1. Verify Remote Registry Service
• Open services.msc.
• Locate Remote Registry.
• If stopped, select Start and set Startup Type to Automatic.
2. Check firewall and required ports
• Confirm these ports are open: TCP 445, 139, 135.
• Ensure inbound rules allow:
• File and Printer Sharing (SMB-In)
• Remote Event Log Management (RPC)
3. Enable Group Policy and sharing exceptions
• Run gpedit.msc and navigate to:
  Computer Configuration → Administrative Templates → Network → Network Connections → Windows Firewall → Domain Profile
• Enable:
• Allow inbound remote administration exception
• Allow inbound file and printer sharing exception
4. Test WMI connectivity with WBEMTest
• On a different device, open cmd and run wbemtest.
• Connect to the target device using \\<IP or Host>\root\cimv2.
• Click Execute Method, set Object Path to Win32_Process.
• Choose method Create, then Edit In Parameters.
• Locate CommandLine, select Edit Property, and choose Not Null for Value.
• For the Value, enter (do not add any extra spaces): cmd.exe /Q /c netstat -anop TCP 1> \\127.0.0.1\ADMIN$\FILENAME 2>&1
•  Save the property, then save the object, and execute.

5. Verify SMB is enabled
• Run in PowerShell:
• Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol
• Ensure EnableSMB2Protocol is True. Enable SMB2 if disabled.

6. Validate firewall rules for SMB
   • Confirm rules allow these ports:
     • TCP 445 – SMB
     • TCP 135 – RPC Endpoint Mapper
     • Dynamic RPC Ports – 49152–65535 (default)
   • SMB and RPC/DCOM protocols must be permitted for remote execution.

Impacket tools rely on SMB and RPC/DCOM protocols for remote execution. If these ports are blocked, commands like remote netstat or WMI calls will fail

After completing these steps, the Netstat metrics collection should succeed during scans. If the issue persists, confirm RN150 connectivity and re-run the scan.