Recently I've been trying to figure out how to keep track of computers for inventory and then manage them remotely. I've stumbled upon WMI and Psexec. Psexec seems to be using port 135 to talk to RPC to execute remote PC services. (If I'm understanding correctly) However, I can't say that I understand exactly how WMI works, and I can't find any resources to help me with that. As far as I know, it uses ports 135, 445, and a group of IPs that are defined in registry. Port 135 doesn't surprise me because I know that WMI can do a lot of the things that Psexec can do, but what does is port 445. Normally that port is for TCP/IP SMB if I recall correctly. Why does WMI need access to that, what are the range of IPs for, and generally - how does WMI inner-workings work?
Asked
Active
Viewed 472 times
1 Answers
1
I'm going down the same path you are: using WMI to inventory or manage devices. It has been working well for the last year, but there is always more to add or do (like inventorying monitors).
So, port 445 does SMB, but it also does AD authentication.
