Configuring Windows Hosts for Nessus Credentialed Scans

"Configuring a Windows host for Nessus credentialed scans typically requires more effort compared to Linux systems. While Linux hosts often allow seamless authentication via SSH, Windows introduces additional layers such as authentication models, UAC restrictions, firewall configurations, and service dependencies that must be properly aligned for successful host scanning. The following configuration was performed in a laboratory setup where the Nessus scanner operated on a Kali Linux machine (192.168.50.50) and the target Windows Server was hosted at 192.168.50.10 in virtual environment."

"The following configuration was carried out on a standalone Windows server, where a local administrative account was created to enable credentialed scanning through Nessus. When a Windows server is not joined to a domain, a local account must be created and configured with administrative privileges to support credentialed checks. 1. Creating a Local Administrator Account By default, Windows uses the Guest only model which causes all remote logins to authenticate as guests. This prevents remote vulnerability audits like nessus host scans from succeeding."

Windows hosts require more configuration than Linux for Nessus credentialed scans because of authentication models, UAC restrictions, firewall settings, and dependent services. In a lab, the Nessus scanner ran on Kali Linux (192.168.50.50) against a Windows Server at 192.168.50.10. Standalone Windows servers require creation of a local administrative account and switching the local security policy from Guest only to Classic so remote logins authenticate as the actual user. The Local Security Policy path is Local Policies > Security Options > Network access: Sharing and security model for local accounts. Administrative SMB shares ADMIN$, C$, and IPC$ must be accessible for credentialed checks.

Read at Medium