Additional Discovery probe permissions

Several probes require additional permissions to run.

Discovering Active Connections

Discovery uses the Windows - Active Connections probe to access active connection information. The application dependency mapping feature requires this probe to function.
Table 1. Discovering Active Connections
Probes Additional Permissions
Windows - Active Connections Ability to invoke the \root\CIMV2:Win32_Process object

Access to the $admin share

Access to the %SystemRoot%\temp directory

Discovering Application Profiles

Discovery uses these probes to access application profile information. The application profile discovery feature requires these probes to function.
Table 2. Discovering Application Profiles
Probes Additional Permissions
Windows - Get APD Environment Files

Windows - Get APD Env File Content

Windows - Get APD Version File Content

Ability to invoke the \root\CIMV2:Win32_Process object

Access to the $admin share

Access to the %SystemRoot%\temp directory

Discovering VMware Workstation

Attention: VMware workstation Discovery is deprecated in the Helsinki release. This probe and its sensor will be removed from the product in a future release.
Discovery uses the Windows - Get VMware Workstation probe to access information about VMware virtual machines installed on Windows.
Table 3. Discovering VMware Workstation
Probes Additional Permissions
Windows - Get VMware Workstation Ability to invoke the \root\CIMV2:Win32_Process object

Access to the $admin share

Access to the %SystemRoot%\temp directory

Configure the PATH variable to include the path to the vmrun.exe command. This command is typically found in the VMware Workstation install directory.

Discovering MSSQL

Discovery uses the Windows - MSSQL probe to access information about Microsoft SQL Server installed on Windows.
Table 4. Discovering MSSQL
Probes Additional Permissions
Windows - MSSQL
  • Access to the Win32_Process object
  • Access to the Win32_Service object
  • Access to the Win32_NetworkAdapterConfiguration object
  • Access to the Microsoft.SqlServer.Management.Smo object
  • Access to run the nbtstat command
  • Access to HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\InstalledInstances
  • Access to HKLM\SOFTWARE\Microsoft\MSSQLServer\$instanceName\SuperSocketNetLib\Tcp\TcpPort where $instanceName is an array of possible values.