Windows agents

To register the Windows Agent, you need to start a CMD or a Powershell as Administrator. The installation directory of the Wazuh agent in Windows host depends on the architecture of the host.

  • C:\Program Files (x86)\ossec-agent for x86_64 hosts.

  • C:\Program Files\ossec-agent for x64 hosts.

This guide suppose that the Wazuh agent is installed in a x86_64 host, so the installation path will be: C:\Program Files (x86)\ossec-agent.

After that, you can register the agent using agent-auth.exe and your password:

  1. Register the agent using the password. The agents can use the password by storing it on a file or as a command line argument, so you can use any of these two options:

    1. Write the password on C:\Program Files (x86)\ossec-agent\authd.pass and run the agent-auth program:

    # echo TopSecret > C:\Program Files (x86)\ossec-agent\authd.pass
# C:\Program Files (x86)\ossec-agent\agent-auth.exe -m <MANAGER_IP_ADDRESS>

    1. Run the program with the -P flag, and insert the password:

    # C:\Program Files (x86)\ossec-agent\agent-auth.exe -m <MANAGER_IP_ADDRESS> -P "TopSecret"

  2. Edit the Wazuh agent configuration to add the Wazuh server IP address.

In the file C:\Program Files (x86)\ossec-agent\ossec.conf, in the <client><server> section, change the MANAGER_IP value to the Wazuh server address:

<client>
  <server>
    <address>MANAGER_IP</address>
    ...
  </server>
</client>

  1. Start the agent.

    1. Using Powershell with administrator access:

      # Restart-Service -Name wazuh

    2. Using Windows cmd with administrator access:

      # net stop wazuh
# net start wazuh