Deploying Wazuh agents on Windows endpoints

The Wazuh agent runs on the endpoint you want to monitor. It sends data to the Wazuh manager in near real time through an encrypted and authenticated channel. For the supported Windows versions, see Requirements.

Before you start, create an enrollment token on the Wazuh manager, as described in Generate the enrollment token. You can also create it in the Wazuh dashboard, under Agents management > Enrollment tokens. The endpoint must reach the Wazuh manager on port 1517/TCP.

1. Download the Windows installer to start the installation process.

2. Select the installation method you want to follow: Command Line Interface (CLI) or Graphical User Interface (GUI).

   CLIGUI

   1. Choose one of the command shell alternatives to deploy the Wazuh agent on your endpoint. Make sure the downloaded Wazuh agent installation file is in your working directory and run the following command.

      • Using CMD:

        > start /wait wazuh-agent-5.0.0-rc2.msi /q WAZUH_ENROLLMENT_TOKEN="<ENROLLMENT_TOKEN>" WAZUH_AGENT_NAME="<AGENT_NAME>"
        

      • Using PowerShell:

        > Start-Process -FilePath ".\wazuh-agent-5.0.0-rc2.msi" -ArgumentList '/q WAZUH_ENROLLMENT_TOKEN="<ENROLLMENT_TOKEN>" WAZUH_AGENT_NAME="<AGENT_NAME>"' -Wait
        

      Replace <ENROLLMENT_TOKEN> with the token you created in Generate the enrollment token. Replace <AGENT_NAME> with a name that no other agent uses, for example, the endpoint's host name. If you omit WAZUH_AGENT_NAME, the agent enrolls under the endpoint's host name.

      For additional deployment options such as agent group, see the Deployment variables section.

      Note

      Alternatively, if you want to install an agent without enrolling it, omit the deployment variables. To learn more about the different enrollment methods, see the Wazuh agent enrollment section.

   2. Start the Wazuh agent from the GUI or by running:

      • Using CMD:

        > NET START WazuhSvc
        

      • Using PowerShell:

        > Start-Service wazuhsvc
        

   3. Check that the Wazuh agent is enrolled and connected. In PowerShell, run:

      > Get-Service WazuhSvc
      > Select-String -Path "C:\Program Files (x86)\ossec-agent\ossec.log" -Pattern "enrollment succeeded|ERR_|rejected|malformed|bootstrap failed"
      

      Get-Service shows Running, and Select-String shows Token bootstrap: enrollment succeeded. If Get-Service shows StopPending or Stopped within a few seconds of the start, wait a few seconds and run it again.

      If the service stopped or the agent didn't enroll, the cause is one of these:

      • ERR_BAD_TOKEN: the installer refused the token, for example because it lost a character when you copied it. No token was stored, and the service stops when you start it.

      • Enrollment rejected by the manager or Enrollment-token bootstrap failed means that the Wazuh manager refused the enrollment. For example, the token was revoked or expired, or another agent already uses the name. The service stops.

      In each case, enroll the agent with a valid token. In an administrator PowerShell, run:

      > Set-Content -Path "<TOKEN_FILE_PATH>" -Value '<ENROLLMENT_TOKEN>' -Encoding ascii
      > & "C:\Program Files (x86)\ossec-agent\wazuh-agent-auth.exe" --token-file "<TOKEN_FILE_PATH>"
      > Remove-Item "<TOKEN_FILE_PATH>"
      > Start-Service WazuhSvc
      

      You can also uninstall the agent and reinstall it with a valid token. After ERR_BAD_TOKEN, the agent enrolls under the endpoint's host name. Select-String keeps showing the old failure lines above the new success line, because C:\Program Files (x86)\ossec-agent\ossec.log keeps them.

   In the Wazuh dashboard, Agents management > Summary lists the agent as Active. Its first alerts can take a few minutes to appear on a new deployment. The installation process is now complete, and the Wazuh agent is successfully installed and configured.

By default, all agent files are stored in C:\Program Files (x86)\ossec-agent after the installation.