Scanning Microsoft Windows assets

Technology

Windows Management Instrumentation (WMI) is Microsoft’s implementation of the Web-Based Enterprise Management (WBEM) standard for Windows operating systems.

Using WMI, TNI obtains software and hardware information, as well as computer registry data.

There are three methods for scanning Windows-based computers.

Remote scanning via the SMB protocol

How it works

  1. Executable tniwinagent.exe (an agent) is uploaded to the administrator’s shared folder admin$ on the remote computer.
  2. TNI’s main unit connects to the Service Control Manager on the target PC, installs the agent as a service and starts it.
  3. The agent collects the information, saves it to a compressed file, and then stops.
  4. The main unit imports the resulting file into the Storage.
  5. The agent service is uninstalled, and the executable is deleted.

No traces of the scan are left on the target PC after the scan is complete.

Requirements for the target machine

Object Parameters
CPU
500 MHz
RAM
64 MB
Disk space
10 MB
TCP ports
445, 139
Services
Server
Windows Management Instrumentation (WMI)
Remote Procedure Call (RPC)
Remote Registry
Resources
ipc$
admin$
Protocols
SMB
NetBIOS (for Windows NT4)
TCP/IP
Windows versions
7, 8, 8.1, 10, 11, Server 2008/2012 (incl R2)/2016/2019/2022/2025

Remote scanning via the RPC protocol

How it works

TNI’s main unit connects directly to the WMI service on the target PC via RPC and collects information remotely.

Disadvantages

  1. It generates significant network traffic.
  2. Scanning speed depends on the network connection.
  3. All data processing is performed by the main unit, which significantly increases system resource usage when scanning large networks.

This method offers no advantages over SMB scanning. It is recommended only when SMB cannot be used.

Requirements for the target machine

Object Parameters
CPU
500 MHz
RAM
64 MB
Disk space
10 MB
TCP ports
135, 445 and random ports above 1024
Services
Windows Management Instrumentation (WMI)
Remote procedure call (RPC)
Protocols
RPC
TCP/IP
Windows version
7, 8, 8.1, 10, 11, Server 2008/2012 (incl R2)/2016/2019/2022/2025

Alternative scanning methods

Manual scanning

  1. The executable tniwinagent.exe (an agent) is manually copied to the target computer and launched.
  2. When the scanning is complete, the agent creates a file containing the collected information.
  3. The resulting file must be moved to the TNI Storage.

Command-line parameters of the agent tniwinagent.exe:

  • /path:"\\server\share" specifies the path to the folder where the data file will be placed;
  • /delay:XX specifies the delay, in seconds, between launching the agent and starting the scan;
  • /overwrite overwrites the existing data file if the target folder already contains one.

See the Manual scan section for details.

Automatic Agent Launch

The agent can also be run by a domain logon script, using Task Scheduler, or at Windows startup.

For automated scanning of computers that cannot be accessed directly by the main TNI module, a resident agent can be used. It performs scans on a schedule and automatically sends the results using the selected transfer method. For more information, see Scanning with a Windows Resident Agent.

Requirements for the target machine

Object Parameters
CPU
500 MHz
RAM
64 MB
Disk space
10 MB
Services
Windows Management Instrumentation (WMI)
Protocols
RPC
TCP/IP
Windows version
7, 8, 8.1, 10, 11, Server 2008/2012 (incl R2)/2016/2019/2022/2025

Scanning overhead

All scanning methods use CPU resources and perform various disk operations, so a slight reduction in system performance may occur while scanning a computer. Scanning usually takes 1-2 minutes.

Online scanning methods (on demand) generate network traffic:

The numbers in the table represent average values, including service data such as packet headers.

RPC scanning generates more network traffic because WMI collects data from the registry. The amount of traffic depends on the number of applications and services installed on the remote computer.

Method To remote computer (upload) From remote computer (download)
SMB
6.3 MB
0.05-0.1 MB
RPC
10 MB
18 MB

When scanning via SMB, you can optionally save the agent file on the remote computer for subsequent scans to reduce network traffic.

Low-level hardware scan

In Manual scan mode, as well as during remote scanning via SMB, TNI installs a third-party driver to collect low-level hardware details, such as memory SPD data, HDD S.M.A.R.T. data, etc. In normal mode, the driver is installed and uninstalled each time the scan is run, which takes only a fraction of a second.

There is a known issue with the Intel storage driver (iastor.sys). A bug in this driver causes a BSOD during low-level disk subsystem scanning. A workaround has been implemented: TNI skips low-level disk scanning when the driver is detected. This behavior can be changed in the program settings or by using command-line switches in the standalone agent.

Contents