Windows

Agentless

Synopsis

Creates a device collector that connects to Windows servers via WinRM to deploy and run the VirtualMetric Agent. Supports local and Active Directory authentication.

note

To collect logs from arbitrary files on a Windows host (IIS logs, application logs, SQL Server error logs, etc.), see File Log Datasets. For host network activity (TCP and remote login sessions) and running scripts to collect their output, see Windows Datasets.

note

For cluster-aware Windows scenarios, the device type windows_cluster is also registered and delegates to the same deployment flow as windows. Use it when the GUI exposes a cluster-specific workflow; configuration semantics are otherwise identical to this page.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: windows
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    username: <string>
    password: <string>
    active_directory: <boolean>
    type: <string>
    timeout: <numeric>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
id	Y	-	Unique numeric identifier
name	Y	-	Device name
description	N	-	Optional description
type	Y	-	Must be windows
tags	N	-	Optional tags
pipelines	N	-	Optional pre-processor pipelines
status	N	true	Enable/disable the device

Connection

Field	Required	Default	Description
address	Y	-	Target server address
port	N	5985	WinRM port number (5985 for HTTP, 5986 for HTTPS)
username	N	-	WinRM username; for AD authentication use DOMAIN\\username or username@domain.local format (resolvable via ${ENV_VAR} or $secret{...})
password	N	-	WinRM password (resolvable via ${ENV_VAR} or $secret{...})
active_directory	N	false	When true, authenticates against Active Directory; when false, uses local Windows authentication
type	N	"agentless"	Deployment mode selector under properties: (distinct from the top-level type: windows field). Values: agent or agentless

Performance

Field	Required	Default	Description
timeout	N	60	WinRM connection timeout in seconds

Examples

Local Authentication

Connecting with local Windows credentials...

- id: 1 name: windows_server type: windows properties: address: "192.168.1.100" username: "Administrator" password: "secret"

Active Directory Authentication

Authenticating against AD with domain-qualified username...

- id: 2 name: domain_windows type: windows properties: address: "server1.domain.local" username: "DOMAIN\\monitor" password: "P@ssw0rd" active_directory: true timeout: 120

warning

The user account must have appropriate permissions to deploy the Agent and read the targeted log sources.

Custom Port (HTTPS)

Connecting over HTTPS WinRM (TLS-enabled listener)...

- id: 3 name: windows_https type: windows properties: address: "192.168.1.101" port: 5986 username: "Administrator" password: "secret"

note

When multiple Windows collectors are deployed, the server adds a random delay (up to 20 seconds) before initiating the collection to help prevent overwhelming the target server.