WMI Process Orion uses to add nodes

Question

I have been trying to manually manage some nodes and wondering how Orion does this so i can replicate the process in a powershell script.

The main reason for this is that, most of the servers i manage have Remote Administration turned off but yet Solarwinds is able to add and query these machines.

I tried using CimInstance and any powershell command but cant connect to these servers.

Does anyone understand or know and can explain the underlying process Orion connects to these nodes?

KMSigma.SWI · Answer

You are getting dangerously close to "How does the program actually do the thing" which is stepping close to the Intellectual Property line.  For many, many reasons we're not going to give you all of the secret sauce.

What we are comfortable about saying is all going to be on the support site somewhere.

efodela · Answer

Thank you for the reply. I haven't had the chance to fully scope through the support site for what i am looking for.

But you provided me a direction to look into. My issue is that, in regards to adding agents by WMI in Orion, what is the exact process it uses.

I was advised that every process Orion uses should generally be doable manually and as such orion just makes it faster and more manageable.

I have tried using all WMI calls in powershell to connect to servers but no success if Remote Management is turned off on the server. RPC port tests also fail or come back as filtered so how does Orion connect and make WMI requests in this scenario.

KMSigma.SWI · Answer

Can I ask why you want to know this?  Aren't your questions being covered in the WMI topics on the Support Site?

The shortest answer is that the WMI calls are happening over RPC (the default in earlier versions of the Orion platform) and not over WSMan.  WSMan is the protocol exposed by the "Windows Remote Management (WS-Management)" service.

The other possible answer is that the agent is being used.  If that's the case, then the WMI calls are taking place locally (hence no need for access to them over the network) and then the information is sent via the secure agent channels to the Orion server.