Skip to content

Commit 7f9320f

Browse files
authored
Merge pull request #899 from ritza-co/1033-windows
1033: non-admin user permission; windows-and-hyper-v-auto-discovery
2 parents 88c1dae + cdae4f3 commit 7f9320f

File tree

1 file changed

+16
-2
lines changed

1 file changed

+16
-2
lines changed

docs/auto-discovery/windows-and-hyper-v-auto-discovery.mdx

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Device42 discovery uses multiple protocols to communicate with the target device
1010

1111
## Prerequisites
1212

13-
When using WMI, you need to install Windows Discovery Service (WDS) and connect to your Remote Collectors (RCs) before setting up your Windows discovery job. For WDS installation instructions and information, visit the [Windows Discovery Service Installation](/getstarted/installation/windows-discovery-service-installation.mdx) documentation.
13+
When using WMI, you need to install the Windows Discovery Service (WDS) and connect to your Remote Collectors (RCs) before setting up your Windows discovery job. For WDS installation instructions and information, visit the [Windows Discovery Service Installation](/getstarted/installation/windows-discovery-service-installation.mdx) documentation.
1414

1515
### WinRM Network Requirements
1616

@@ -374,7 +374,7 @@ If you discover servers that do not belong to a domain, your User Account Contro
374374

375375
### Windows ADM Minimum Permissions
376376

377-
There are two options for configuring ADM permissions. The first option uses local administrative permissions and the `IPC$` and `ADMIN$` shares. The second option lets users configure their own shares.
377+
There are two options for configuring ADM permissions for admin users. The first option uses local administrative permissions and the `IPC$` and `ADMIN$` shares. The second option lets users configure their own shares.
378378

379379
For the local administrator method:
380380

@@ -398,6 +398,20 @@ sources={{
398398
}}
399399
/>
400400

401+
While it's best to use an admin account for complete discovery, you can try the following workaround to grant a non-admin user permission for service discovery.
402+
403+
Use the `sc.exe sdset scmanager` command to grant `SC_MANAGER_CONNECT` permission to the user:
404+
405+
- First, [find the SID](https://www.ninjaone.com/blog/how-to-find-user-security-identifier/) of the non-admin user account that you want to grant permission.
406+
407+
- Next, as an admin user, add the non-admin user's SID to the following command and execute it in PowerShell:
408+
409+
```bash
410+
sc.exe sdset scmanager "D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPRC;;;SID_OF_DISCOVERY_USER)"
411+
```
412+
413+
- Then try running the discovery process again as the non-admin user.
414+
401415
### Port Matrix
402416

403417
| Ports | Protocol | Application Protocol | Notes |

0 commit comments

Comments
 (0)