Windows

Windows reads WMI values over WinRM HTTPS, usually on port 5986. The check requires an account with appropriate read permissions and no installed monitoring software on the Windows target.

  1. Add an additional Windows check.

  2. Expand Prepare Windows access once.

  3. Download Windows-Einrichtung.ps1.

  4. Copy the script to the target server and run it there in Windows PowerShell as an administrator. The account to be used must already exist:

.\Windows-Einrichtung.ps1 -MonitorAddress "IP-DES-MONITORING-SERVERS" -UserName "RECHNER\monitoring"

  1. In the check, enter Destination address, Port, User with read access and Password.

  2. Compare and confirm the certificate as described in the certificate trust section.

  3. Select the required Windows areas, run Test connection and click Save all.

The script configures HTTPS, restricted firewall access and read permissions, and displays the certificate fingerprint. The monitoring account is not intended to have administrator rights during regular check operation.

Field/selection

Meaning

CPU, memory and local drives

Basic measurements for CPU, RAM and local drives

Windows services that should be running

Internal service name per line, for example Spooler; a missing or stopped service becomes critical

Error events from System and Application

Enables event evaluation

Events in the last … minutes

1 to 1.440 minutes, default 15

Thresholds in percent

CPU, memory and storage usage; default warning at 80 % and critical at 95 % for each

Windows performance checks → Disk performance and latency

Additional WMI performance values for disks

Network performance

Additional network counters

Process performance

Enables process performance values

Process names (blank = all)

Filter for process performance values

Additional WMI performance counters

WMI class and property, for example Win32_PerfFormattedData_PerfOS_Processor.PercentProcessorTime

Event filters → Protocols

Log names per line, default System and Application

Event IDs (optional)

Event IDs per line

Event source (optional)

Optional source filter

Text to match

Text filter for events

Without event IDs, error events are evaluated. With specified IDs, the selected events are read regardless of severity. The filters only take effect when event evaluation is enabled. WMI areas that cannot be read appear as missing readings with a corresponding note.