Discovery probe permissions

  • Release version: Zurich
  • Updated July 31, 2025
  • 1 minute to read

    • Several probes require additional permissions to run.

    Discovering Active Connections

    Discovery uses the Windows - Active Connections probe to access active connection information. The application dependency mapping feature requires this probe to function.
    Table 1. Discovering Active Connections
    Probes Additional Permissions
    Windows - Active Connections Ability to invoke the \root\CIMV2:Win32_Process object

    Read and Write access to the admin$ share

    Discovering Application Profiles

    Discovery uses these probes to access application profile information.
    Table 2. Discovering Application Profiles
    Probes Additional Permissions
    Windows - Get APD Environment Files

    Windows - Get APD Env File Content

    Windows - Get APD Version File Content

    		 Ability to invoke the \root\CIMV2:Win32_Process object

    Read and Write access to the admin$ share

    Write access to the %SystemRoot%\temp directory

    Discovering VMware Workstation

    Discovery uses the Windows - Get VMware Workstation probe to access information about VMware virtual machines installed on Windows.
    Table 3. Discovering VMware Workstation
    Probes Additional Permissions
    Windows - Get VMware Workstation Ability to invoke the \root\CIMV2:Win32_Process object

    Read and Write access to the admin$ share

    Write access to the %SystemRoot%\temp directory

    Configure the PATH variable to include the path to the vmrun.exe command. This command is typically found in the VMware Workstation install directory.

    Discovering MSSQL

    Discovery uses the Windows - MSSQL probe to access information about Microsoft SQL Server installed on Windows.
    Table 4. Discovering MSSQL
    Probes Additional Permissions
    Windows - MSSQL
    • Access to the Win32_Process object
    • Access to the Win32_Service object
    • Access to the Win32_NetworkAdapterConfiguration object
    • Access to the Microsoft.SqlServer.Management.Smo object
    • Access to run the nbtstat command
    • Access to HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\InstalledInstances
    • Access to HKLM\SOFTWARE\Microsoft\MSSQLServer\$instanceName\SuperSocketNetLib\Tcp\TcpPort where $instanceName is an array of possible values.