GPO Agent install

20 views
Skip to first unread message

German DiCasas

unread,
Jun 22, 2026, 6:08:29 PM (5 days ago) Jun 22
to Wazuh | Mailing List
Hi Team,

I did a GPO to install the agent as documented over Deploying Wazuh agents using Windows Group Policy Objects (GPO) | Wazuh

But, It is posible to edit it with centralized configuration too (https://documentation.wazuh.com/current/user-manual/reference/centralized-configuration.html) ? I mean, install over GPO with centralized configuration.

Thanks

German

Jorge Eduardo Silva Jackson

unread,
Jun 22, 2026, 6:28:11 PM (5 days ago) Jun 22
to Wazuh | Mailing List
Hi German, let me see..

Jorge Eduardo Silva Jackson

unread,
Jun 22, 2026, 6:48:58 PM (5 days ago) Jun 22
to Wazuh | Mailing List

Yes, you can use both approaches together.

The GPO deployment method can be used to install and enroll the Wazuh agent on Windows endpoints. After the agent is installed, enrolled, and connected to the Wazuh manager, you can manage part of its configuration remotely using centralized configuration through the agent.conf file.

A common approach would be:

  1. Deploy the Windows agent using GPO, including the required deployment variables, such as WAZUH_MANAGER and WAZUH_REGISTRATION_SERVER. You can also use the WAZUH_AGENT_GROUP variable to automatically assign the agent to a specific group during installation.

  2. Ensure that the group already exists on the Wazuh manager before deploying the agents. If a non-existent group is specified during enrollment, the enrollment process will fail.

  3. Configure the shared agent.conf file for that group on the Wazuh manager.

  4. Once the agent is installed, enrolled, and assigned to the group, it will receive the centralized configuration from the manager.

Please note that centralized configuration is not used to install the agent itself. It is used to manage supported agent settings after the agent is already enrolled. Also, not every local ossec.conf option can be managed centrally, so you should check whether the module or setting you want to configure is supported in agent.conf.

For example, centralized configuration can be used for modules such as FIM/syscheck, log collection/localfile, SCA, syscollector, labels, rootcheck, command monitoring, and client buffer settings.

With this approach, the deployment can be fully automated: the agent is installed through GPO, assigned to the proper group during installation, and then receives the corresponding centralized configuration from the manager.

References:

Reply all
Reply to author
Forward
0 new messages