How can I have a Windows agent join a new Wazuh server without reintsallation?

[Joseph Keegan]

Hello all,

I recently installed the Wazuh VM appliance and thought it was great !  I registered a handful of Windows devices and thought it was good enough to spin up its own box.  I installed on Ubuntu 20 LTS with the Quickstart script.  All going well.

How can I register the existing Windows nodes to the new Wazuh server?  I still have access to the old and the new server, and have full access to the Windows agents.  I'm sure that an uninstall / reinstall will work, but I'd rather know how to re-point since we will likely have DEV and PROD simultaneously.

Thanks!

[Héctor Gómez]

Hello, @joseph
Thank you for using wazuh.
Yes, as you mentioned, you can uninstall the agent in your windows environment, and from the dashboard generate the strip of code for the new environment, with the corresponding parameters so that this time it connects to the new server.

You can also try modifying your C:\Program Files (x86)\ossec-agent\ossec.conf file

Changing the server address and manager address parameters and in case you have security the enroll password

https://documentation.wazuh.com/current/user-manual/agent-enrollment/security-options/using-password-authentication.html

If I solved your doubt let me know. greetings

[Joseph Keegan]

This did work, thanks!

Is there a command that will enroll an agent to a new server as well without modifying the config file?  Something that I can issue with a command line management tool?

Thanks again.  

[Héctor Gómez]

Greetings, you can use a batch, first with the command to uninstall the agent
https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-windows.html#uninstall-a-wazuh-agent

Then you can continue again with the installation and your new parameters.
https://documentation.wazuh.com/current/user-manual/deployment-variables/deployment-variables-windows.html

All this through the cli with powershell.

If you want to keep custom settings on agents, you can use centralized settings, organizing agents by groups.
https://wazuh.com/blog/agent-groups-and-centralized-configuration/