GPO Agent install

58 views
Skip to first unread message

German DiCasas

unread,
Jun 22, 2026, 6:08:29 PMJun 22
to Wazuh | Mailing List
Hi Team,

I did a GPO to install the agent as documented over Deploying Wazuh agents using Windows Group Policy Objects (GPO) | Wazuh

But, It is posible to edit it with centralized configuration too (https://documentation.wazuh.com/current/user-manual/reference/centralized-configuration.html) ? I mean, install over GPO with centralized configuration.

Thanks

German

Jorge Eduardo Silva Jackson

unread,
Jun 22, 2026, 6:28:11 PMJun 22
to Wazuh | Mailing List
Hi German, let me see..

Jorge Eduardo Silva Jackson

unread,
Jun 22, 2026, 6:48:58 PMJun 22
to Wazuh | Mailing List

Yes, you can use both approaches together.

The GPO deployment method can be used to install and enroll the Wazuh agent on Windows endpoints. After the agent is installed, enrolled, and connected to the Wazuh manager, you can manage part of its configuration remotely using centralized configuration through the agent.conf file.

A common approach would be:

  1. Deploy the Windows agent using GPO, including the required deployment variables, such as WAZUH_MANAGER and WAZUH_REGISTRATION_SERVER. You can also use the WAZUH_AGENT_GROUP variable to automatically assign the agent to a specific group during installation.

  2. Ensure that the group already exists on the Wazuh manager before deploying the agents. If a non-existent group is specified during enrollment, the enrollment process will fail.

  3. Configure the shared agent.conf file for that group on the Wazuh manager.

  4. Once the agent is installed, enrolled, and assigned to the group, it will receive the centralized configuration from the manager.

Please note that centralized configuration is not used to install the agent itself. It is used to manage supported agent settings after the agent is already enrolled. Also, not every local ossec.conf option can be managed centrally, so you should check whether the module or setting you want to configure is supported in agent.conf.

For example, centralized configuration can be used for modules such as FIM/syscheck, log collection/localfile, SCA, syscollector, labels, rootcheck, command monitoring, and client buffer settings.

With this approach, the deployment can be fully automated: the agent is installed through GPO, assigned to the proper group during installation, and then receives the corresponding centralized configuration from the manager.

References:

German DiCasas

unread,
Jun 30, 2026, 10:45:24 AMJun 30
to Jorge Eduardo Silva Jackson, Wazuh | Mailing List
JOrge,

So, centralized configuration is enable at the moment that it is installed?  I dont understand.. the doc https://documentation.wazuh.com/current/user-manual/reference/centralized-configuration.html show that local_internal_options.conf need to be configured with wazuh_command.remote_commands=1. You say that is not needed?

Regards

German

--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/62rErvVyi4Q/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/d46674de-7b56-4bfe-8220-222b1dab9e91n%40googlegroups.com.

Jorge Eduardo Silva Jackson

unread,
Jul 6, 2026, 6:48:15 PM (13 days ago) Jul 6
to Wazuh | Mailing List

Hi German,

Good question. Let me clarify that point.

Centralized configuration itself does not require wazuh_command.remote_commands=1 for all settings. Once the agent is installed, enrolled, connected to the manager, and assigned to the proper group, it can receive the shared agent.conf configuration for the supported sections.

However, the wazuh_command.remote_commands=1 setting is specifically required when you want to configure remote command execution through centralized configuration, for example using:

<wodle name="command"> ... </wodle>

This is disabled by default for security reasons. In that specific case, the option must be enabled locally on the agent in:

C:\Program Files (x86)\ossec-agent\local_internal_options.conf

Then the Wazuh agent service must be restarted.

So, to summarize:

  • For normal centralized configuration, such as FIM/syscheck, localfile/log collection, SCA, syscollector, labels, rootcheck, or client_buffer, you do not need to enable wazuh_command.remote_commands=1.

  • For centralized command monitoring using <wodle name="command">, you do need to enable wazuh_command.remote_commands=1 locally on the agent.

If you need a fully automated deployment with GPO and remote commands enabled, you can deploy the agent with the GPO and also push/update the local_internal_options.conf file through GPO or another endpoint management tool before restarting the Wazuh agent service.

References:

Reply all
Reply to author
Forward
0 new messages