Skip to content
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Discovery probe permissions

Several probes require additional permissions to run.

Discovering Active Connections

Discovery uses the Windows - Active Connections probe to access active connection information. The application dependency mapping feature requires this probe to function.

ProbesAdditional Permissions
Windows - Active ConnectionsAbility to invoke the \\root\\CIMV2:Win32\_Process objectRead and Write access to the admin$ share

Discovering Application Profiles

Discovery uses these probes to access application profile information.

ProbesAdditional Permissions
Windows - Get APD Environment FilesWindows - Get APD Env File Content Windows - Get APD Version File ContentAbility to invoke the \\root\\CIMV2:Win32\_Process objectRead and Write access to the admin$ share Write access to the %SystemRoot%\\temp directory

Discovering VMware Workstation

Discovery uses the Windows - Get VMware Workstation probe to access information about VMware virtual machines installed on Windows.

ProbesAdditional Permissions
Windows - Get VMware Workstation

Ability to invoke the \root\CIMV2:Win32_Process objectRead and Write access to the admin$ share

Write access to the %SystemRoot%\temp directory

Configure the PATH variable to include the path to the vmrun.exe command. This command is typically found in the VMware Workstation install directory.

Discovering MSSQL

Discovery uses the Windows - MSSQL probe to access information about Microsoft SQL Server installed on Windows.

ProbesAdditional Permissions
Windows - MSSQL- Access to the Win32\_Process object - Access to the Win32\_Service object - Access to the Win32\_NetworkAdapterConfiguration object - Access to the Microsoft.SqlServer.Management.Smo object - Access to run the nbtstat command - Access to HKLM\\SOFTWARE\\Microsoft\\Microsoft SQL Server\\InstalledInstances - Access to HKLM\\SOFTWARE\\Microsoft\\MSSQLServer\\$instanceName\\SuperSocketNetLib\\Tcp\\TcpPort where $instanceName is an array of possible values.

Parent Topic:Discovery probe management

Related topics

Discovery commands for probes and patterns