Installing Wazuh agents on Windows systems
The agent runs on the host you want to monitor and communicates with the Wazuh manager, sending data in near real time through an encrypted and authenticated channel.
Note
To perform the installation, administrator privileges are required.
To start the installation process, download the Windows installer.
Select the installation method you want to follow: command line interface (CLI) or graphical user interface (GUI).
To deploy the Wazuh agent to your system, choose one of the command shell alternatives and edit the
WAZUH_MANAGER
andWAZUH_REGISTRATION_SERVER
variables so that they contain the Wazuh manager IP address or hostname.Using CMD:
wazuh-agent-4.1.5-1.msi /q WAZUH_MANAGER="10.0.0.2" WAZUH_REGISTRATION_SERVER="10.0.0.2"
Using PowerShell:
.\wazuh-agent-4.1.5-1.msi /q WAZUH_MANAGER="10.0.0.2" WAZUH_REGISTRATION_SERVER="10.0.0.2"
For additional deployment options such as agent name, agent group, and registration password, see the Deployment variables for Windows section.
The installation process is now complete and the Wazuh agent is successfully installed, registered, and configured, running on your Windows system.
Note
Alternatively, if you want to install an agent without registering it, omit the deployment variables. To learn more about the different registration methods, see the Registering Wazuh agents section.
To install the Wazuh agent on your system, run the Windows installer and follow the steps in the installation wizard. If you are not sure how to answer some of the prompts, use the default answers. Once installed, the agent uses a GUI for configuration, opening the log file, and starting or stopping the service.
The installation process is now complete and the Wazuh agent is successfully installed on your Windows system. The next step is to register and configure the agent to communicate with the Wazuh manager. To perform this action, see the Registering Wazuh agents section.
By default, all agent files are stored in
C:\Program Files (x86)\ossec-agent
after the installation.
Uninstall a Wazuh agent
To uninstall the agent, the original Windows installer file is required to perform the unattended process:
msiexec.exe /x wazuh-agent-4.1.5-1.msi /qn
The Wazuh agent is now completely removed from your Windows system.