The WMI Agent is Versa software installed on a Windows device inside an Active Directory domain. It monitors AD login and logoff events and forwards them, over TLS, to a VMS server – enabling passive user authentication on Secure SD-WAN devices without requiring a captive portal.
Key takeaways
- Installed on a Windows device inside an Active Directory domain.
- Forwards AD login and logoff events to a VMS server over TLS.
- Enables passive user authentication with no captive portal needed.
- Runs standalone or as a software package on Windows Server 2016.
- Supports group and user filters to control what gets monitored.
On this page: Why it mattersHow it worksWMI Agent deployment modelsWMI Agent & VMSFAQ
Why is the WMI Agent important?
Captive portals are the default way SD-WAN devices confirm who’s on the network, but they interrupt every user with a login page – friction multiplied across every branch, every day. The WMI agent removes that friction for domain-joined Windows users: because Active Directory already authenticates the login, the WMI agent listens for that event and relays it onward, so the network learns who’s connected without asking the user to do anything at all.
That passive model also closes a visibility gap for policy enforcement. Without a live user-to-IP mapping, a Secure SD-WAN device can only apply policy by IP address or subnet – a poor proxy for identity-based rules like per-user firewall policy or role-based access. By streaming AD events through VMS to VOS devices, the WMI agent gives every enforcement point a continuously refreshed user identity to apply policy against, standing in for a captive portal at branch scale.
What is the WMI Agent?
The WMI agent is a Windows Management Instrumentation client that installs on a Windows 10 or Windows Server 2016 machine sitting inside an Active Directory domain – either as a standalone component or bundled as a software package. Once configured with the domain’s authentication details, it subscribes to Active Directory login and logoff notifications and republishes them as incremental updates to a real-time messaging server.
That messaging server is the Versa Messaging Service (VMS): a message-streaming platform that receives the WMI agent’s user events and disseminates them to VOS devices for policy enforcement. Communication runs over a secure, certificate-based connection – a root CA certificate generated on the VMS server is installed on the Windows host before setup, and a client certificate is imported afterward, so both ends complete two-way TLS authentication.
WMI Agent deployment models
The WMI agent supports two install shapes on the Windows side: a lightweight standalone client, or installation as a software package on an existing Windows server. Both run on Windows 10 Client or Windows Server 2016, and both connect outward to one or more VMS servers configured with an FQDN, port, and TLS settings.
Configuration after installation covers three areas. Active Directory settings define the domain, a service account, and the reconnect interval the agent uses if the connection drops; a non-administrator account can be scoped to read event logs only, rather than granting full administrator rights. VMS settings define the tenant name, how long a user-IP mapping stays valid before it expires, and how quickly duplicate login events are ignored. Group and user filters then narrow monitoring to specific Active Directory groups or individual accounts, so unrelated service accounts or shared machines don’t generate noise. See Install and Configure the WMI Agent for the full field-by-field configuration.
WMI Agent & VMS
The WMI agent is one of several external sources VMS ingests through its northbound interface, alongside RADIUS accounting, SCIM identity updates, and threat-intelligence feeds; VMS normalizes each source’s data and streams it southbound to subscribed VOS devices. In this specific pipeline, VMS’s third-party authentication service is what the WMI agent feeds: it verifies user identity without any explicit login step, letting Secure SD-WAN devices apply identity-aware policy the same way a captive portal would, without ever displaying one. See Install and Configure VMS for how a VMS cluster is deployed, and Enable and Configure VMS Services for turning third-party authentication and the other VMS microservices on per tenant.
Frequently asked questions
What does the WMI agent actually do?
The WMI agent monitors Active Directory login and logoff events on a Windows device and forwards them to a VMS server. VMS then distributes that user-identity data to VOS devices, which use it to enforce policy without requiring the user to log in through a captive portal.
Where does the WMI agent get installed?
The WMI agent installs on a Windows device that sits inside an Active Directory domain – either a standalone Windows 10 client or a Windows Server 2016 host running it as a software package. It needs network reachability to both the AD server and the VMS server.
How does the WMI agent authenticate to VMS?
The WMI agent uses certificate-based TLS. A root CA certificate generated on the VMS server is installed on the Windows device before agent installation, and a client certificate exported from VMS is imported into the agent afterward, completing mutual authentication for the connection.
Does the WMI agent replace a captive portal?
Yes, for domain-joined Windows users. Because Active Directory already authenticates the login, the WMI agent passively relays that event through VMS to VOS devices, confirming identity without ever redirecting the user to a captive portal login page or requiring any extra action from them.
Can I control which users or groups the WMI agent monitors?
Yes. The WMI agent supports group filters, which scope monitoring to specific Active Directory groups, and user filters, which monitor or ignore individual accounts by name – useful for excluding service accounts, kiosk logins, or shared machines from identity-based policy enforcement.
More on the WMI Agent
If you want to learn more, these are sources we trust.
| Versa Networks: platform | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages for the platform the WMI agent’s identity data feeds into. | The service that consumes WMI-derived identity for policy, as packaged by the vendor. | Training and labs covering VMS, identity services, and Secure SD-WAN configuration. |
Related terms
If you’re reading about the WMI agent, these are worth looking at next.
| Captive Portal | Secure SD-WAN | Versa Operating System |
|---|---|---|
| The login-page authentication method the WMI agent’s passive model is built to avoid. | The networking and security platform that applies policy using WMI-derived user identity. | The software on VOS devices that enforces policy against the identity data VMS relays. |