Windows agent - unable to start agent (check config)

[Krzysztof Zaklikiewicz]

Hello

I can't start ossec agent for Windows 7 Pro - agent displays error unable to start agent (check config). My Windows is Polish, I added group Administrators and nothing changed. Please help.

Best regards
Krzysztof Zaklikiewicz

[Jose Luis Ruiz]

Hi Krzysztof

are you compiling your own windows agent from sources? or you are downloading from any web?

———————— 

Jose Luis Ruiz

Wazuh Inc.

jo...@wazuh.com

--

---
You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Krzysztof Zaklikiewicz]

Hi

I downloaded from http://ossec.wazuh.com/windows/

In addition, I had to manually add the IP address of the server to ossec.conf <client> <server-ip> 192.168.17.14 </ server-ip> </ client>

Logs of ossec.log

2016/03/29 21:36:22 ossec-agent: INFO: Service does not exist (OssecSvc) nothing to remove.

2016/03/29 21:36:22 ossec-agent: INFO: Successfully added to the service database.

2016/03/29 21:36:23 setup-windows: INFO: System is Vista or newer (Microsoft Windows 7 Business Edition Professional Service Pack 1 (Build 7601) - OSSEC HIDS v2.8.3).

2016/03/29 22:08:48 ossec-agent: Using notify time: 600 and max time to reconnect: 1800

2016/03/29 22:08:48 ossec-agent(1402): ERROR: Authentication key file 'client.keys' not found.

2016/03/29 22:08:48 ossec-agent(1750): ERROR: No remote connection configured. Exiting.

2016/03/29 22:08:48 ossec-agent: INFO: Received exit signal.

[Pedro Sanchez]

Did you use the UI (win32ui.exe) to add the key? You need to import the key extracted from Manager. Open it as Administrator, paste the key on "Authentication key" and click on "Save" button.

The log is telling us that you didn't add the key, so the file client.keys is not created.

[Jose Luis Ruiz]

Try to add and admin user to this new Administrator group and reinstall Ossec

-----------------------

Jose Luis Ruiz

Wazuh Inc.

jo...@wazuh.com

[Victor Fernandez]

Hi.

Have you added the original administrator and your own account to the "Administrators" group?

I followed your steps, added my user account to "Administrators", closed and reopened my session, and it did work.

Regards.

[Krzysztof Zaklikiewicz]

Hi

Thanks for answer, I try after 6 pm beacuse now people are working and can not reset the computer.

[Krzysztof Zaklikiewicz]

Hi

Thanks guys now it's works fine, but on Windows 2012 Server is still problem. I was doing exectly the same how on Windows 7 but when I start agent show error UNABLE TO START AGENT (CHCECK CONFIG), my ossec.log:

2016/03/31 20:31:45 ossec-agent: INFO: Service does not exist (OssecSvc) nothing to remove.

2016/03/31 20:31:45 ossec-agent: INFO: Successfully added to the service database.

2016/03/31 20:31:45 setup-windows: INFO: System is Vista or newer (Microsoft Windows Server 2012 Standard Edition  (Build 9200) - OSSEC HIDS v2.8.3).

2016/03/31 20:31:56 ossec-win32ui: INFO: Running the following command (C:\Windows\system32\cmd.exe /c echo y|cacls "new-ossec.conf" /T /G Administrators:f)

2016/03/31 20:31:58 ossec-win32ui: INFO: Running the following command (C:\Windows\system32\cmd.exe /c echo y|cacls "client.keys" /T /G Administrators:f)

What's wrong??

W dniu wtorek, 29 marca 2016 22:51:25 UTC+2 użytkownik Victor Fernandez napisał:

[Victor Fernandez]

Hi.

I remember a problem that I had with permissions in Windows: please check that your OSSEC directory (like C:\Program Files\ossec-agent) and every file contained in it have full permissions for "Administrators".

I hope this solves your problem.

Best regards.

[Krzysztof Zaklikiewicz]

Hi

I checked every file and folder and I was given him full permision for Administrators group but is still the same, nothing changed.

Best Regards

[Jayalaxmi K]

Hi Krzysztof ,

Could you please give me the link to download oSSEC agent for windows workstations?? I dint find any details regarding installation od OSSEC agent for windows workstation.

//Jaya

[Jose Luis Ruiz]

Hello Jaya

You can download from the following link:

http://ossec.github.io/downloads.html

or 

https://bintray.com/artifact/download/ossec/ossec-hids/ossec-agent-win32-2.8.3.exe

Regards

-----------------------

Jose Luis Ruiz
Wazuh Inc.
jo...@wazuh.com

--