cancel
Showing results for 
Search instead for 
Did you mean: 
kmc
Level 12

windows 10 as data-source?

Jump to solution

Hi friends,

Is it possible to add windows 10 as WMI data-source ? does SIEM support it?

I tried to add the data-source in a way like the standard WMI configuration, its not working i get the below errors

WMI Event Log test connection unsuccessful. The user does not have the correct permissions. The UAC or WMI setting may need to change.

if i use RPC below error:

WMI Event Log test connection unsuccessful. result was NT_STATUS_ACCESS_DENIED

We have configured the account as per standard steps, is some other configuration we need to do it specially for windows 10?

Regards,

Kotresha

0 Kudos
1 Solution

Accepted Solutions
kmc
Level 12

Re: windows 10 as data-source?

Jump to solution

It's started working after network settings from public to private, and re run the ‘winrm quickconfig’ command

0 Kudos
3 Replies
kmc
Level 12

Re: windows 10 as data-source?

Jump to solution

It looks like it supported but dont no extra configuration required.

0 Kudos
sssyyy
Level 12

Re: windows 10 as data-source?

Jump to solution

I think windows 10 is only supported from 9.6.1 onwards. The error you got shows that the user account you used doesn't have enough permission to pull WMI.

0 Kudos
kmc
Level 12

Re: windows 10 as data-source?

Jump to solution

It's started working after network settings from public to private, and re run the ‘winrm quickconfig’ command

0 Kudos