Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:
According to the Forescout HPS Inspection Engine Configuration Guide Version 10.8, when using MS-WMI for Remote Inspection, MS-WMI Reachable property should be used to test for Windows Manageability.
MS-WMI Reachable Property:
According to the documentation:
"MS-WMI Reachable: Indicates whether Windows Management Instrumentation can be used for Remote Inspection tasks on the endpoint."
This Boolean property specifically tests whether WMI services are available and reachable on a Windows endpoint.
Remote Inspection Reachability Properties:
According to the HPS Inspection Engine guide:
Three reachability properties are available for detecting services on endpoints:
MS-RRP Reachable - Indicates whether Remote Registry Protocol is available
MS-SMB Reachable - Indicates whether Server Message Block protocol is available
MS-WMI Reachable - Indicates whether Windows Management Instrumentation is available (THIS IS FOR MS-WMI)
How to Use MS-WMI Reachable:
According to the documentation:
When Remote Inspection method is set to "Using MS-WMI":
Check the MS-WMI Reachable property value
If True - WMI services are running and available for Remote Inspection
If False - WMI services are not available; fallback methods or troubleshooting required
Property Characteristics:
According to the documentation:
"These properties do not have an Irresolvable state. When HPS Inspection Engine cannot establish connection with the service, the property value is False."
This means:
Always returns True or False (never irresolvable)
False indicates the service is not reachable
No need for "Evaluate Irresolvable Criteria" option
Why Other Options Are Incorrect:
A. Windows Manageable Domain (Current) - This is not the specific property for testing MS-WMI capability
B. MS-RRP Reachable - This tests Remote Registry Protocol, not WMI
D. MS-SMB Reachable - This tests Server Message Block protocol, not WMI
E. Windows Manageable Domain - General manageability property, not specific to WMI testing
Remote Inspection Troubleshooting:
According to the documentation:
When troubleshooting Remote Inspection with MS-WMI:
First verify MS-WMI Reachable = True
Check required WMI services:
Verify port 135/TCP is available
If MS-WMI Reachable = False, check firewall and WMI configuration
Referenced Documentation:
CounterACT Endpoint Module HPS Inspection Engine Configuration Guide v10.8
Detecting Services Available on Endpoints
