Why is SMB required for Windows Manageability?

For agentless management of Windows endpoints, Forescout's HPS Inspection Engine utilizes native Windows protocols. The Server Message Block (SMB) protocol, specifically over TCP port 445, is required to connect to the administrative shares (e.g., ADMIN$) on the target endpoint. This connection allows the Forescout appliance to copy necessary scripts and tools to a temporary directory on the endpoint (e.g., %windir%\temp). Once the script is transferred via SMB, its execution is triggered locally on the endpoint, typically using Remote Procedure Calls (RPC), enabling Forescout to perform actions like remediation or property collection.

A. Incorrect because the scripts are executed locally on the endpoint, not on the CounterACT appliance.

B. Incorrect because scripts are copied to a standard Windows temporary directory, not a "Linux script repository."

C. Incorrect because the script execution is local to the endpoint, not initiated or run remotely from the CounterACT appliance.

D. Incorrect because scripts are run locally on the endpoint, and the execution is not remote from the CounterACT appliance.

1. Forescout HPS Inspection Engine Configuration Guide, Version 1.3, Page 11, Section: "Windows Endpoints". The guide states, "The HPS Inspection Engine uses native Windows protocols to access endpoints... It uses SMB to copy tools to the endpoint and RPC to run them." This confirms that SMB is used for copying files that are then run locally.

2. Forescout Administration Guide, Version 8.2.2, Page 810, Appendix A: "Port Reference", Table 217: "Ports Used by the HPS Inspection Engine". The table lists TCP Port 445 (Service: SMB) with the function "Read/write files on endpoints," which directly supports the file copy mechanism described in the correct answer.

3. Forescout Ports, Protocols, and Services Management, Version 1.0, Page 10, Table 1: "Forescout Platform Ports". This document lists TCP 445 (microsoft-ds) as required for the HPS Inspection Engine to perform actions on Windows machines, reinforcing its role in the manageability process.