Agentless discovery for Windows devices collects inventory data from Windows computers remotely, without installing an agent on each machine. IT teams use it to bring into the inventory the computers where an agent can't be installed, and Windows is where that need concentrates: it holds about 76% of the desktop operating system market worldwide, according to StatCounter's September 2026 figures.
This is where agentless discovery becomes especially valuable. By leveraging Windows Management Instrumentation (WMI) to collect information remotely, organizations can gather detailed asset data without installing agents on every machine.
In this article, we explain how agentless discovery works for Windows devices, how to configure WMI so InvGate Asset Management can retrieve inventory data from your network, and which Mobile Device Management (MDM) tools can bring in the Windows devices they already manage. Let's begin.
What is agentless discovery for Windows devices?
Agentless discovery for Windows devices is a method of identifying and collecting asset information from Windows machines remotely. Instead of relying on local agents, this approach uses network scanning and remote data collection techniques to discover devices and retrieve information directly from the operating system.
For Windows environments, this typically relies on WMI, a built-in Windows management framework that allows authorized tools to query system information remotely. By enabling remote WMI access, tools like InvGate Asset Management can collect inventory data from Windows devices as part of their discovery sources. Besides WMI, InvGate Asset Management can also bring in the Windows devices that an MDM tool already manages, by connecting that tool as another discovery source.
How does agentless discovery for Windows devices benefit IT teams?
Many IT environments contain devices that are not fully managed, such as newly connected machines, remote computers, or systems where installing an agent is not practical. Agentless discovery for Windows devices helps IT teams detect these machines and retrieve key system information without requiring prior deployment, improving visibility across the network and supporting more reliable Windows device discovery.
In practice, agentless discovery is commonly used to identify and inventory devices quickly, while agent-based methods are better suited for continuous monitoring and deeper management capabilities. Together, they provide a balanced approach to maintaining reliable asset visibility.
Recommended reading
Read Article
Agent vs. Agentless ITAM: Their Differences – And Why You Need Both
How to set up agentless discovery for Windows devices in InvGate Asset Management
To enable agentless discovery for Windows devices, you need to allow WMI remote access and ensure the appropriate permissions and network settings are in place. Once configured, InvGate Asset Management can query Windows machines remotely and retrieve asset data as part of its discovery process.
In the following steps, we explain the required configuration on Windows devices and how to enable WMI-based discovery within InvGate Asset Management.
Prerequisites
Before configuring agentless discovery for Windows devices, make sure the following conditions are met:
- The target Windows devices are reachable from the network where the InvGate Proxy that runs the discovery is installed, either directly or through a virtual private network (VPN), with the correct network scope and routing.
- Valid credentials are available for the discovery process.
- The discovery account has the necessary permissions to query Windows devices remotely through WMI.
- The Windows firewall allows WMI and remote management traffic.
- Distributed Component Object Model (DCOM) remote calls are permitted on the target devices.
- Supported Windows versions are being used.
Expected results
Once the configuration is complete, the discovery process should be able to:
- Detect Windows devices during network scans.
- Retrieve hardware and operating system information.
- Show the devices in Assets > Discovery with data such as hostname, OS version, and hardware details, ready to be converted into assets.
If these results appear in the discovery output, the configuration is working correctly.
Step 1: Enable remote WMI requests
To allow agentless discovery for Windows devices, the target machine must permit remote queries through WMI. This requires granting the appropriate WMI permissions to the account that will perform the discovery.
Follow these steps on the target Windows device:
- Open Computer Management.
- In the left panel, expand Services and Applications.
- Right-click WMI Control and select Properties.
- Go to the Security tab and select the Root namespace.
- Click Security.
- Add the user or group that will run discovery if it is not already listed.
- Enable the Remote Enable permission for that user or group.
- Click Advanced, select that user or group, and make sure This namespace and subnamespaces is selected under Applies to.
- Apply the changes and close the configuration window.
Once this permission is granted and inherited by the subnamespaces, as Microsoft's guide to troubleshooting WMI access recommends, the discovery process can query system information remotely through WMI.
Step 2: Allow WMI through Windows firewall
For agentless discovery for Windows devices to work, Windows must allow inbound traffic required for remote Windows Management Instrumentation queries. This typically involves enabling the WMI rule group in the Windows firewall.
You can enable the required firewall rules by running the following command on the target device from an elevated command prompt, as documented in Microsoft's guide to setting up a remote WMI connection:
netsh advfirewall firewall set rule group="Windows Management Instrumentation (WMI)" new enable=yes
This command enables the firewall rules that allow remote WMI requests.
If the discovery process cannot retrieve data, common errors may include:
- "RPC server unavailable": usually indicates that required RPC/DCOM ports are blocked by the firewall or the target machine is unreachable.
- "Access denied": typically means the discovery credentials lack sufficient permissions for remote WMI queries.
- "The requested operation requires elevation (Run as administrator)": the command prompt or PowerShell session must be opened with administrative privileges to modify firewall rules.
Verifying firewall rules, credentials, network reachability, and administrative privileges usually resolves these issues.
Note: Remote WMI communication also relies on DCOM and Remote Procedure Call (RPC) services, which must be available for remote queries to succeed.
Step 3: Enable DCOM calls on the remote machine
Remote WMI queries rely on DCOM to communicate with Windows devices. If the discovery account is not a local administrator on the target machine, DCOM permissions must allow remote access.
Follow the configuration steps described in the official Microsoft documentation to enable the required DCOM permissions.
Step 4: Enable WMI on InvGate Asset Management
Once WMI access is enabled on the target devices, you must configure the discovery integration in InvGate Asset Management so the platform can query those machines during network scans.
Follow these steps:
- In your InvGate Asset Management instance, go to Settings > Discovery > Discovery sources.
- Click Add and choose InvGate Discovery, or edit an existing InvGate Discovery source.
- Complete the discovery configuration form by specifying the parameters used to scan the network.
During this configuration, you can select the network protocols used to identify and inventory devices on your network. The available discovery protocols include:
- DNS
- ICMP
- mDNS
- NetBIOS
- SNMP (v1, v2c, and v3)
- SSH (for Linux computers)
- TCP
- UPnP
- WMI
For some protocols, you may need to define the corresponding credentials and network port used during IT asset discovery. Once WMI is enabled as part of the discovery configuration, InvGate Discovery will be able to query Windows devices remotely and retrieve inventory information from them.
When you select WMI, the form asks for the Windows username and password of the discovery account. It also lets you choose whether the devices found through WMI go straight into the inventory on each sync or wait in Assets > Discovery for you to convert them. Either way, this configuration becomes part of your broader network discovery process, which identifies devices across the network and collects asset data automatically.
Note: WMI discovery is available starting from InvGate Proxy v3.26.0 or later.
Other ways to discover Windows devices without the Agent
The WMI setup in Step 4 covers the Windows computers that the InvGate Proxy can reach on the network. Windows devices already enrolled in an MDM tool can come into the inventory another way: InvGate Asset Management connects to that tool as a discovery source and keeps its devices in sync, without installing the InvGate Agent on them.
The Microsoft Intune integration brings in the laptops and desktops of the office fleet that Intune manages. The SOTI MobiControl integration adds the Windows desktops it manages and the Windows CE and Embedded devices used on handheld and industrial equipment, which come in as computers. Both are added from the same catalog in Settings > Discovery > Discovery sources, where the InvGate Discovery source also lives.
To sum up
Enabling agentless discovery for Windows devices allows IT teams to identify and inventory Windows machines without deploying agents on each device. By configuring WMI access and enabling it within InvGate Asset Management discovery sources, organizations can expand visibility across their network and collect reliable asset data from systems that may not yet be fully managed. For the Windows devices that Microsoft Intune or SOTI MobiControl already manage, connecting those tools as discovery sources brings them into the same inventory without installing the Agent on them.
This approach is especially useful during initial discovery, audits, or when mapping existing environments, helping teams build a more complete and accurate asset inventory.
Once configured, you can include WMI in your regular network discovery scans to continuously detect Windows devices and keep your inventory up to date.
Ready to see it in practice? Start a 30-day free trial of InvGate Asset Management or talk to Sales about improving discovery and inventory coverage across your environment.
Frequently Asked Questions
These are the questions that come up most often when teams set up agentless discovery for Windows devices. They cover the available methods, the permissions WMI needs and what to expect after the first scan.
Can InvGate Asset Management discover Windows devices without the Agent?
Yes. InvGate Discovery queries the Windows computers on the network through WMI, and the Microsoft Intune and SOTI MobiControl integrations bring in the Windows devices those tools already manage, all without installing the InvGate Agent.
What permissions does WMI discovery need on each Windows device?
The discovery account needs the Remote Enable permission on the WMI namespace, applied to its subnamespaces, and remote DCOM access if it isn't a local administrator. The Windows firewall also has to allow the WMI rule group.
Where do Windows devices discovered through WMI appear in InvGate Asset Management?
They appear in Assets > Discovery, where you can review them and convert them into assets. If you enable automatic import for WMI in the discovery source, they go straight into the inventory on each sync.
What does the "RPC server unavailable" error mean in WMI discovery?
It usually means the firewall is blocking the RPC and DCOM ports that remote WMI uses, or the device can't be reached from the network where the InvGate Proxy runs. Checking the firewall rule group and network routing usually solves it.
