# wazuh-agent-windows

Companion files for the lesson **Install the Wazuh Agent on Windows**:
<https://maheshtata.com/wazuh/wazuh-agent-windows/>

Tested against: Wazuh 5.0.0-beta5, Windows 11 Pro build 26200 (ARM64), against a
5.0.0-beta5 manager. The install, the service name, the enrolment and the
default event channels were exercised. Server 2019 and Server 2022 were not.

## Files

| File | What it is |
| --- | --- |
| `ossec.conf.fragment.xml` | Partial `<agent>` block for `C:\Program Files (x86)\ossec-agent\ossec.conf`: manager endpoint, config profile, TLS, keepalive and enrolment. |
| `Install-WazuhAgent.ps1` | Two-mode installer. `-Mode Enrol` uses the two documented MSI properties. `-Mode Staged` installs with no properties and applies a prepared `ossec.conf`, which keeps the enrolment password off the command line. Verifies the Authenticode signature, runs the MSI through `msiexec` for an exit code and a log, then starts `WazuhSvc` and reports the state file and the last log lines. |

## Usage

Fleet rollout, password never on a command line:

```powershell
.\Install-WazuhAgent.ps1 -MsiPath .\wazuh-agent-5.0.0-beta5.msi `
                         -Mode Staged `
                         -ConfigPath .\ossec.conf
```

One-off lab endpoint:

```powershell
.\Install-WazuhAgent.ps1 -MsiPath .\wazuh-agent-5.0.0-beta5.msi `
                         -Mode Enrol `
                         -WazuhManager 10.0.0.2 `
                         -RegistrationPassword '...'
```

## Things to check before a rollout

1. **Service name is `WazuhSvc`.** Verified on beta5: `Get-Service *wazuh*`
   returns one service, name `WazuhSvc`, display name `Wazuh`, start type
   Automatic, left Stopped by the installer. Beta documentation pages that use
   `Restart-Service -Name wazuh` are wrong against the package. The script uses
   `WazuhSvc` and falls back to a wildcard lookup only if it is absent.
2. **Supported Windows versions.** The packages list says "10 or later", the
   deployment page says XP through Server 2022, and the enrolment requirements
   page says 7 and later with Server 2008 R2 and later. Only Windows 11 build
   26200 was exercised here. Test your oldest build.
3. **Groups exist first.** Any group in `<enrollment><groups>` must already be
   created on the manager or enrolment is rejected.
4. **Agent name.** Always set `<agent_name>` on image-based deployments.
5. **Clock.** Enrolment signs a short-lived token. A virtual machine reading
   the hardware clock as local time enrols anyway (the agent self-corrects from
   the manager's `Date` header) but the manager logs a `stale_token` warning.
   Fix time synchronisation before a rollout.
6. **No firewall rule, no registry value.** The MSI creates neither. Detect the
   install from the service or from `VERSION.json` in the agent folder.

## Group policy note

Group policy Software Installation cannot pass MSI properties. Either attach a
transform (`.mst`) that sets `WAZUH_MANAGER` and `WAZUH_REGISTRATION_PASSWORD`,
or assign the MSI with no properties and push the prepared `ossec.conf` with a
group policy preference or startup script. The second option is what
`-Mode Staged` is for.