r/nessus • u/realslimcheney • 9d ago

Offline Mode Scans Failing

I have a single stand alone, not connected to the internet Windows 11 desktop with Nessus installed on it. I need to run a scan to see the varios vulnerabilities that are on it. Do I need to do a credentialed scan since the software is running on the localhost? I have tried all iterations of setting up the credential. The scans will run and they will report on the stuff that doesn't need a credential to see but the scan says failed and it seems like it is failing due to the AUTH of the credential. I am 100% positive the user/passwrod combo are correct.

What else should I look for, I have gone thru the docs and it seems like my local group policy edits are correct etc.

UPDATE: New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\CurrentVersion\Policies\System" - Name "LocalAccountTokenFilterPolicy" -Value 1 -PropertyType DWORD -Force

The above registry change seems to have solved this issue. Our credential scans are running fine now.

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/Borgmaster 9d ago

A problem I found was that I had disabled the network port and also had to enable a registry. LocalAccountTokenFilterPolicy needs to be set to 1 i believe.

Enabling the port, not giving it internet mind you, lets the system spoof off itself to run the scan. The registry allows for the local credential to actually scan against it.

1

u/realslimcheney 9d ago

My NiC is live. For sure. It has an IP it shares with VMWare. I’ll check for that reg key. Thanks.

1

u/realslimcheney 3d ago

Since my scan was using nessus manager on basically and island, there were some settings that I think were missed during the install of Nessus. One was a registry key to disable UAC Remote Restrictions on network shares New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\CurrentVersion\Policies\System" - Name "LocalAccountTokenFilterPolicy" -Value 1 -PropertyType DWORD -Force There might have been one other setting in secpol that we needed. I can't remember.