Windows

Agentless

Synopsis

Creates a device collector that connects to Windows servers via WinRM to deploy and run the VirtualMetric Agent. Supports local and Active Directory authentication.

note

To collect logs from arbitrary files on a Windows host (IIS logs, application logs, SQL Server error logs, etc.), see File Log Datasets. For host network activity (TCP and remote login sessions) and running scripts to collect their output, see Windows Datasets.

note

For Windows failover clusters, the device type windows_cluster is also registered. It delegates to the same deployment flow as windows and takes the same properties, so this page describes it in full. Set type: windows_cluster instead of type: windows when the host is a cluster member.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: windows
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    ssl: <boolean>
    insecure_skip_verify: <boolean>
    winrm_auth: <enum>
    username: <string>
    password: <string>
    active_directory: <boolean>
    type: <string>
    timeout: <numeric>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
id	Y	-	Unique numeric identifier
name	Y	-	Device name
description	N	-	Optional description
type	Y	-	Must be windows
tags	N	-	Optional tags
pipelines	N	-	Optional pre-processor pipelines
status	N	true	Enable/disable the device

Connection

Field	Required	Default	Description
address	Y	-	Target server address
port	N	5985	WinRM port number. When ssl is true and no port is pinned, the port is derived as 5986; an explicit value always wins
ssl	N	false	Enables WinRM over TLS. Without this the session runs plain HTTP even on port 5986 — setting the port alone does not enable TLS. Basic authentication requires it
insecure_skip_verify	N	false	Skips verification of the WinRM listener certificate. Covers the common self-signed listener cert; do not use where the certificate can be trusted properly
winrm_auth	N	-	Pins the authentication method: basic, ntlm (or negotiate), kerberos, or machine (or ad) for the Director machine's own domain identity. Matched case-insensitively. Unset selects automatically — NTLM for credentialed devices; Basic only when ssl is on and the certificate is verified. An unrecognized value is ignored with a warning and falls back to automatic selection
username	N	-	WinRM username; for AD authentication use DOMAIN\\username or username@domain.local format (resolvable via ${ENV_VAR} or $secret{...})
password	N	-	WinRM password (resolvable via ${ENV_VAR} or $secret{...})
active_directory	N	false	When true, authenticates against Active Directory; when false, uses local Windows authentication
type	N	"agentless"	Deployment mode selector under properties: (distinct from the top-level type: windows field). Values: agent or agentless

Performance

Field	Required	Default	Description
timeout	N	60	WinRM connection timeout in seconds

Examples

Local Authentication

Connecting with local Windows credentials...

- id: 1 name: windows_server type: windows properties: address: "192.168.1.100" username: "Administrator" password: "secret"

Active Directory Authentication

Authenticating against AD with domain-qualified username...

- id: 2 name: domain_windows type: windows properties: address: "server1.domain.local" username: "DOMAIN\\monitor" password: "P@ssw0rd" active_directory: true timeout: 120

warning

The user account must have appropriate permissions to deploy the Agent and read the targeted log sources.

Custom Port (HTTPS)

Connecting over HTTPS WinRM (TLS-enabled listener)...

- id: 3 name: windows_https type: windows properties: address: "192.168.1.101" ssl: true username: "Administrator" password: "secret"

note

When multiple Windows collectors are deployed, the server adds a random delay (up to 20 seconds) before initiating the collection to help prevent overwhelming the target server.