Discovery MID Server itself - Support and Troubleshooting

Discovery MID Server itself Issue When you discovery Mid Server itself, you might see below warning message and Discovery failed.

User credentials cannot be used for local connections User credentials cannot be used for local connections User credentials cannot be used for local connections User credentials cannot be used for local connections User credentials cannot be used for local connections User credentials cannot be used for local connections

Release All

Cause The root cause of this issue is a gap in the legacy WMI fields fetch flow, which requires a code fix. When executing the WindowsClassifyWMI probe, if the credentials provided in the discovery do not have PowerShell access, the legacy flow is used to fetch WMI fields. However, when the target is the MID server itself (localhost), this results in the error: "User credentials cannot be used for local connections."

Resolution 1. Update the WMIFetch.psm1 script file with the following updated code:

Original Code: ```python if ($cred) { $wmiClass = gwmi -namespace $namespace -class $table -computer $computer -credential $cred -impersonation impersonate -authentication packetprivacy -EA "Stop" } else { $wmiClass = gwmi -namespace $namespace -class $table -computer $computer -impersonation impersonate -authentication packetprivacy -EA "Stop" } ``` Updated Code: ```python if (($global:isMid -eq $False) -and $cred) { SNCLog-DebugInfo "WMIRunner.psm1 with credential: $cred.username computer: $computer namespace: $namespace table: $table isMid: $global:isMid"; $wmiClass = gwmi -namespace $namespace -class $table -computer $computer -credential $cred -impersonation impersonate -authentication packetprivacy -EA "Stop" } else { SNCLog-DebugInfo "WMIRunner.psm1 no credential computer: $computer table: $table namespace: $namespace isMid: $global:isMid"; $wmiClass = gwmi -namespace $namespace -class $table -computer $computer -impersonation impersonate -authentication packetprivacy -EA "Stop" } ```