We are discovering Windows servers through unsecured WMI ports i.e 135, 137, 139 and 445. Security team advised that these ports are unsecured. Is there any alternative solution can enable for changing WMI ports?
- WMI ports should only be enabled on the internal network and denied from outside to inside in your network firewall
Things you can do to improve security:
Set DCOM Security to Allow only specific Users
Set Namespace Security to Require Data Encryption for Remote Connections
Get a WMI Explorer/Tester to actually perform various VMI tests
Don't forget to secure WinRM
Read some tips here.