Wazuh windows agents with same hostname

[SP_11]

Hi

I have installed wazuh windows agents in 2 different windows servers, but both the agents shows the same hostname. Due to this I am facing some issues where neither of the agents works correctly instead they keep getting registered over and over again.

Does anyone know how to fix this? 

I thought of changing the agent name of one windows agent, can anyone help me with this!

Thank you very much

[Henadence Anyam]

Hello Shenal,

Thank you for using Wazuh.

There is no functionality as such that allows you to change the name of an already registered agent, but the following workarounds can be done to achieve this:

• Delete the agent and register it again with a new name (inconvenience: wazuh-agent has a new ID)

First, we stop the wazuh-agent we want to rename:

NET STOP WazuhSvc

Next, we remove the wazuh-agent from the wazuh-manager. For this we can use for example the CLI tool /var/ossec/bin/manage_agents of the wazuh-manager. More info about removing agents can be found here.

Note: That you would lose the history of the alerts up to the time of the name change when performing certain searches.

Once deleted, we have to register the agent with the new name.
We can do this in two different ways:

• By adding an <enrollment> option in C:\Program Files (x86)\ossec-agent\ossec.conf  configuration file.

The following configuration block must be added to the C:\Program Files (x86)\ossec-agent\ossec.conf file of the wazuh-agent (more information here):
<enrollment>
    <agent_name>YOUR_NEW_AGENT_NAME</agent_name>
</enrollment>

Then start the wazuh-agent and wait a few seconds until the wazuh-agent requests a new key and registers with the new name but with a different ID.

• Registering manually with the agent-auth tool.

In the wazuh-agent, we can execute the command (more info at https://documentation.wazuh.com/current/user-manual/reference/tools/agent-auth.html):
C:\Program Files (x86)\ossec-agent\bin\agent-auth -m <WAZUH-MANAGER-IP> -A <YOUR_NEW_AGENT_NAME>
and then start the wazuh-agent:

NET START WazuhSvc

After following the steps and restarting the wazuh-agent, the wazuh-agent name is updated.

I hope this information is helpful.

[SP_11]

Great, I will try this out. Thank you for the information