2

We are discovering Windows servers through unsecured WMI ports i.e 135, 137, 139 and 445. Security team advised that these ports are unsecured. Is there any alternative solution can enable for changing WMI ports?

  • Your last sentence is confusing. What do you want to do? Change the port numbers WMI runs on, or secure the existing WMI ports? – schroeder Jan 29 '18 at 10:01
  • Thanks for respond . Is it possible to customize the ports ? Means instead of unsecure WMI ports Can we configure any other ports in application ? – shashi kumar Jan 29 '18 at 10:42
  • Changing ports is not the answer. Securing WMI is the answer. – schroeder Jan 29 '18 at 10:50
  • Please do not duplicate questions. Edit this question to add details. – schroeder Jan 29 '18 at 15:30
  • 2
    Windows is designed to use those ports. "Ports" are not secure or secure, the services running on those ports are secure or not secure. The answer is to secure those services. – schroeder Jan 29 '18 at 15:33
1
  • WMI ports should only be enabled on the internal network and denied from outside to inside in your network firewall

Things you can do to improve security:

  • Set DCOM Security to Allow only specific Users

  • Set Namespace Security to Require Data Encryption for Remote Connections

  • Get a WMI Explorer/Tester to actually perform various VMI tests

  • Don't forget to secure WinRM

Read some tips here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.