Set up the report server

The server side is four PHP files and a data directory. install_server.sh puts them in place. Plan on about 15 minutes.

Requirements

Install the pages

The pages are in the php folder of the source package. The script only shows what it would do until you add --apply:

$ cd windows_reporting_agent/php
$ ./install_server.sh /var/www/html/windows_reporting_agent /var/lib/windows_reporting_agent
# ./install_server.sh --apply --admin-user admin \
      /var/www/html/windows_reporting_agent /var/lib/windows_reporting_agent

The script never overwrites an existing server.ini or admin.htpasswd, so it is safe to run again to update the pages. --admin-user creates the admin login and asks for its password.

Permissions

The web server user must be able to write to DATA_DIR:

# setfacl -R -m u:apache:rwX -m d:u:apache:rwX /var/lib/windows_reporting_agent

With SELinux enforcing (RHEL, Rocky, Alma, Fedora), also label it for writing:

# semanage fcontext -a -t httpd_sys_rw_content_t "/var/lib/windows_reporting_agent(/.*)?"
# restorecon -R /var/lib/windows_reporting_agent

On Debian and Ubuntu the web server user is www-data.

Apache

The generated upload/.htaccess does three things:

SetEnv WRA_SERVER_INI /var/lib/windows_reporting_agent/server.ini

<FilesMatch "^wra_(lib|page)\.php$">
    Require all denied
</FilesMatch>

<FilesMatch "^(admin|status|report)\.php$">
    AuthType Basic
    AuthName "Windows Reporting Agent admin"
    AuthUserFile /var/lib/windows_reporting_agent/admin.htpasswd
    Require valid-user
</FilesMatch>

If you do not allow .htaccess files, put the same lines in a <Directory> block in the Apache configuration. admin.php, status.php and report.php refuse to run if the web server has not logged the user in, unless you set require_remote_user = 0 in server.ini. Add or change admin logins with:

$ htpasswd -B /var/lib/windows_reporting_agent/admin.htpasswd admin

Enrollment token

Without a token, every new computer waits on the admin page until you approve it. To approve computers automatically, set a long random token in DATA_DIR/server.ini and give the same token to the setup:

$ openssl rand -hex 24

; DATA_DIR/server.ini
[registration]
enrollment_token = 6f1c...e9a2
auto_approve_with_token = 1

With auto_approve_with_token = 0 the token is still checked, but an admin approves each computer. A computer that sends a wrong token is refused. Change the token after a deployment if it may have been seen by others: computers already approved keep working.

Shared hosting

On a host such as HostGator where everything is under public_html, put DATA_DIR inside WEB_DIR. The script then adds an .htaccess with Require all denied to it so the reports, registrations and settings cannot be downloaded:

$ ./install_server.sh --apply --admin-user admin \
      ~/public_html/windows_reporting_agent ~/public_html/windows_reporting_agent/data

HTTPS

The agent uses the Windows certificate store to check the server, so the server needs a certificate from a public authority or from your own authority that is deployed to the computers. A self-signed server certificate fails with WinINet error 12175 or 12045. Plain HTTP works for a test server, but the inventory then crosses the network in clear text.