Why we need Local admin privileges on all targeted windows machines for Asset Insight Discovery tool

Question

Dear Team,

We are using Asset Insight Discovery tool to scan our assets but we have one security concern with Windows based machines. As mentioned in your documentation, we need local admin privileges on all targeted windows machines.

https://confluence.atlassian.com/insightapps/discovery-system-requirements-1085180644.html#Discoverysystemrequirements-Windows:WMI

Our Security team is not allowing local admin privileges and we have few concerns as mentioned below.

i) Why asset discovery tool credentials need local admin privileges on all windows targeted machines?

ii) What will be activities performed by Insight Discovery tool using admin rights on windows?

iii) If we are not wrong, Insight Discovery will just read the information from windows system during scanning?

iv) Will Insight discovery tool will write anything on targeted windows machines?

v) Is there any clear requirements that on which specific paths we need to provide the admin rights for scanning?

Does anyone know regarding the above mentioned queries. Please provide you feedback for above queries

OR

Provide any workaround for this problem so that we don't need to use admin rights on each targeted windows machine.

Thanks & Regards,
Tariq Ashraf

Nicolaus Brooks · Answer

@Nic Brough -Adaptavist- Hi, I am having trouble with testing my credentials I do have local admin rights on all of the devices but the test does not work. When I did a scan the only device that import was my device. Can you help at all? Can you use .\ before username for the local admin?

Nic Brough -Adaptavist- · Answer

>just related to read the data and not to edit anything then why we need local admin privileges

Because that's how Windows works.

> which specific paths/folders we need to provide the admin rights for scanning

It doesn't do much direct reading of files, it's mostly reading system settings.  I don't know what files it might be reading, but it's safe to say "all the folders the operating system is installed and configured in"

Tariq Ashraf_li0g2e · Answer

Dear Nic Brough,

Thanks for your response. But I am still confused, if it is just related to read the data and not to edit anything then why we need local admin privileges.

Second concern, do you have any idea on which specific paths/folders we need to provide the admin rights for scanning?

Regards,

Tariq Ashraf