Install Wazuh Agent on Windows: Complete Guide 2026

To install the Wazuh agent on Windows, download the MSI installer from the Wazuh portal, run it with the WAZUH_MANAGER=SERVER_IP parameter, and the agent registers and connects to the server automatically. The whole process takes less than 5 minutes.

How to install the Wazuh agent on Windows step by step?

In this guide I'll show you how to install the Wazuh agent on Windows and configure the most important parts of the ossec.conf file. The agent is the component that collects logs, monitors file integrity and sends all the information to the Wazuh server.

Prerequisite: connectivity with the server

Important: Before installing the agent, make sure the Windows machine has connectivity with the Wazuh server. The agent needs to communicate with the server to send logs and receive its configuration.

You can verify connectivity in several ways:

1. Ping the server

ping SERVER_IP

2. Check access to the Dashboard (port 443)

# Using PowerShell
Invoke-WebRequest -Uri https://SERVER_IP -SkipCertificateCheck

# Or open it in the browser
https://SERVER_IP

If the Dashboard loads correctly, there's connectivity. If it doesn't work, check:

The server firewall (ports 443 and 1514 open)
The Windows firewall on the client
Network/VPN configuration if they are on different networks

What is the installation command?

Run this command in PowerShell as Administrator. You must replace the following values with the ones for your environment:

WAZUH_MANAGER: IP or hostname of your Wazuh server
WAZUH_AGENT_NAME: Identifying name for this agent (e.g.: PC-ACCOUNTING, SERVER-WEB, etc.)

Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.7.0-1.msi -OutFile wazuh-agent.msi; Start-Process msiexec.exe -ArgumentList "/i wazuh-agent.msi /q WAZUH_MANAGER=YOUR_SERVER_IP WAZUH_AGENT_NAME=AGENT_NAME" -Wait

Real example: If your Wazuh server is at 192.168.1.100 and you want to name the agent "PC-OFFICE":

Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.7.0-1.msi -OutFile wazuh-agent.msi; Start-Process msiexec.exe -ArgumentList "/i wazuh-agent.msi /q WAZUH_MANAGER=192.168.1.100 WAZUH_AGENT_NAME=PC-OFFICE" -Wait

The ossec.conf configuration file

The agent's configuration file is located at:

C:\Program Files (x86)\ossec-agent\ossec.conf

This XML file holds the entire agent configuration. The two most important sections are localfile and syscheck.

What does the localfile section do for log monitoring?

The <localfile> section defines which Windows system logs you want to send to Wazuh. By default, the agent monitors the main Event Logs:

Security: Security events (logons, failed access, permission changes, etc.)
System: Operating system events (boot, service stops, hardware errors)
Application: Events from installed applications

Example configuration in ossec.conf:

<localfile>
  <location>Security</location>
  <log_format>eventchannel</log_format>
</localfile>

<localfile>
  <location>System</location>
  <log_format>eventchannel</log_format>
</localfile>

How does the syscheck section enable File Integrity Monitoring (FIM)?

The <syscheck> section configures File Integrity Monitoring. This feature detects changes in critical system files and folders:

Creation of new files
Modification of existing files
Deletion of files
Permission changes
Changes to the Windows registry

What is it for? FIM is crucial for detecting malware, ransomware or unauthorized changes. If an attacker modifies system files or ransomware starts encrypting documents, Wazuh will generate alerts immediately.

Example configuration:

<syscheck>
  <frequency>300</frequency>
  <directories check_all="yes">C:\Windows\System32</directories>
  <directories check_all="yes">C:\Users\*\Documents</directories>
  <windows_registry>HKEY_LOCAL_MACHINE\Software</windows_registry>
</syscheck>

Useful commands

Some PowerShell commands to manage the agent:

# Restart the agent service
Restart-Service WazuhSvc

# Check the service status
Get-Service WazuhSvc

# View the agent logs (last 50 lines)
Get-Content "C:\Program Files (x86)\ossec-agent\ossec.log" -Tail 50

Additional resources

Frequently Asked Questions

How long does it take to install the Wazuh agent on Windows?

The whole process takes less than 5 minutes. You download the MSI installer, run it from PowerShell with the WAZUH_MANAGER parameter set to your server IP, and the agent registers and connects to the server automatically.

Which ports does the Wazuh agent need open?

The agent needs to reach the Wazuh server on port 1514 to send logs, and port 443 is used to access the Dashboard. Make sure both the server firewall and the Windows firewall on the client allow this traffic.

Where is the Wazuh agent configuration file on Windows?

The configuration file is ossec.conf, located at C:\Program Files (x86)\ossec-agent\ossec.conf. It is an XML file whose two most important sections are localfile, for log collection, and syscheck, for file integrity monitoring.

What Windows logs does the agent collect by default?

Through the localfile section the agent collects the Security, System and Application Event Logs using the eventchannel format. The Security log captures logons, failed access and permission changes, which are key for detecting attacks.

How do I restart or check the Wazuh agent service?

Use the PowerShell commands Restart-Service WazuhSvc to restart it and Get-Service WazuhSvc to check its status. You can review the agent logs with Get-Content on C:\Program Files (x86)\ossec-agent\ossec.log.

Related articles:

Get Wazuh deployed the right way

We can configure agents, build custom rules, integrate with other tools and much more as part of a professional implementation.

Professional implementation