Why Can't Windows Open-AudIT Discover Itself?

(and what can I do about it?)

When we run Open-AudIT Server on Windows and try to discover the IP that the server is using, we will not get a meaningful result - why is this?

When discovery runs it has no idea that the IP it is attempting to talk to is actually the local machine. It is treated just like any other IP. This means we will attempt to connect to it, over the "network", using credentials.

WMI simply does not support doing this. No credentials we supply will work, because they will be rejected by WMI on the local machine.

You can try this for yourself by running the below command on your Open-AudIT Server. Obviously substitute the IP, username, domain and password.

wmic /Node:"YOUR-IP" /user:"YOUR_DOMAIN\YOUR_USERNAME" /password:"YOUR_PASSWORD" csproduct get uuid

The result you get will be as below.

Node - 192.168.88.73
ERROR:
Description = User credentials cannot be used for local connections

And you can see this in the discovery log when we attempt to connect using WMI (ID 375 below). We don't actually retrieve a result, even with valid credentials.

So how can we audit the Open-AudIT Server?

The best option right now is to setup a scheduled task to run the audit script or to run it manually when you need to.

If you have a Collector that is able to reach the server using the required network ports, you could have that collector discover the server.

We have this as an outstanding item to be addressed in a future release.

This issue has been outstanding for a very long time, but with the work-around in place, it is not crucial to the function of Open-AudIT.

When running a discovery that includes the IP of the local server, you will receive very limited data from, the discovery but you will receive the FQDN and the MAC address. Between these two items and the default match settings, no extraneous devices will be created.