Install Collector - Windows

1. Download the Installer and Collector Config

Sign in to your ConfigSentry account and go to Appliances → Collectors. Download the Windows collector installer and the Collector Config JSON for the collector you are installing. Keep the JSON file available for setup.

For a new installation, the installer and the Collector Config JSON are both required. The JSON identifies and configures the collector instance.

2. Run the Installer

Run the downloaded Windows installer and select the Collector Config JSON when prompted. Follow the installer prompts to complete setup.

The installer will:

• Create the collector instance from the supplied Collector Config JSON.
• Install the shared machine runtime used by ConfigSentry collectors on that Windows machine.
• Create and start this collector's Windows Service.

Administrator approval (UAC) is required because the installer creates a machine service. After installation, the collector starts automatically and begins communicating with ConfigSentry.

3. Multiple Collectors on One Windows Machine

Windows collectors share one machine-wide ConfigSentry runtime. Each collector has its own identity, configuration, logs, state, and Windows Service, so adding or restarting one collector does not require stopping the others.

To add another collector, obtain that collector's own Collector Config JSON and run the installer again. Do not create a separate runtime copy for each collector.

By default, the shared runtime and collector instances are stored beneath C:\ProgramData\Secdit\ConfigSentry. If an installer location is selected, the shared runtime and all collector instance paths derive from that selected location.

4. Manage the Collector After Install

Each collector runs as one Windows Service, configured for automatic (delayed) startup. Its per-home base process supervises the native worker and syslog processes independently of other collector homes.

Common first tasks are:

• Confirm the collector has checked in to the ConfigSentry dashboard.
• Provide any locally managed values required by the collector or appliance configuration.
• Use Services or the management application for normal background operation.

For syslog configuration and operational guidance, see Collector Management.

4. Enter Local Settings

If your collector or appliance uses values that should not be stored on the website, use the installed ConfigSentry collector management application to configure the collector locally.

Typical examples include appliance hostnames, usernames, passwords, or other fields configured as Enter Locally in the collector setup.

A simple first-run workflow is:

• Open Configure ConfigSentry Collectors from the Start menu.
• Select the collector and choose Configure....
• Review the local syslog listener settings and save any change.
• Confirm the collector checks in to the ConfigSentry dashboard after it starts.

The Windows management application is native. It does not require PHP or a script launcher.

4a. Security Notes for Reviewers

• Use the lowest practical privilege that still allows full configuration retrieval.
• Locally entered collector secrets are intended to remain on the collector host rather than being stored as website-managed secret values.
• Website communication is designed around outbound HTTPS from the collector host. If syslog-triggered collection is enabled, separate inbound syslog traffic to the collector host is also part of that workflow.
• If your review needs current package-trust, update, or deployment-architecture details, contact secdit directly.

5. Verify the Installation

After installation, confirm the collector is healthy from the ConfigSentry dashboard and Windows Services.

• Open Configure ConfigSentry Collectors from the Start menu and confirm the collector is listed.
• In Services, confirm the collector's ConfigSentry Collector … service is running and set to automatic startup.
• Review appliance-level status and any errors in the ConfigSentry dashboard.
• Run a collection and confirm the audit appears in the ConfigSentry dashboard.

If the service or dashboard reports a warning, resolve it before relying on scheduled collection.

6. Windows Firewall (Syslog)

If you have enabled syslog-triggered collection, allow the collector syslog listener port through Windows Firewall. By default the listener uses UDP port 2216. You may create a manual Windows Defender Firewall rule, or an equivalent third-party firewall rule, limited to that UDP port, the required profile/interface, and (where supported) the expected FortiGate source address. A Windows Firewall listener prompt concerns inbound network access; it is separate from SmartScreen, which concerns executable reputation/code-signing. Do not accept a broad firewall rule solely to dismiss a prompt.

7. Unsigned Trial Installer

The current trial installer is unsigned. Windows may show an Unknown Publisher or SmartScreen warning. Review the download source and your organisation's software policy before proceeding; do not disable Windows security controls to install it.

8. Updating the Collector

There are two supported runtime update paths:

• Automatic update - the collector validates and downloads an available update, then updates the shared runtime once for the machine and restarts the affected collector instances.
• Manual update - download the newer Windows collector MSI and run it over the existing installation.

A normal update of a current shared-runtime installation does not require another Collector Config JSON. It preserves existing collector instances, configuration, identity, logs, and state while updating the shared native runtime once. Windows collector runtime updates are EXE-only and do not require PHP.

Legacy installations are different: an incompatible older collector layout cannot be migrated automatically. Retain or download the required Collector Config JSON, uninstall the old collector, then perform a fresh installation with the current installer.

9. Uninstalling

Use the Windows installed-apps/uninstall entry to remove a collector installation. Before uninstalling a legacy collector, retain or download the Collector Config JSON required for the fresh installation that follows.

Do not remove shared-runtime folders manually while any ConfigSentry collectors remain on the machine. Customer-created Windows Firewall or third-party firewall rules are not automatically removed.