ServiceNow discovery for MSSQL Cluster not created in Discovery when root\MSCluster WMI query fails with "There are no more endpoints available from the endpoint mapper"Issue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Discovery builds MSSQL Failover Cluster relationships by running a remote WMI query in root\MSCluster. On the affected node <TARGET_NODE_IP_A>, the WMI call fails with an RPC/DCOM endpoint-mapper error, so Discovery cannot retrieve cluster membership and therefore cannot create the Cluster / Cluster Node CI relationships. Discovery cannot read cluster membership from the affected node due to the RPC/WMI error, so it cannot populate the cluster mapping needed to create/update the cluster CI and relationships. Symptoms<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } In the Pattern logs you can see the below: Step 4 – Get mssql cluster info WMI query execution Executing WMI query on host: <TARGET_NODE_IP_A> with namespace: root/MSCluster and query: SELECT * FROM MSCluster_ClusterToNode Failure returned Error during execution of Windows command: executeQuery -Namespace root/MSCluster -Query "SELECT * FROM MSCluster_ClusterToNode".executeQuery : Could not get query SELECT * FROM MSCluster_ClusterToNode on namespace=root/MSCluster.Original Exception: There are no more endpoints available from the endpoint mapper.CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorExceptionFullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,executeQuery Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ALL Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ServiceNow Discovery collects MSSQL Failover Cluster membership by running a remote WMI query against the root\MSCluster namespace (pattern step: “Get mssql cluster info”). On the affected Windows server (<TARGET_NODE_IP_A>), the MID Server cannot complete the WMI/DCOM/RPC call and returns the error below. Because the cluster-to-node mapping cannot be retrieved, Discovery cannot build the MSSQL Cluster / Cluster Node CIs and relationships for that node. Error message you might observe in the Discovery Horizontal Pattern logs: executeQuery : Could not get query SELECT * FROM MSCluster_ClusterToNode on namespace=root/MSCluster. Original Exception: There are no more endpoints available from the endpoint mapper. CAUSES: RPC/DCOM/WMI connectivity blocked (Firewall / network ACLs) from MID Server to target hostRPC Endpoint Mapper (TCP 135) not reachableDynamic RPC ports blocked or restricted without an allowed rangeWMI / RPC services not running or unhealthy on targetCredential lacks permissions to query root\MSCluster namespace Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Restore remote WMI access to root\MSCluster from the MID Server to the affected Windows node <TARGET_NODE_IP_A>. Step-by-step remediation Step 1 — Validate RPC Endpoint Mapper connectivity (mandatory) From the MID Server network segment (or a jump host with identical routing), verify TCP 135 to <TARGET_NODE_IP_A> is reachable.If blocked, coordinate with the network/security team to allow it. Expected result: TCP 135 reachable between MID Server and target host If not: the endpoint mapper error is expected. Step 2 — Allow/validate DCOM dynamic RPC ports Confirm your firewall policy allows dynamic RPC ports (used after TCP 135 negotiation).If the environment restricts dynamic RPC, configure an approved RPC port range and allow that range between MID Server and <TARGET_NODE_IP_A>. Expected result: DCOM/RPC can complete the handshake and open required ports If blocked: WMI queries fail even if TCP 135 is open. Step 3 — Confirm Windows Firewall rules for WMI/DCOM On <TARGET_NODE_IP_A>, ensure inbound rules allow: Windows Management Instrumentation (WMI-In)DCOM-In Remote administration rules required by your baseline Expected result: Remote WMI calls are allowed to the target host Step 4 — Confirm required services are running on <TARGET_NODE_IP_A> Check (at minimum): Remote Procedure Call (RPC)Windows Management Instrumentation Any supporting DCOM components as per your Windows hardening baseline Expected result: Services running and healthy If stopped/unhealthy: WMI queries may fail intermittently or consistently. Step 5 — Confirm WMI namespace permissions for the Discovery credential Ensure the credential used by Discovery has permissions to query: root\CIMv2 (general Windows discovery)root\MSCluster (cluster mapping) Confirm the user is allowed remote WMI access (per org policy). Expected result: Credential can read the MSCluster_ClusterToNode class. Step 6 — Re-run Discovery and validate cluster creation Re-run Discovery for <TARGET_NODE_IP_A> from the same MID Server.Validate the pattern step: Get mssql cluster info returns rows for MSCluster_ClusterToNode Confirm outcomes in CMDB: Cluster CI exists (or is updated)Cluster node relationships are created for <TARGET_NODE_IP_A> Success criteria: The root\MSCluster query returns results and the MSSQL Cluster objects/relationships appear the same way they do for <TARGET_NODE_IP_B>. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } https://www.servicenow.com/docs/bundle/zurich-it-operations-management/page/product/discovery/reference/mssql-data-collected-pattern.html