Which service needs to be running on a host to detect a Windows device?

To successfully detect and classify a Windows device, ServiceNow Discovery historically relies on the Windows Management Instrumentation (WMI) service. During the initial port scanning phase (Shazzam), the MID Server checks for open ports characteristic of specific operating systems. For Windows devices, Discovery actively scans port 135, which corresponds to the RPC endpoint mapper utilized by WMI. If this service is running and the port is accessible, Discovery successfully detects a Windows operating system and triggers the Windows classification phase. While Windows Remote Management (WinRM) is presently the recommended protocol for the subsequent exploration phase using PowerShell, WMI remains the fundamental service traditionally associated with the initial detection and classification of Windows hosts in ServiceNow Discovery.

B. SSH: Secure Shell operates on port 22 and is strictly utilized for the discovery and exploration of Linux, Unix, and network devices, not Windows operating systems.
C. WinRM: While WinRM is the preferred protocol for executing commands during the deep exploration phase, WMI (port 135) remains the traditional service associated with the initial OS detection.
D. CIM: The Common Information Model (CIM) is an underlying schema standard that WMI extends; however, WMI is the actual running service interrogated during the network detection phase.

ServiceNow Product Documentation, "Discovery ports and protocols," Shazzam probe port considerations, ServiceNow.

ServiceNow Product Documentation, "Windows Discovery," ServiceNow.