Windows process detection fails with error "Command NeebulaWMI.PutFileUsingAdminShare failed. System.Exception: Failed to create connection. Unable to connect to."

Windows process detection fails with error:

Put file on Windows host <ip_address> failed. filePath: 64/msvcp100.dll error: Unable to execute command. None of the command implementations was successful.
Command NeebulaWMI.PutFileUsingAdminShare failed. System.Exception: Failed to create connection. Unable to connect to \\<ip_address>\c$. Error=53

All currently supported releases.

The process detection in windows discovery, depending on settings, will use the WMI collector. The WMI collector will attempt to collect the results from either the C$ or via sending the result file back to the MID server via HTTP.

If WinRM is available on the target, set the following MID Server properties:

• mid.sa.use_powershell = true
• mid.sa.prefer_powershell = true
• mid.sa.prefer_powershell_fallback = true

If both mid.sa.use_powershell and mid.sa.prefer_powershell are true, WMIProvider will try Powershell first. If powershell command returns nothing it will try to fall back to WMI Collector, if mid.sa.prefer_powershell_fallback is true. When it tries Powershell it will check if WinRM is available on the target and run the command via Powershell remoting. If WinRM is not availble, it will try WMI and will still need the admin share to copy the script to run on the target. Thus, WinRM needs to be setup in order to use Powershell without the admin share.

• Setup a MID Server to use Powershell