Windows Reporting Agent DocumentationReports and status page
Each computer's report is a plain text file, easy to read, grep and diff. The server keeps the latest one per computer.
Report format
Reports are saved as <hostname>_windows_report_agent.txt in reports_dir. The header lines are KEY: value pairs, and each section starts with its name and a colon and ends with END and the name:
Windows report agent from host pc-0142
VERSION: 3.2
HOSTNAME: pc-0142
ETIME: 1792971236
DATETIME: Sun Oct 25 19:33:56 2026
SERVICE TAG AND BARCODE:
...
END SERVICE TAG AND BARCODE
INSTALLED WINDOWS PATCHES:
Date: 2026-10-14
Patch: 2026-10 Cumulative Update for Windows 11 Version 25H2 for x64-based Systems
...
END INSTALLED WINDOWS PATCHESETIME is the report time in seconds since 1970 (UTC), for check-in age calculations.
Sections
| Section | Contents |
|---|---|
| SERVICE TAG AND BARCODE | Service tag (BIOS serial number, the Dell service tag on Dell computers) and asset tag from WMI |
| IP ADDRESS | IPv4 addresses of the network adapters that are up |
| USERS | Profile folders in users_dir |
| ALL INSTALLED PROGRAMS | Name and version of every program in the 64-bit and 32-bit uninstall registry keys |
| WINDOWS DEFENDER ALERTS | Critical, error and warning events from the Defender event log for event_lookback_days |
| INSTALLED WINDOWS PATCHES | Windows Update installation history |
| HOT FIXES | Installed hotfixes from WMI (Win32_QuickFixEngineering) |
Fleet status page
status.php in the upload pages folder lists every computer with its state, worst first. See it on the live demo.
| State | When |
|---|---|
| Needs attention | No report for missing_days, an empty or bad report, or a Windows Defender detection, failed action or disabled protection |
| Warning | A late report, Windows updates older than patch_max_age_days, a missing required program or an unwanted program |
| OK | None of the above |
The tiles at the top filter the list, the column headers sort it, and the search box matches computer names, users, service tags, IP addresses and problems. report.php?host=<name> shows one computer: its problems, hardware, users, Defender events, installed programs with a filter, Windows updates, hotfixes and the report file. Both pages are read only and need the admin login. Set the rules in server.ini:
[status]
required_apps = "Microsoft 365 Apps*, Google Chrome"
required_apps_skip_hosts = "srv-*"
unwanted_apps = "uTorrent*, CCleaner*"Live demo and sample fleet
tools/gen_sample_fleet.py writes reports for a made up fleet that covers every state: current, late and missing check-ins, empty and bad reports, computers behind on updates, missing and unwanted programs and Defender detections. php/install_demo.sh installs the status pages in a folder of their own with such a fleet and no login, which is how the live demo runs:
$ php/install_demo.sh --apply /var/www/html/windows_reporting_agent/demoStatus page script
bash/run_windows_laptop_inventory.sh is the original status page. It reads the reports and builds an HTML and a text page that list every computer by check-in state (reported in the last 24 hours, in the last 15 days, not for more than 15 days, or an empty or unreadable report) with pass and fail lists. It uses the DRSM configuration (~/.drsm.sh or $BASEdir/etc/drsm.sh) and runs from cron. Set SYSLOG_DIR at the top of the script to your reports_dir.
# crontab: update the status page every 30 minutes
*/30 * * * * $HOME/windows_reporting_agent/bash/run_windows_laptop_inventory.sh > /dev/null 2>&1DRSM
The DataReel System Monitor is getting a Windows plugin that reads these reports, so Windows computers show up on the DRSM dashboard next to the Linux hosts. See the DRSM documentation when it is released.