Windows Agent Installation

In this Topic

Tutorials

Background

Server Manager includes a Windows Agent to remotely manage Windows hosts. Our agent-based solution solves several security and performance issues with existing built-in technologies and security implementations. To understand the benefits, we must first understand the technologies used to remotely manage Windows hosts without an agent.

Agentless Management

Windows

Windows Event Logs are downloaded using remote WMI while Text Logs use either Windows Shares, SFTP/SSH or FTP/S to download logs. Most monitors, such as CPU, Memory and Disk Space use remote WMI to query information. Other monitors, such as Windows Certificates and Performance Counters, rely on other seemingly undocumented Microsoft APIs.

Security and Performance Concerns

• Attack Surface Reduction Rules do not permit remote WMI event subscriptions.
• In many hardened environments, monitoring and compliance services are not permitted to run as domain or local administrators.
• In many hardened environments, remote WMI and other Microsoft APIs are not permitted.
• Cloud-based servers cannot typically be managed by remote WMI.
• Windows blocks discovery and remote management of remote Windows Certificate Stores.
• WMI is needlessly slow when transmitting Event Log entries and often throws what seems are random errors on a random basis.
• WMI requires multiple ports, one of which is randomly assigned. The randomly assigned port can be configured to use a fixed port, however, the fixed port must be configured on each client host.
• In rare cases, WMI corrupts itself requiring the WMI service to be restarted or repaired.
• Hosts that periodically connect to the local network (e.g. Law Enforcement laptops), can be difficult to manage on a polling schedule. The polling schedule must be fast enough to catch each managed laptop when they just so happen to be logged into the local network often generating unnecessary traffic as well as a high number of errors in the meantime.

Agent-Based Management Benefits

• Both the Windows Management Service and the Windows Agent Service can be run using the built-in SYSTEM Account eliminating the requirement to run as a Domain Administrator.
• All data is transmitted over a single TLS 1.2/3 capable TCP/IP port using a highly efficient binary protocol stack that downloads Windows Event Logs 12 times faster than remote WMI.
• Windows Event Logs are efficiently accessed, parsed, and filtered directly on each managed host prior to transmitting the latest filtered entries to the Management Server.

System Requirements

The Windows Agent requires the .Microsoft .NET 8 Runtime to be installed, however, the air gapped installer embeds the .NET 8 Runtime within the installation bootstrapper, so there is no need to pre-install the .NET 8 Runtime.

How to Remotely Install the Windows Agent

To remotely install the agent, the Corner Bowl Server Manager Service must first be runnign as a Domain Administrator. The installer is uploaded to the remote host using Windows Shares then remotely executed using Remote WMI. If either of these technologies are not available, you must manually install the agent.

• Add the hostname or IP add to Corner Bowl Server Manager. For more information see: Adding Hosts.
• Once added, from the Host Properties View, select the Agent Tab, then click the Install Agent button.
  Or
  assign an Agent-Based Template to either the host's parent host group or directly to the host. Once assigned, by default, the Agent Server automaitcally installs the agent on the target host. For more information see: Agent-Based Management

How to Manually Install the Windows Agent

• From the Management Server, copy the agent installer, ServerManagerAgentDotNetInstaller.exe, to the target host. The file is located in the following path:

C:\Program Files\Corner Bowl\Server Manager\Agent Installers\Windows\ServerManagerAgentDotNetInstaller.exe

• From the target host, open a command prompt as Administrator then run the executable with the following command-line options:

For Example:

ServerManagerAgentDotNetInstaller.exe -q HOST=1.2.3.4 PORT=21843

How to Update the Windows Agent

Once installed, the agent uses the Corner Bowl TCP/IP connection to the server to download both major and minor updates, then automatically installs the downloaded version.

How to Configure the Agent

Once installed, if you need to change the destination hostname or would like to enable TLS 1.2/3, you must modify the agent's configuration file.

The agent's configuration file is located in the following path:

C:\ProgramData\Corner Bowl\Server Manager Agent\tcpserver.json

Configuration File Reference

{
    "Host": "SERVERNAME", 
    "Port": 21843, 
    "IdleTimeout": 300, 
    "ReceiveTimeout": 120, 
    "SendTimeout": 120, 
    "TempDirectory": "d:\temp", 
    "TlsConfiguration": {
      "Enabled": true, 
      "Certificate": null, 
      "RequireRemoteCertificate": false, 
      "AllowSelfSignedCertificate": true, 
      "CheckCertificateRevocation": false, 
      "AllowCertificateChainErrors": true 
    }
}

For more information see: Agent Configuration

How to Configure Templates to Run on the Agent

• Select File | New Template. The Select Template Type view displays.
• Click the Template type to create. The Template Properties view displays.
• Select the Agent Template Tab
• Use the Enabled Check Box to flag the template as an Agent-Based Template.
• Use the Trigger Check Box to trigger actions when assigned hosts do not connect within the configured time span.
• Use the On Host Not Connecting Drop-Down to assign the actions to fire when assigned hosts do not connect within the configured time span.

Troubleshooting

If the Agent does not appear to be connecting or processing templates as expected, you can view the agent's verbose output log for detailed information. The agent's log file is located in the following path:

C:\ProgramData\Corner Bowl\Server Manager Agent\agent.log

To View Agent's' Verbose Output and Errors

• Open a text editor as an Administrator, then open the file. To view the most recent entries, scroll to the bottom of the file.
• If your agent is unable to connect or remain connected, re-open the file after at least 2 minutes. Typically one of the following error scenarios will be present:
  • There is a connection error due to the tcpserver.json file not specifying the correct host, or other invalid parameter.
  • A firewall is blocking the default port, 21843, outbound or inbound on the Corner Bowl Server Manager Server host.
  • The host has been added using the localhost name, the Agent Server is configured to use DNS or FQDN lookup and is not configured to add new hosts. The server correctly responds by disconnecting the client.
  All of these error scenarios are easily identified when tailing the agent.log file.

Related Topics

Adding Hosts

Agent-Based Management

Installation

Server Configuration