Install the Windows Wazuh agent

Use the following procedure to install, register and configure a Wazuh agent on a Windows system.

Run the installer to download, install and self-register the Wazuh agent


You will need administrator privileges to perform this installation. PowerShell 3.0 or greater is required.

  1. Log into your Windows Agent instance.

  2. Click the Search Windows icon (magnifying glass in the bottom left of screen). Type: "PowerShell" and right-click on Windows PowerShell.

  3. Click Run as administrator.

  4. Download and run the installer with the following command line. Make sure to replace the IP address in WAZUH_MANAGER and WAZUH_REGISTRATION_SERVER with your Wazuh manager IP address or FQDN.

    Invoke-WebRequest -Uri -OutFile ${env:tmp}\wazuh-agent-4.3.10.msi; msiexec.exe /i ${env:tmp}\wazuh-agent-4.3.10.msi /q WAZUH_MANAGER='<WAZUH_MANAGER_IP_ADDRESS>' WAZUH_REGISTRATION_SERVER='<WAZUH_MANAGER_IP_ADDRESS>' WAZUH_REGISTRATION_PASSWORD='please123' WAZUH_AGENT_NAME="windows-agent"
  5. Start the agent.

    NET START WazuhSvc

Create a shortcut to the Wazuh agent Manager tool on the taskbar

(This is only for lab purposes. In production you will rarely open this tool.)

  1. Open File Explorer (Windows-key + E).

  2. Navigate to the C:\Program files(x86)\ossec-agent directory and find the win32ui executable.

  3. Right-click the win32ui file and select Pin to the taskbar.

Run the Wazuh agent Manager and confirm it is running and connected to the Wazuh manager

  1. Click on the Wazuh icon on your taskbar. It should look like this:

  2. By clicking on View > View Logs you should find a record of the agent successfully receiving a valid key and connecting to the Wazuh manager.

  3. By clicking on Manage, you can Star, Stop and Restart the agent.

On the Wazuh dashboard, click Wazuh > Agents to review all the registered agents and their status.


The C:\Program Files (x86)\ossec-agent\wazuh-agent.state file contains several useful pieces of information about the state of the Wazuh agent connection with the Wazuh manager. See the file content itself for more information.