Configuration

The agent reads windows_reporting_agent.ini next to windows_reporting_agent_svc.exe before every report, so changes take effect on the next cycle without a restart. Any setting left out uses its default.

Agent settings

File share delivery

[delivery]
methods=cifs

[cifs]
share=\\fileserver\reports

The service runs as LocalSystem, so on a domain it connects as the computer account (DOMAIN\HOSTNAME$). Give the computer accounts, or the Domain Computers group, write access to the share and folder. The report is written under a temporary name and renamed, so a reader never sees a partial file. File share and SCP deliveries do not use the certificate registration: the share permissions or the SSH key control access.

SCP delivery

Create a key with no passphrase for the agent, add the public key to the SSH account's authorized_keys, and limit the private key to SYSTEM and Administrators:

ssh-keygen -t ed25519 -N "" -f C:\ProgramData\WindowsReportAgent\id_ed25519
icacls C:\ProgramData\WindowsReportAgent\id_ed25519 /inheritance:r /grant SYSTEM:F /grant Administrators:F
ssh-keyscan reports.example.com > C:\ProgramData\WindowsReportAgent\known_hosts

[delivery]
methods=https,scp

[scp]
host=reports.example.com
user=winreports
remote_dir=/var/lib/windows_reporting_agent/reports

Server settings

server.ini is found through the WRA_SERVER_INI variable that install_server.sh sets in .htaccess, or at /etc/windows_reporting_agent/server.ini. Keep it out of the web root: it holds the enrollment token.