Deploying Wazuh Agents Using Windows Group Policy Objects (GPO)#

1
$computers = Get-ADComputer -Filter * -SearchBase "OU=Wazuh,DC=wazuhtests,DC=com"
2

3
foreach ($computer in $computers) {
4
    $result = Test-Connection -ComputerName $computer.Name -Count 1 -Quiet
5
    if ($result) {
6
        $service = Get-Service -Name "WazuhSvc" -ComputerName $computer.Name -ErrorAction SilentlyContinue
7
        if ($service) {
8
            Write-Host "$($computer.Name): Wazuh installed - Status: $($service.Status)" -ForegroundColor Green
9
        } else {
10
            Write-Host "$($computer.Name): Wazuh not installed" -ForegroundColor Red
11
        }
12
    } else {
13
        Write-Host "$($computer.Name): Offline" -ForegroundColor Yellow
14
    }
15
}

1
param(
2
    [string]$WazuhServer = "192.168.1.100",
3
    [string]$ExpectedVersion = "4.7.3"
4
)
5

6
function Test-WazuhDeployment {
7
    $results = @()
8

9
    # Check if Wazuh is installed
10
    $installed = Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*Wazuh*"}
11

12
    if ($installed) {
13
        $results += "✓ Wazuh installed: $($installed.Version)"
14

15
        # Check service status
16
        $service = Get-Service -Name "WazuhSvc" -ErrorAction SilentlyContinue
17
        if ($service) {
18
            $results += "✓ Wazuh service status: $($service.Status)"
19
        } else {
20
            $results += "✗ Wazuh service not found"
21
        }
22

23
        # Check configuration
24
        $configPath = "C:\Program Files (x86)\ossec-agent\ossec.conf"
25
        if (Test-Path $configPath) {
26
            $config = Get-Content $configPath
27
            if ($config -match $WazuhServer) {
28
                $results += "✓ Correct server configured: $WazuhServer"
29
            } else {
30
                $results += "✗ Incorrect server configuration"
31
            }
32
        }
33

34
        # Check connectivity
35
        if (Test-NetConnection -ComputerName $WazuhServer -Port 1514 -InformationLevel Quiet) {
36
            $results += "✓ Can reach Wazuh server"
37
        } else {
38
            $results += "✗ Cannot reach Wazuh server"
39
        }
40
    } else {
41
        $results += "✗ Wazuh not installed"
42
    }
43

44
    return $results
45
}
46

47
# Run validation
48
$validation = Test-WazuhDeployment
49
$validation | ForEach-Object { Write-Host $_ }