Preparing Windows Servers for the Agentless Data Collector

Overview

This Knowledge Base article provides a step-by-step guide on how to prepare Windows servers for data collection with the Cloudamize Agentless Data Collector (ADC) using a domain service account and Group Policy, without logging in to each server.

The ADC needs a Windows account that is a member of the local Administrators group on each server it collects from. A Domain Admin account is not required.

The examples in this article use CONTOSO\svc-cloudamize for the service account and CONTOSO\CMZ-Discovery for the discovery group. Replace these with names that match your environment.

ADC 2.0.182 and newer attempts collection over WinRM (TCP 5985) first and falls back to WMI over DCOM/RPC if WinRM is unavailable. The traffic is encrypted. The ADC collects remotely, and no Cloudamize software is installed on the servers:

• It connects to the server over WinRM, or over WMI (DCOM/RPC) as a fallback.

• It runs collection commands on the server, such as netstat for dependency mapping and a PowerShell script for SQL Server discovery, and reads performance counters.

• The server writes the command output back to a shared folder on the ADC machine over SMB (TCP 445).

• The ADC uploads the collected data to Cloudamize over HTTPS (TCP 443).

Quick Checklist

Prerequisites

Before you begin, make sure the following are in place:

• Official Cloudamize Prerequisites: Review the ADC machine requirements and ports in Agentless Installation Prerequisites.

• Domain-joined Servers: The servers to be assessed are joined to your Active Directory domain or a trusted domain. For other servers, see Special Cases below.

• Administrative Access: You can create users and groups in Active Directory, and create and link GPOs in Group Policy Management.

• ADC Machine IP Address: You know the IP address of the machine where the ADC is (or will be) installed. It is used to limit the firewall rules.

• SQL Server basic discovery components: For basic SQL Server collection, the remote SQL servers need PowerShell 2.0 and .NET Framework 3.5. Most supported Windows Server builds already meet this requirement, but older systems should be checked.

Step-by-Step Instructions

Step 1: Create the Service Account and Group

1. In Active Directory Users and Computers, create a regular domain user for the ADC, for example CONTOSO\svc-cloudamize. It does not need to be a member of Domain Admins.

2. Set the password so it does not expire or change during the assessment.

   • Note: If the password changes, collection stops on every server until the new password is entered in the ADC.

3. Create a domain security group, for example CONTOSO\CMZ-Discovery, and add the service account to it.

Optional security hardening: If your security team requires it, deny the service account interactive logon and RDP logon by using Deny log on locally and Deny log on through Remote Desktop Services. The ADC only needs network logon to the target servers.

Step 2: Add the Group to Local Administrators with a GPO

1. Open Group Policy Management, create a new GPO, and link it to the OUs that contain the servers to be assessed.

   • Note: Do not link it to the Domain Controllers OU. See Special Cases below.

2. Edit the GPO and go to Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups.

3. Right-click and select New > Local Group.

4. Set Action to Update and Group name to Administrators (built-in).

5. Under Members, click Add, enter CONTOSO\CMZ-Discovery, and set the action to Add to this group.

6. Click OK to save.

This adds the group without removing existing members. If another GPO controls Administrators membership through Restricted Groups ("Members of this group"), it can remove the group again. In that case, add the group in that GPO instead.

Step 3: Open the WinRM and WMI Firewall Rules in the Same GPO

1. In the same GPO, go to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security > Inbound Rules.

2. For WinRM, enable or create an inbound rule for Windows Remote Management (HTTP-In) and allow TCP 5985 from the ADC machine's IP address.

3. For WMI fallback, right-click and select New Rule > Predefined > Windows Management Instrumentation (WMI).

4. Select the WMI-In and DCOM-In rules, click Next, and select Allow the connection.

5. Open each new rule, go to Scope > Remote IP address, and add the ADC machine's IP address.

Servers apply the GPO at their next policy refresh, normally within 90–120 minutes. To apply it sooner, run gpupdate /force on pilot servers. You can also right-click the OU in Group Policy Management and select Group Policy Update, but remote Group Policy Update requires the target servers to allow the Remote Scheduled Tasks Management firewall rules.

Step 4: Open the Network Paths

The GPO opens each server's own firewall. Any network firewall between the ADC machine and the servers must also allow the following:

Step 5: Check Domain-Wide Settings

These settings usually come from domain GPOs or security tools. If one of them blocks the ADC, it blocks every server at once, so check them before data collection starts.

• NTLM Restrictions: Servers connect to the ADC's shared folder with a local account on the ADC machine, which uses NTLM.

  • On the servers, Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers must not deny it. If it does, add the ADC machine to Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication.

  • On the ADC machine, Network security: Restrict NTLM: Incoming NTLM traffic must allow it.

  • If servers are added to the ADC by IP address instead of hostname, authentication from the ADC to each server can fall back from Kerberos to NTLM. In that case, each server's Network security: Restrict NTLM: Incoming NTLM traffic setting must also allow the connection.

• Network Logon Rights: The service account and its group must not be listed in Deny access to this computer from the network (User Rights Assignment).

• Endpoint Protection: The ADC starts its commands through WinRM or WMI. If the Microsoft Defender attack surface reduction rule Block process creations originating from PSExec and WMI commands (GUID d1e49aac-8f56-4280-b9ba-993a6d77406c) is in block mode, or another EDR product blocks remote process creation, add an exclusion or set the rule to audit for the in-scope servers.

• SMB2: Servers must support SMB2, which is enabled by default from Windows Server 2008 R2. For servers that only support SMB1, see Access Shared Folder Troubleshooting.

Verification

Test two or three pilot servers before the data collection day, while there is still time to fix problems centrally.

Check 1: Confirm the GPO Applied (on one pilot server)

1. Run gpupdate /force.

2. Run gpresult /r. The GPO should appear under Applied Group Policy Objects.

3. Run net localgroup Administrators. The list should include CONTOSO\CMZ-Discovery.

Check 2: Test Network Access (from the ADC machine)

From the ADC machine, test the preferred WinRM path and the WMI fallback ports:

• Test-WSMan <server> checks WinRM on TCP 5985.

• Test-NetConnection <server> -Port 135 checks the WMI/RPC endpoint mapper.

Check 3: Test WMI Command Execution (from the ADC machine)

1. Press Windows key + R, type wbemtest, and press Enter.

2. Click Connect. Enter \\<server>\root\cimv2 as the namespace, enter the service account as DOMAIN\username with its password, and click Connect.

3. Click Execute Method, enter Win32_Process as the object path, and select the Create method.

4. Click Edit In Parameters, set CommandLine to cmd.exe /c echo test, and click Save Object.

5. Click Execute!. The message Method executed successfully means WMI fallback is ready.

For batch testing across multiple servers, you can also use PowerShell:

Invoke-WmiMethod -ComputerName <server> -Class Win32_Process -Name Create -ArgumentList "cmd.exe /c echo test" -Credential (Get-Credential)

Check 4: Test the SMB Return Path (from a pilot server)

On a pilot server, run:

Test-NetConnection <ADC-host> -Port 445

A successful result confirms that the server can reach the ADC machine's shared folder over SMB.

Failure Indicators:

• Test-WSMan fails: WinRM is not enabled, the WinRM listener is missing, or TCP 5985 is blocked. Re-check Steps 3 and 4.

• The RPC server is unavailable when connecting: TCP 135 or the dynamic RPC ports are blocked. Re-check Steps 3 and 4.

• Access is denied when connecting: the account is not in the server's local Administrators group, the password is wrong, or the domain prefix is missing. Re-check Steps 1 and 2.

• Access denied only when executing the method: an endpoint protection rule is blocking remote process creation. Re-check Endpoint Protection in Step 5.

• TCP 445 fails from the pilot server to the ADC machine: SMB return traffic is blocked by a network firewall, the ADC machine firewall, or SMB/NTLM policy. Re-check Step 4 and NTLM Restrictions in Step 5.

If the ADC is already installed, you can also add the pilot servers in the ADC. It runs a connection check on each server and reports what is missing.

Special Cases

• Servers outside the domain (workgroup or DMZ servers, or a domain without a trust). The GPO does not reach them and the domain account cannot log on. Use a local administrator account on each, and set HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy (DWORD) to 1. The built-in Administrator account does not need this registry change. Open the firewall rules from Step 3 on each server.

• Domain controllers. On a domain controller, the local Administrators group is the domain's built-in Administrators group, so adding the collector group there grants rights across the domain. If domain controllers are in scope, agree a separate approach with your security team.

• SQL Server detail. Basic SQL Server discovery requires PowerShell 2.0 and .NET Framework 3.5 on the remote SQL server. For detailed SQL Server data, add the collector group as a login on each SQL Server instance (Security → Logins). The servers also need PowerShell 5.1 and access to the PowerShell Gallery to install the SqlServer module; see Agentless Installation Prerequisites for the URLs.

Related Articles

• Agentless Installation Prerequisites

• Windows Agentless Troubleshooting

• Windows Error 0x80070005 - Access Denied

• Access Shared Folder Troubleshooting

• Linux Preparation

If you have any queries, please get in touch with the helpdesk via our Helpdesk Portal or by email at helpdesk@cloudamize.com.