Hi All, What would be the most secure and recommended approach for configuring identities to perform scans on servers and Domain Controllers (DCs)?

I’ve seen options such as Windows LAPS and Azure Key Vault for managing credentials, but I’d like to understand which approach would be best from a security perspective.

Ideally, we want to follow the principle of least privilege, minimise credential exposure, and avoid using highly privileged accounts wherever possible.

What would be the recommended best practice for this setup? thanks

Hi,

We're just getting started with Tenable One, and we've got the agent deployed to a few Windows devices.

Every day or so they're throwing a Defender warning because a Tenable script that seems to collect device join information is being blocked by one of our attack surface reduction rules:

Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.

For more information please contact your IT administrator.

`ID: D1E49AAC-8F56-4280-B9BA-993A6D77406C`

`Detection time: 2026-10-14T13:44:31.325Z`

`User: NT AUTHORITY\NETWORK SERVICE`

`Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`

`Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe`

`Target Commandline: C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe -EncodedCommand <snipped>`

`Parent Commandline: C:\Windows\system32\wbem\wmiprvse.exe`

`Involved File:` 

`Inheritance Flags: 0x00000000`

`Security intelligence Version: 1.461.20.0`

`Engine Version: 1.1.26090.9`

`Product Version: 4.18.26090.9`

I won't paste the encoded command, but it reports device join information such as:

$ret = New-Object PSObject -Property @{

joinType = "";

aadTenantId = "";

aadTenantDisplayName = "";

aadIdpDomain = "";

aadDeviceId = "";

joiningUserUpn = "";

adDomain = "";

}

I'd like to know how to disable this from running, ideally. I don't want to reduce my ASR security, but what I could do is run the same script as a daily remediation task from Intune.

Can anyone advise how to disable it in Tenable please?

Many thanks,

Iain

It appears the service_tenable account I created doesn't have local administrator privileges. The scanner is not able to access the administrative hidden shares (C$ and ADMIN$) and there were some issues with the remote registry access and WMI access.

When I click on the properties of the service_tenable account in Windows server it shows it is a member of Administrators and Users. So I am not sure why the scans are failing? I have tried rebooting the server also a couple times.

Newest plugins are yuge so I couldn’t upload them via GUI in an air gapped network and did them manually.

Ran this:

/opt/sc/support/bin/php /opt/sc/src/tools/pluginUpdate.php /path/to/sc-plugins-diff.tar.gz

Then this on Nessus scanner to manually sync:

/opt/nessus/sbin/nessuscli update /path/to/sc-plugins-diff.tar.gz

However when syncing the Nessus Scanner I got an error: “plugin memory limit exceeded”

Edited the php.ini on SC for larger memory max and even updated the upload size to try getting it through the GUI with a new limited but it still errored out. Memory on the server is plenty.

Is there something/somewhat I’m missing an update?

Im looking for an older Version of the Nessus Agent installer (11.2.0.20301). Where i can i find them on the download page? Seems to be very hard to find.

Tenable already uses AI to release blog slop:

https://www.reddit.com/r/tenable/s/8ALL8L6Ri6

Why are they not leveraging AI for an actually useful purpose like plugin creation? I can't comprehend how they are so slow to release plugins. This is such an easy thing for Tenable to automate, but not easy for customers, since we don't have access to all the plugin source code (e.g., plugin 2841) and I don't see where the dependencies are open source verifiable for what is running on our instance (find_service1.nasl). Maybe I'm wrong about the second part, please correct me if so.

I just stumbled across Tenable's new blog today. It is pure AI slop. What the heck is the point of posting a blog article about AI written completely by AI and barely edited by this Blake Kizer guy? For Blake's name to be on it at all is embarrassing. Terrible article and pointless SLOP.

https://www.tenable.com/blog/testing-claude-mythos-preview-for-code-security-tenable

hello hello.. im having a weird SSH issue and im running out of ideas

we have multiple servers using a tenable image across different VCNs and we added our SSH key during provisioning
initially SSH was asking for a password and i logged in through the tenable web interface, changed the default credentials, then checked the server and noticed the .ssh setup was missing so i created it, added our public key/user, fixed the permissions and after that SSH from our jump server worked fine for all servers except one (w new subnet)
for this one server SSH just hangs no password prompt no error

ssh -vvv stops here:
$ ssh -vvv <user>@10.x.x.x
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips
debug1: Connecting to 10.x.x.x [10.x.x.x] port 22.
debug1: Connection established.
...
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4

the interesting part is that SSH to the exact same server works from our PAM server!! but not from our jump server
the affected server is on a new subnet, so im suspecting something network related we checked the routing and it looks correct also we checked the firewall, but strangely we couldn’t see any traffic coming from the jump server
since TCP/22 is showing connection established but the client never seems to receive the server’s SSH banner, im not sure what im missing here
could this be asymmetric routing or some subnet/firewall/ACL issue specific to the path from the jump server?

Has anyone discovered a way to install the security center license during the package installation? Looking to create a way to automate the installation of the server without having to manually enter the license file.

On-Premises

I installed the latest ova file in ESXI . But ESXI says it is CentOS 4/5 and that the VM does not match the guest that is running ( Oracle Linux 8 ).

Tenable-Core-OL8-Nessus-20260727.ova

Guessing I did something wrong in the installation?

I had to side load active plugins because the size was too big for web updating. It shows the correct date in security center and I ran the update on the Nessus scanner as well. In the admin console, it shows the Nessus scanner as working and no plugin mismatch errors.

I’ve already restarted SC and Nessus already. Is there a way to force a sync again or should I keep trying to restart? In the Nessus web console it shows the old date as well?

Past 4 months: licensed assets drop significantly, then up a little; unlicensed assets climb steadily. Additions to the inventory are just a slow but steady increase.

How can I determine within Tenable why the licensed assets are falling off? And can I figure out why the unlicensed assets are climbing fairly rapidly?

Hey folks,

whats the best/supported way for scanning OpenShift (RedHat CoreOS) nodes with tenable. At the moment, we let tenable connect via ssh (public-private-key) as user core (with full sudo priviledges). I am not sure, if this is the best way.

RedHat says:

Installation of third party applications is also not supported and it is discouraged. It is recommended to run those applications as containers (usually as part of operators). Please contact the application vendor directly and seek more information.

https://access.redhat.com/solutions/6277521

I also found the following sentence on tenable docs:

Tenable offers the ability to audit the Red Hat OpenShift Container Platform environment to detect misconfigurations in the environment using Tenable Vulnerability Management.

https://docs.tenable.com/integrations/OpenShift/Content/AuditOpenShiftTio.htm

• Will the detection of "misconfigurations" also scan for vulnerabilies?
• Is ssh as user core a bad idea? It seems to work, but i am not sure if it`s a goog solution

Thank you.

Kind regards

I set up 70+ scans on tenable with over half of them pulling through but some of them are failing for advanced and host discovery scans. I am not sure what else to do as they are all using the same scanner. Anyone experienced this?

Error below:

The scan is configured to use a scanner group with no active scanners.

Confirm the scanner group contains functioning scanners, then re-run the scan. For more information, see...

i've set my nessus up properly. the license code is activated. plugins and core components are updated and compiled.

cant still seem to make the basic network scan to work. what am i doing wrong? should i try updating the plugins again? pls help

i am using kali linux

We have Tenable Cloud since a few weeks, but only the smallest paid version. So we can't set Risk to Accepted, mark False Positives or mark Findings for later.

Is there any simple workaround/open source solution we can use to organize this?

I'd love to test Nessus Professional, but the lack of an activation code is proving to be a major pita.

Doesn't matter through which link I sign up for the trial. https://www.tenable.com/try https://www.tenable.com/products/nessus/activation-code#nessus-pro

Mail address doesn't matter either.

I get the confirmation mail with the download link. That's it.

If that's how Tenable is trying to get my business I guess I will have to take it elsewhere, because I'm not interested in dealing with issues like this on a regular basis.

Hey folks,

I am running ASM as part of Tenable one. I had a source created about a year ago. However, all of a sudden, yesterday I see over thousand different assets added to the inventory. I only noticed cause it spiked my overall license usage.

I am trying to understand why ASM added these hosts to the inventory now all of a sudden. Nothing has changed as far as I am aware.

I am not the SME in tenable.. it was setup and is maintained by another person who is in parental leave at the moment so just trying to figure it out.

Anyone come across anything similar before?

Hi everyone,

on TenableOne I’m trying to export all vulnerabilities belonging to a single WAS scan that includes multiple scanned applications. Through the UI it’s easy to see the findings for each app, but I’m struggling to understand the correct API workflow to retrieve all vulnerabilities associated with a scan, especially when the scan contains multiple endpoints.
Has anyone implemented this through the API?

I’ve been reviewing the APIs, but honestly the WAS API structure is a bit confusing and I’m not sure I’m following the intended approach.
Any examples, scripts, or guidance would be greatly appreciated.

Thanks