supported Windows operating system. ServiceNow supports these PowerShell versions:
    Version 3.0
    • Regular Discovery
    • Application Dependency Mapping (ADM)
    • File-based Discovery
    • PowerShell version 3.0 does not support Windows Server 2003.
    Version 4.0
    • Regular Discovery
    • Application Dependency Mapping (ADM)
    • File-based Discovery
    Version 5.0
    • Regular Discovery
    • Application Dependency Mapping (ADM)
    • File-based Discovery
    Note:
    PowerShell version 6.0 is not supported. Many of the cmdlets that discovery relies on have been removed from this version. For example, only cmdlets using WinRM are available for remote operations.

    Windows PowerShell execution policies

    Windows PowerShell has four different execution policies. Customers can set the script execution policies with their group policy settings. For more information, see the Microsoft website for PowerShell documentation.
    • Restricted: No scripts can be run. Windows PowerShell can be used only in interactive mode.
    • AllSigned: Only scripts signed by a trusted publisher can be run.
    • RemoteSigned: Downloaded scripts must be signed by a trusted publisher before they can be run.
    • Unrestricted: No restrictions; all scripts can be run.
    Note:
    If you have any policy other than Unrestricted, the script needs to be signed.