ServiceNow Windows Discovery credential test fails even when port 135 is reachableIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } During ServiceNow Discovery or a Test Credential run, authentication to a Windows target fails even though TCP 135 is reachable from the MID Server (telnet/connect test succeeds) and the credential user is a member of the Local Administrators group on the target. Common searchable terms for this issue include: Windows Discovery, credential test, port 135, RPC, DCOM, WMI, MID Server, admin$, SMB, UAC, LocalAccountTokenFilterPolicy, dynamic RPC ports, Discovery authentication failure. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ALL Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } This behaviour is most commonly caused by one or a combination of the following: WMI/DCOM requires more than just port 135. WMI uses the RPC endpoint mapper on port 135, then negotiates a dynamic RPC/DCOM port. If that dynamic range is blocked by a firewall or network ACLs, Discovery can fail with authentication or access-denied errors even though port 135 is open.Discovery stages output via Windows administrative shares (admin$). For WMI-based Windows discovery, the MID Server can write output to the target's admin$ share by default. If SMB/445 or admin$ access is blocked or denied, the credential test and discovery steps can fail.UAC remote restrictions for local accounts. If the credential is a local (SAM) account, Windows can apply UAC remote restrictions so the session does not receive a full elevated admin token remotely. This causes remote admin actions, including admin$ access, to fail even when the user is a local admin.Missing required Windows rights beyond local admin membership in some environments. Depending on hardening or GPOs, explicit WMI namespace permissions, PowerShell/WMI access, and sometimes membership in Distributed COM Users may be required for remote discovery actions to succeed. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Apply the following validated fixes in order, from the MID Server to the target: 1. Confirm required network ports are allowed (not just port 135): Allow TCP 135 (RPC Endpoint Mapper).Allow SMB TCP 445 so the MID Server can access \\\\admin$ when using WMI/PowerShell-based discovery.Allow the dynamic RPC/DCOM port range used by the target OS (commonly 49152–65535 on modern Windows; older OS versions may use 1025–5000), or have the Windows/security team constrain RPC to a smaller fixed range and open that range. 2. Validate admin$ share access from the MID Server host: Ensure the credential can access \\\\admin$ (this is required by default for WMI-based discovery staging).If the organisation does not permit admin$ usage, use a pre-mounted alternate share on every target. 3. Use a domain account when possible: Switching to a domain account with local admin rights on targets avoids the filtered-token behaviour seen with local accounts. If a local account must be used, coordinate with the Windows/security team regarding UAC remote restrictions.Only if approved by the security policy: Windows provides a registry-based option (LocalAccountTokenFilterPolicy) to change remote token filtering behaviour for local accounts. 4. Confirm WMI/DCOM permissions and hardening controls: Verify the credential has WMI namespace access (for example, Remote Enable where applicable) and the required rights for PowerShell/WMI execution.If required by the policy or hardening baseline, add the user to Distributed COM Users. 5. Re-test and capture the exact failure point: Re-run Test Credential and a single-target discovery.If the test still fails, capture the exact credential test error and the related Discovery/ECC/probe output. The error will usually indicate whether the block is caused by dynamic RPC ports, admin$/SMB, or UAC/permission issues.