Windows Reporting Agent DocumentationWindows Reporting Agent
A small Windows service that sends a hardware, software, patch and Windows Defender inventory from every computer to your report server. Built for sites that need to know what is on their Windows computers but do not run SCCM/MCM, Intune or BigFix.
What it reports
Hardware
Computer name, service tag (the Dell service tag on Dell computers), asset tag, and the IPv4 addresses of the adapters that are up.
Software
Name and version of every installed program from the 64-bit and 32-bit uninstall registry keys.
Patches
The Windows Update installation history and the installed hotfixes.
Windows Defender
Critical, error and warning events from the Defender event log for the last 30 days.
Users
The profile folders in C:\Users, to see who has signed in to the computer.
Check-ins
A status page shows which computers reported in the last day, in the last 15 days, or not at all.
How it works
The agent runs as the WindowsReportAgent service. Every 45 minutes it writes a plain text report and delivers it. On its first run it creates a key that cannot be exported and registers its certificate with the report server. After an admin approves the computer, or it sends the right enrollment token, every report it uploads is signed, and the server only accepts reports that are signed by the computer they claim to be from.
The report can also, or instead, be copied to a Windows file share or to an SSH server. The reports are plain text files, one per computer, which the fleet status page and the DataReel System Monitor read.
Who it is for
Enterprise suites do this and much more, but they need servers, licenses and staff. The agent covers the everyday questions with a 2.5 MB installer and a few PHP pages:
- Is every laptop that was handed out actually checking in?
- Which computers are missing a program, or still have one that should be gone?
- Which computers are behind on Windows updates?
- Has Windows Defender found anything this month?
- Which service tag belongs to which computer name?
It was first written to sort out a deployment of 120 laptops with inventory gaps, missing software and patching problems, before an enterprise suite was working.
Get started
1. Set up the report server
Copy the PHP pages to an Apache and PHP host with install_server.sh. Shared hosting works.
2. Install the agent
Run the setup on each computer, or deploy it silently with Group Policy, PDQ or a script.
3. Approve the computers
On the admin page, or automatically with an enrollment token.
Other documentation
These pages cover the same ground as the files that ship with the agent:
README.md, the full install and configuration guidewindows_reporting_agent.ini, every agent setting with commentsphp/server.ini.example, every server setting with comments