The fourteen-hour scan that still misses a quarter of the estate

A host is declared down by the scanner's host-discovery step, not by the plugins. If the policy's ping settings are ICMP-only and the estate's host firewalls (Windows Firewall by default blocks inbound echo in many baselines, and network ACLs often do too) drop ICMP, live hosts are eliminated before a single plugin runs. The technician's ping working from her desk does not contradict this - different source segment, different rule set.

Policy fixes:

• Enable TCP-based liveness checks against ports that are genuinely open (445/139 for Windows, 22 for Unix), and ARP on local segments.
• Consider a two-phase approach: a lightweight Host Discovery scan to produce a live-host asset list, then the full scan targeted at that list. This also shortens the window.
• Verify the host timeout isn't prematurely abandoning slow hosts.

Network causes still worth ruling out: the edge ACL in front of 10.20.0.0/20, and whether the zone's scanner is the one you think it is. If a different scanner in another zone were used, the ping behavior would be identical but the reachable set would differ - check which scanner actually ran the scan before tuning anything.

Work from cheapest-to-check outward, and treat "credentials configured" and "credentials working" as different facts.

1. Confirm the failure is uniform or clustered. Pull the scan-information output per host and group by subnet. Clustered failures point at a network/ACL problem; scattered failures point at host configuration.
2. Reachability of the credential channel. SMB needs 445 inbound from the scanner. Host firewalls, segment ACLs, and IPS between scanner and targets are the most common culprits. Test from the scanner itself, not from a workstation.
3. Account usability on the target. Is the service account allowed to log on locally / access administrative shares? Is it locked, expired, or denied by policy? Local-account-token and remote-UAC restrictions can silently block remote registry and share access even when authentication succeeds.
4. Credential scope design. Policy credentials apply to every target in that scan. If the /20 mixes domain, workgroup, appliance, and Unix hosts, one credential set cannot serve them; split into separate policies (or scoped credential sets) so each host class gets only the credentials that apply.
5. Re-run a small sample (10 hosts, one policy change at a time) and confirm the credentialed flag flips before re-running 4,094.

Reduce work per host and increase parallelism across hosts, in that order.

Per-host reduction:

• "Every family" is almost never justified on a routine internal scan. Move to a curated policy (safe checks on, discovery + the families that matter for this estate) and keep the exhaustive policy for a quarterly deep scan of a smaller slice.
• Lower per-host concurrency is sometimes the cause of long scans; 5 checks per host is conservative for modern hosts. Raise it moderately, watch for target destabilization, and keep host timeout sane.

Across-host parallelism:

• Split the /20 by zone/segment across scanners rather than serially through one. With 5 concurrent scans per scanner, one scanner is the bottleneck no matter how good the policy is.
• Use the live-host list from Host Discovery as the target, so time isn't spent on dead addresses.
• Stagger schedules so the two existing zones aren't competing for the same scanner slots.

Then measure: capture scan duration and credentialed-success rate for a single /24 before committing the full run. Validate the 8-hour target on the sample, not on hope.