Unfortunately I don't have an easy answer for this. Windows performance counters, as far as I'm aware, are not built on SNMP. That's an open standard that does pretty much what Windows performance interface does. But for Windows, you should only need the SMB ports open. (137, 138,139,445)
Getting the traffic through is about half of the battle. The other half is permissions. Not only do you need the 'profile system performance' right in the local security policy, but you need file permissions to whatever dll the performance object resides in.
The best advice I can give is to run the test as a domain user that has local administrator rights to the server. This is the surest way to make sure your test can access the performance objects on the server, although it's not the best idea from a security standpoint.