The Windows agent

The Windows agent watches the machine itself: its processor, memory and disks, what runs on it, and what it writes to the event log. It runs on Windows Server 2016 and later, and on Windows 10 and 11. Like the Linux agent, it only makes outbound calls to your install, and nothing listens on the machine.

Install it

Open Launchpad → Install → Host and copy the command from the Windows box. Paste both lines into an elevated PowerShell or Command Prompt. The text is written so that the same two lines work in either shell:

powershell -NoProfile -Command "…Invoke-WebRequest https://your-install/agent/win-install.ps1 -OutFile C:\ProgramData\obscenter-install.ps1 -UseBasicParsing"
powershell -NoProfile -ExecutionPolicy Bypass -File C:\ProgramData\obscenter-install.ps1 -Key agt_… -Url https://your-install

There are two lines because downloading a script and running it in memory is the shape of a dropper. Microsoft Defender's machine-learning detection removes it as one. Written to disk first and run from disk, the installer is what every deployment tool does. It also leaves you a file you can read before you run it. The first line also switches on TLS 1.2, which older Windows Server versions do not use by default.

The installer takes -Key and -Url, and optionally -InstallDir, which defaults to %ProgramFiles%\Obscenter Agent. If the machine has no Node.js, it brings its own, from your install.

A real Windows service

It registers a service called Obscenter Agent (ObscenterAgent), which appears in services.msc. The service starts automatically and runs as LocalSystem, which is needed to read the Security log. It is stopped and started like anything else on the machine.

The service exists to restart the agent whenever it exits, which the agent does on purpose when your install serves a newer version. Windows' own recovery settings restart the service if it fails. The small service host is C# source that your install serves. It is compiled on your machine by the compiler that ships with Windows, so the installer still fetches binaries from nowhere but your install. The key is kept in a configuration file beside the agent, never on a command line. Earlier versions used a scheduled task, and installing over such a machine removes it.

What it measures

It samples every 15 seconds and reports once a minute, like the Linux agent.

• The machine: processor, memory, pagefile and every fixed disk, network and disk counters, and what the machine is: build, architecture, processor model and virtualisation.
• What runs on it: every process, with processor time as a rate and its working set, and every running service, as an inventory of what the machine is for. Nothing is read from inside any of them.
• The event log: the channels you ask for, per machine. Levels become severities, so the lines read beside every other log in the product. Nothing is collected until you name a channel.
• Logons: failed and successful logons from the Security log, including RDP. See Windows logons.

There is no load average, because Windows does not have one. It is shown as absent, not as zero.

The Windows agent covers infrastructure only. It instruments no code, injects no tag and opens no console. To trace a Node.js service on Windows, send its spans through OpenTelemetry.

Updates

Every report is answered with the agent version your install serves. A Windows agent running something else updates itself and exits, and the service starts the new one. Nothing needs to be done on the machine.

Look at it, stop it, remove it

Get-Service ObscenterAgent           # look at it
Stop-Service ObscenterAgent          # stop it
sc.exe delete ObscenterAgent         # remove it, then delete %ProgramFiles%\Obscenter Agent

Measurements already sent stay on the dashboard. To drop them, remove the host on its settings page.

Did it work

The machine appears under Backend → Hosts within a minute, with the same tile as a Linux machine, minus the load average. The keys work as they do on Linux. See Agent keys and install links.