Skip to main content
Not available in SaaS.
Computer Discovery finds Windows local privileged accounts using two scanners. This page configures and troubleshoots them. By default both run concurrently, and accounts found are de-duplicated.
  • The WMI scanner finds privileged local accounts in the default Administrators group.
  • The PowerShell scanner also finds local accounts with any privileged permission granted via GPO (for example, SeTcbPrivilege, SeBackupPrivilege).

​
Configuration keys

As of the version introducing Account Discovery Settings, these keys are configured in the Management Tool instead — the config-file keys below are removed on upgrade and no longer take effect. The table below is kept for reference on older versions.
Add or change these in EkranServer.Settings.config, found in C:\Program Files\Ekran System\Ekran System\Server on the Application Server host.

​
WMI scanner prerequisites

1

Check the timeout key

Confirm WmiConnectionTimeoutSeconds is valid in the config file. The default 20s is usually enough; a high value can slow scans when target computers are unreachable.
2

Allow WMI through the firewall

On both the Application Server host and the target computers: press Win+R, run firewall.cpl, click Allow an app or feature through Windows Defender Firewall → Change settings, find Windows Management Instrumentation (WMI), and allow it in Private, Public, and Domain as required.
3

Check the targets

Make sure target computers are online, their local accounts aren’t disabled, and they have the latest Windows cumulative updates.

​
PowerShell scanner prerequisites

1

Check the timeout key

Confirm PowerShellConnectionTimeoutSeconds is valid in the config file.
2

Enable WinRM

Ensure the WinRM service runs on both the Application Server host and the targets. It’s on by default only on Windows Server. To check and enable on Windows 10/11:
Enable-PSRemoting also sets the service to Automatic and opens the WinRM firewall rules.
3

Add trusted hosts (cross-domain)

If the Application Server host and targets aren’t in the same domain, add the targets to the trusted hosts list on the Application Server host:
Separate multiple values with commas, or use asterisks for ranges (for example, 10.150.*). Trusting * is possible but not recommended.
4

Allow WinRM through the firewall

Enable the Windows Remote Management (HTTP-In) inbound rule on the targets and allow port 5985.
5

Synchronize time

The Application Server host and targets must use the same time source. A PowerShell remote session fails if a target is ~10+ seconds out of sync; adding the target to trusted hosts is an alternative workaround.
6

Check WMI on targets

Ensure the WMI service is running on the targets (on by default, but may have been disabled).
To use HTTPS instead of HTTP, set up an HTTPS listener on each computer to be scanned:
  1. Generate a self-signed certificate:
  1. Create the listener using the certificate thumbprint (run in cmd, not PowerShell):
  1. Allow port 5986 in the firewall:
  1. Export the certificate, then import it into Trusted Root Certification Authorities on the Application Server host:
Use a GPO to set this up across many computers.

​
Troubleshooting

Application Server logs can be downloaded from the Management Tool or found in C:\Program Files\Ekran System\Ekran System\ServerLogs.
  • WMI service not running / paused — resume the WMI service on the target.
  • Cannot scan (offline / port 135 blocked / unreachable) — turn the target on, allow port 135 in the firewall, or verify reachability with ping.
  • Access is denied — the secret’s credentials are wrong or lack permissions; try another secret.
  • Can’t scan the Application Server’s own computer — use the PowerShell scanner for that host instead.
  • Connection timed out — increase WmiConnectionTimeoutSeconds.
  • Cannot scan (offline / WinRM disabled / firewall / bad listener) — turn the target on, enable WinRM, check the firewall (5985/5986), or check listeners with winrm enumerate winrm/config/listener.
  • Not in same domain / IP not trusted — add the target to TrustedHosts or use HTTPS.
  • Name cannot be resolved — use the IP (added to TrustedHosts) instead of the name.
  • Access is denied — wrong credentials or insufficient permissions; try another secret.
  • Connection timed out — increase PowerShellConnectionTimeoutSeconds.

Account Discovery

Create and run Computer Discovery rules.

SSH for Linux Discovery

The equivalent setup for Linux scanning.