Azure migrate discovery shows "Discovery Incomplete" for Windows servers after "Validation successful"

Question

Azure migrate discovery shows "Discovery Incomplete" for Windows servers after "Validation successful"

Jan Claes 80

We have an on-premises Xen environment where we did install a Windows Server 2022 and installed the Azure Migrate software on it.

We did add all Windows and Linux servers. When we start the Discovery only the Windows servers are showing : "Discovery Incomplete".

User's image

Only port TCP/5985 is available on the servers.

We use a domain admin account which is also local admin on all Windows servers.

Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator

2026-04-07T08:42:17+00:00
Hello Jan, it looks like the appliance is able to reach your Windows hosts (they appear under “Discovery Incomplete”) but can’t finish the WinRM/WMI handshake it needs to collect metadata and run software inventory/dependency analysis. Here are a few things to check:

Enable PS-remoting and WinRM on each server

Log on as Administrator and run in PowerShell:
winrm qc -q Enable-PSRemoting -Force

Make sure you’re not supplying the account in UPN format (domain\user is required today).

Open the right firewall ports

You already have TCP/5985 (WinRM HTTP) open – great.

If you’ve left software inventory or agentless dependency analysis enabled, the appliance will also use WMI/DCOM over TCP/135 and the high-port RPC range (default 49152–65535). Either open those or disable software inventory/dependency on the appliance if you want to isolate just server metadata.

Validate connectivity from the appliance itself

On the appliance VM, open an elevated PowerShell prompt and run:
winrm identify -r:http://<your-server-ip>:5985 -u:'DOMAIN\admin' -p:'password'

Also try a simple WMI call (if you’ve left inventory on):
Get-WmiObject Win32_OperatingSystem -ComputerName <your-server-ip> -Credential (Get-Credential)

Both commands should succeed without timeout or access denied.

Trigger a fresh discovery

In the Azure portal, go to your Migrate project > Discovery and assessment > Appliances > select your appliance > Refresh services.

Wait a few minutes, then refresh the Servers tab.

Hope this helps! If you run into any specific errors during the WinRM/WMI tests, let us know. Thanks

Reference docs:

• Troubleshoot Windows server validation/WinRM errors: https://docs.microsoft.com/azure/migrate/migrate-support-matrix-physical#physical-server-requirements

• Discovery troubleshooting: https://docs.microsoft.com/azure/migrate/troubleshoot-discovery

• Disable software inventory/dependency if you only want basic discovery: https://docs.microsoft.com/azure/migrate/how-to-set-up-appliance-physical#start-discovery
Arno Vanhoutte 0 Reputation points

2026-04-07T12:42:57.21+00:00

Hello Bharath Y P,

We've managed to follow the procedure, but still have the following issue's:

We have 2 datacenters that we want to migrate, so 2 appliances that are scanning each environment. 1 Datacenter have this issue above.

When i run the diagnostics report on both appliances, they come with the same 3 errors:

Both appliances on each datacenter are identical to eachother and also shares the same firewall config.

but the one appliance where the 3 windows server guests are still not validating. the only diffrence between the 2 datacenters, is that the one where everything works have no windows machines, only linux.

Additionally, the ports are open to the requested url:

1 answer

Your answer

Arno Vanhoutte 0 Reputation points

2026-04-07T12:42:57.21+00:00

Hello Bharath Y P,

We've managed to follow the procedure, but still have the following issue's:

We have 2 datacenters that we want to migrate, so 2 appliances that are scanning each environment. 1 Datacenter have this issue above.

When i run the diagnostics report on both appliances, they come with the same 3 errors:

Both appliances on each datacenter are identical to eachother and also shares the same firewall config.

but the one appliance where the 3 windows server guests are still not validating. the only diffrence between the 2 datacenters, is that the one where everything works have no windows machines, only linux.

Additionally, the ports are open to the requested url:

Answer 1

For Windows servers that validate successfully but show “Discovery incomplete,” focus on the ongoing discovery and software‑inventory path between the Azure Migrate appliance and those machines.

Confirm discovery timing

It can take up to ~15 minutes per vCenter source, a couple of minutes per Hyper‑V host, and 1 minute per physical server for initial discovery to complete.
Changes in discovered server configuration can take up to 30 minutes to appear in the portal, and software inventory can take a few hours.
If the state remains “Discovery incomplete” beyond these windows, continue with the steps below.

Refresh the appliance services from the portal After waiting the above intervals:
In Windows, Linux, and SQL Servers > Azure Migrate: Discovery and assessment, select Overview.
Under Manage, select Appliances.
Select Refresh services and wait for the refresh to complete.
Recheck the discovery status for the Windows servers.
Verify connectivity and prerequisites from the appliance to Windows servers Even though TCP 5985 is open and credentials validate, software inventory and deeper discovery can still fail if prerequisites are not fully met:

Ensure all Windows servers meet the Azure Migrate physical/VM prerequisites and port access requirements (WinRM over HTTP 5985 must be reachable end‑to‑end, and any proxy/firewall between the appliance and servers must allow it).
On the appliance, add the IP addresses of the Windows servers to the WinRM TrustedHosts list and retry discovery. This is required to allow remote inbound connections on port 5985.
Confirm the correct authentication method is selected on the appliance for these Windows servers.

If connectivity or prerequisites are not met, you may see software‑inventory errors such as:

60001 – UnableToConnectToPhysicalServer: indicates network or prerequisite issues. Resolve by ensuring prerequisites and ports are open and TrustedHosts is configured, then retry.
60002 – InvalidServerCredentials: indicates expired/incorrect credentials. Edit the credentials on the appliance, revalidate, and then refresh services.

Check for software‑inventory specific errors If discovery is incomplete specifically because software inventory or guest operations cannot run, check the error codes in the Azure Migrate portal for the affected Windows servers. Common causes include:

Missing or invalid guest credentials (10004, 10005).
Unsupported OS type (10006 – only Windows and Linux are supported).
WMI/PowerShell or environment issues on the guest (9022 Get‑WmiObject access denied, 9023/%SystemRoot% empty, 9024/%TEMP% empty, 9025 PowerShell corrupted).
VMware guest operations issues (if applicable) such as missing/outdated VMware Tools (9016, 9021) or missing guest operations privileges on the vCenter account (9015).

For each error, follow the specific remediation in the software‑inventory error table (for example, granting WMI permissions, fixing environment variables, reinstalling PowerShell, or updating VMware Tools), then revalidate and refresh services.

When to contact Microsoft support If:

Discovery remains “Incomplete” after verifying connectivity, credentials, prerequisites, and refreshing services, or
You see transient internal errors (for example, 10002, 9012, 9017) that do not resolve within the next 24‑hour cycle,

collect the appliance machine ID (shown in the footer of the appliance configuration manager) and open a Microsoft support case as recommended in the troubleshooting guidance.

References:

Share via

Azure migrate discovery shows "Discovery Incomplete" for Windows servers after "Validation successful"

1 answer

Your answer