Step 1: Configure the Wazuh Manager for Auto-Enrollment

Before agents can automatically register, the Wazuh manager must be configured to accept enrollment requests.

This involves enabling the authentication service, defining enrollment policies, and verifying that the required services are running correctly.

Properly configuring the manager first prevents many common enrollment failures later in the deployment process.

Enable the Authentication Service

The Wazuh Authentication Daemon (wazuh-authd) is responsible for processing agent enrollment requests and generating unique authentication keys.

If the service is disabled, agents cannot register automatically.

Depending on your deployment, you may need to:

• Enable the authentication daemon.
• Configure it to start automatically during boot.
• Verify it is listening for enrollment requests.
• Confirm it uses the expected authentication method.

The Wazuh documentation recommends using the authentication daemon for automated deployments because it centralizes agent registration and enforces enrollment policies.

Configure Authentication Settings

The authentication daemon supports several security settings that control how new agents are enrolled.

Common configuration options include:

• Password authentication
• SSL/TLS encryption
• Allowed enrollment methods
• Agent name validation
• Duplicate agent handling
• Connection timeout values

Choose settings that align with your organization’s security requirements while balancing ease of deployment.

Set Enrollment Password (Optional)

Although optional, many organizations protect the enrollment process with a shared enrollment password.

Using a password helps ensure that only authorized endpoints can request registration.

Best practices include:

• Use a strong, randomly generated password.
• Avoid storing passwords in plaintext deployment scripts.
• Rotate enrollment passwords periodically.
• Use a secure secrets management solution whenever possible.

For highly regulated environments, certificate-based authentication may provide stronger security than shared passwords.

Configure Allowed Networks

Restricting which IP addresses can request enrollment reduces the attack surface of the authentication service.

Many organizations limit enrollment to:

• Internal corporate networks
• VPN address ranges
• Private cloud networks
• Branch office subnets
• Trusted management VLANs

Restricting enrollment traffic helps prevent unauthorized devices from attempting registration.

Restart the Manager Services

After modifying enrollment settings, restart the affected Wazuh services so the new configuration takes effect.

Depending on the changes made, this may include restarting:

• Wazuh Manager
• Authentication daemon
• Supporting services

Always verify that services restart successfully before attempting to enroll new agents.

Verify the Authentication Service Is Running

Before deploying agents, confirm that the authentication service is operational.

Typical verification steps include:

• Confirm the service is running.
• Verify it is listening on the expected network interface.
• Check for startup errors.
• Review recent manager logs.
• Test connectivity from another system.

Completing these checks beforehand helps identify configuration issues before they affect large-scale deployments.

Related Guide: Wazuh Agent Not Connecting to Manager? 12 Proven Fixes

Step 2: Install the Wazuh Agent

Once the manager is ready to accept enrollment requests, the next step is installing the Wazuh agent on each endpoint.

Although the installation process differs between operating systems, the overall workflow remains the same:

1. Install the agent.
2. Configure enrollment settings.
3. Start the service.
4. Allow automatic registration.

Installing on Windows

Windows agents can be deployed using several methods, including:

• Interactive installer
• MSI packages
• Microsoft SCCM
• Microsoft Intune
• Group Policy
• PowerShell scripts

Enterprise environments commonly perform silent installations so new workstations and servers automatically enroll without user interaction.

Related Guide: How to Install a Wazuh Agent on Windows Server

Installing on Linux

Linux installations are typically performed using the native package manager for the distribution.

Organizations often automate installation through:

• Ansible
• Bash scripts
• cloud-init
• Puppet
• Chef
• Terraform

Linux servers created from templates can automatically install and enroll the Wazuh agent during provisioning.

Installing on macOS

macOS endpoints can be deployed using:

• Jamf Pro
• Apple Business Manager
• Mobile Device Management (MDM)
• Shell scripts
• Enterprise deployment tools

These deployment methods work well with auto-enrollment to onboard managed Apple devices with minimal administrator involvement.

Verifying Installation

Before configuring enrollment, verify that the agent installation completed successfully.

Recommended checks include:

• Confirm the Wazuh agent service is installed.
• Verify the service starts correctly.
• Ensure configuration files exist.
• Check for installation errors.
• Review the initial agent logs.

Validating the installation first helps isolate whether future issues stem from installation or enrollment.

Step 3: Configure Agent Auto-Enrollment

After installing the agent, configure it so it knows how to locate and authenticate with the Wazuh manager.

Most enrollment settings are defined in the agent configuration file or supplied during automated installation.

Specify the Manager Address

Every agent must know the address of the Wazuh manager.

Organizations typically configure:

• Fully Qualified Domain Name (FQDN)
• Static IP address
• Internal load balancer
• High-availability virtual IP

Using DNS names instead of hardcoded IP addresses simplifies future infrastructure changes.

Configure the Enrollment Server

The agent must also know which enrollment service to contact during registration.

Verify that the enrollment configuration specifies:

• Correct server address
• Appropriate enrollment port
• Matching protocol
• Reachable network path

Any mismatch can prevent successful registration.

Configure Authentication Parameters

Authentication settings must match the configuration on the Wazuh manager.

These settings may include:

• Enrollment password
• TLS configuration
• Certificates
• Authentication mode
• Enrollment options

Consistency between manager and agent configurations is essential for successful enrollment.

Configure Agent Name

Each enrolled endpoint should have a meaningful and unique agent name.

Common naming conventions include:

• Hostname
• Server role
• Location
• Department
• Cloud instance identifier

Examples:

• WEB-APP-01
• DC-AD-02
• AWS-WEB-103
• HQ-LAPTOP-247

Consistent naming simplifies asset management and incident response.

Configure Agent Groups

Assigning an agent group during enrollment allows Wazuh to automatically apply predefined policies immediately after registration.

Common groups include:

• Windows Servers
• Linux Servers
• Workstations
• Domain Controllers
• Web Servers
• Kubernetes Nodes
• Cloud Instances

Group assignments reduce post-deployment configuration work.

Enable Automatic Registration

Finally, enable automatic registration so the agent initiates enrollment when its service starts.

Once enabled, the agent will:

1. Contact the enrollment server.
2. Authenticate.
3. Receive its unique key.
4. Register with the manager.
5. Begin secure communication.

At this point, no additional administrator interaction should be required.

Step 4: Start the Enrollment Process

With both the manager and the agent configured, you can begin the enrollment process.

When the agent starts, it attempts to establish trust with the Wazuh manager and obtain its permanent authentication credentials.

Launch the Agent

Start or restart the Wazuh agent service.

During startup, the agent will:

• Read its configuration.
• Contact the enrollment server.
• Authenticate.
• Request registration.
• Receive its unique agent key.

If enrollment succeeds, the agent immediately transitions into normal operation.

Verify Successful Registration

Successful enrollment should result in:

• A unique agent ID
• Generated authentication keys
• Successful manager connection
• Active communication
• No authentication errors in the logs

If registration fails, review both the manager and agent logs before attempting repeated enrollments.

Related Guide: Wazuh Agent Not Connecting to Manager? 12 Proven Fixes

Confirm Agent Appears in the Dashboard

After successful enrollment, the endpoint should appear in the Wazuh Dashboard.

Verify that:

• The agent is listed.
• Status is Active.
• Last keepalive updates regularly.
• Assigned group is correct.
• Endpoint information is accurate.

If the agent appears but remains disconnected, additional troubleshooting may be required.

Related Guide: Wazuh Dashboard Not Loading? Complete Troubleshooting Guide

Validate Secure Communication

Finally, confirm that communication between the agent and manager is functioning correctly.

Verify that:

• Security events are arriving.
• File Integrity Monitoring data is received.
• Vulnerability information is reported.
• Heartbeat messages continue.
• No TLS or authentication errors appear.

Secure communication confirms that enrollment completed successfully and the endpoint is actively participating in monitoring.

Step 5: Verify Auto-Enrollment

Completing the enrollment process is only part of the deployment.

You should also verify that the newly registered agent is functioning as expected and receiving the correct configuration from the manager.

A few simple validation steps can quickly confirm that auto-enrollment is working properly.

Check Agent Status

Begin by verifying the agent’s operational status.

Confirm that the endpoint is:

• Connected
• Active
• Communicating regularly
• Reporting recent keepalive messages
• Visible in the dashboard

Inactive or disconnected agents may indicate network, firewall, or authentication issues.

Verify Agent Keys

Every successfully enrolled endpoint should have its own unique authentication key.

Verify that:

• The key was generated.
• The key is associated with the correct agent.
• Duplicate identities do not exist.
• Authentication succeeds after service restarts.

Proper key generation confirms that the enrollment process completed successfully.

Confirm Policy Assignment

Next, ensure that the correct configuration policies have been applied.

Verify items such as:

• Assigned agent group
• File Integrity Monitoring policies
• Log collection configuration
• Active Response settings
• Vulnerability Detection configuration
• Security Configuration Assessment (SCA)

Incorrect policy assignments often indicate group configuration issues rather than enrollment failures.

Review Manager Logs

The manager logs provide detailed information about every enrollment request.

Look for messages related to:

• Authentication
• Key generation
• Agent registration
• Group assignment
• Connection establishment
• Configuration synchronization

Reviewing these logs is often the fastest way to diagnose failed enrollments.

Review Agent Logs

Finally, inspect the agent logs for any warnings or errors.

Pay particular attention to messages involving:

• Network connectivity
• DNS resolution
• Authentication failures
• Enrollment retries
• Certificate validation
• Manager communication

Reviewing both the manager and agent logs provides a complete picture of the enrollment process and helps identify issues before deploying auto-enrollment across a larger environment.

Automatically Assign Agents to Groups

Agent groups are one of Wazuh’s most powerful management features.

They allow administrators to automatically apply predefined configurations, policies, and monitoring rules to newly enrolled endpoints, eliminating the need to configure each agent individually after registration.

Using agent groups during auto-enrollment helps ensure consistency across your infrastructure while significantly reducing administrative effort.

Why Agent Groups Matter

As the number of monitored endpoints grows, managing each agent individually becomes increasingly difficult.

Agent groups simplify administration by allowing you to organize endpoints based on characteristics such as:

• Operating system
• Server role
• Department
• Geographic location
• Cloud provider
• Compliance requirements
• Development or production environment

Instead of maintaining hundreds or thousands of unique configurations, administrators can manage policies at the group level.

This approach improves scalability while reducing configuration drift.

Assigning Groups During Enrollment

Rather than manually moving agents into groups after registration, Wazuh allows group assignments to occur automatically during the enrollment process.

Depending on your deployment, group assignment may be based on:

• Installation parameters
• Enrollment configuration
• Automation scripts
• Provisioning templates
• Infrastructure management tools

Automatic assignment ensures that newly deployed systems immediately receive the correct security configuration without requiring additional administrator intervention.

Applying Different Security Policies

Different systems require different monitoring policies.

For example:

Assigning policies through groups ensures every endpoint receives only the monitoring configuration appropriate for its role.

Managing Large Fleets

Large organizations often manage thousands of endpoints distributed across multiple regions and business units.

Agent groups make these environments easier to manage by allowing administrators to:

• Deploy configuration changes centrally.
• Apply new monitoring policies once per group.
• Reduce repetitive administrative tasks.
• Standardize security configurations.
• Simplify compliance reporting.

Instead of updating thousands of individual agents, administrators only need to update the relevant group configuration.

Automating Wazuh Agent Auto-Enrollment at Scale

Auto-enrollment becomes even more valuable when combined with infrastructure automation.

Modern deployment tools can install the Wazuh agent, configure enrollment settings, assign groups, and register endpoints automatically as part of the provisioning process.

This approach allows organizations to deploy fully monitored systems with little or no manual intervention.

Using Ansible

Ansible is one of the most popular automation platforms for deploying Wazuh agents across Linux and Windows systems.

Typical Ansible workflows include:

• Installing the Wazuh agent
• Configuring enrollment settings
• Setting the manager address
• Assigning agent groups
• Starting the agent service

Because Ansible is agentless, it is particularly well suited for managing large server environments.

Related Guide: How to Automate Bulk Wazuh Agent Deployment with Ansible and SCCM

Using SCCM

Microsoft System Center Configuration Manager (SCCM) remains a common choice for enterprise Windows deployments.

Administrators can use SCCM to:

• Deploy MSI installers
• Perform silent installations
• Configure enrollment parameters
• Automatically register endpoints
• Maintain consistent software versions

This approach works well for organizations managing large fleets of Windows desktops and servers.

Using Microsoft Intune

Microsoft Intune provides cloud-based endpoint management for Windows devices.

Organizations can use Intune to:

• Deploy the Wazuh agent remotely
• Configure enrollment settings
• Apply standardized configurations
• Manage remote workstations
• Update deployed agents

Intune is especially valuable for organizations supporting remote or hybrid workforces.

Using Group Policy (GPO)

Active Directory Group Policy can automate Wazuh deployments within Windows domain environments.

Common uses include:

• Software deployment
• Startup scripts
• Configuration file distribution
• Registry configuration
• Service management

GPO is particularly effective for organizations with traditional on-premises Active Directory infrastructures.

Using Puppet

Puppet enables administrators to define the desired configuration of managed systems using code.

For Wazuh deployments, Puppet can automate:

• Agent installation
• Configuration management
• Enrollment configuration
• Service startup
• Ongoing configuration updates

This ensures endpoints remain compliant even after deployment.

Using Chef

Chef provides another Infrastructure-as-Code platform for automating endpoint management.

Chef recipes can:

• Install Wazuh agents
• Configure enrollment
• Apply security policies
• Assign agent groups
• Maintain configuration consistency

Also, Chef is commonly used in organizations with mature DevOps practices.

Using SaltStack

SaltStack enables fast, event-driven infrastructure automation across large environments.

Administrators can use SaltStack to:

• Deploy thousands of agents simultaneously
• Push configuration changes
• Automate enrollment
• Restart services
• Maintain standardized configurations

Its scalability makes it well suited for distributed enterprise environments.

Using Cloud-Init

Cloud-init automates instance initialization for many cloud platforms.

Organizations commonly configure cloud-init to:

• Install the Wazuh agent during first boot
• Configure enrollment settings
• Assign agent groups
• Start the agent automatically

This ensures newly provisioned virtual machines begin reporting security events immediately after creation.

Using Terraform

Terraform provisions cloud infrastructure using Infrastructure as Code (IaC).

Although Terraform primarily creates infrastructure rather than configuring operating systems, it integrates well with tools such as:

• cloud-init
• Ansible
• Puppet
• Chef

Together, these tools allow infrastructure creation and Wazuh enrollment to occur within the same deployment workflow.

Using Kubernetes

Containerized environments introduce unique deployment challenges because workloads may be created and destroyed frequently.

Wazuh can monitor Kubernetes environments by deploying agents using:

• DaemonSets
• Helm charts
• Automated manifests
• CI/CD pipelines

Combining Kubernetes automation with Wazuh auto-enrollment ensures that newly created worker nodes and supporting infrastructure become monitored automatically.

Related Guide: How to Monitor Kubernetes Using Wazuh

Security Best Practices

While auto-enrollment greatly simplifies endpoint deployment, it should be configured with security in mind.

Proper controls help ensure that only authorized systems can join your Wazuh deployment and that enrollment cannot be abused by malicious actors.

The following best practices can help strengthen the security of your enrollment infrastructure.

Use TLS Encryption

Always encrypt communications between Wazuh agents and the manager whenever possible.

TLS encryption helps protect:

• Authentication credentials
• Agent keys
• Configuration data
• Security telemetry
• Management communications

Encryption significantly reduces the risk of interception or tampering during enrollment.

Restrict Enrollment Networks

Do not expose enrollment services to the public internet unless absolutely necessary.

Instead, limit enrollment access to trusted networks such as:

• Internal corporate subnets
• VPN users
• Private cloud networks
• Dedicated management VLANs
• Approved branch office networks

Restricting network access reduces the attack surface and helps prevent unauthorized registration attempts.

Rotate Enrollment Passwords

If your deployment uses enrollment passwords, rotate them periodically.

Password rotation helps:

• Reduce long-term exposure
• Limit the impact of credential compromise
• Improve overall security hygiene
• Support compliance requirements

Avoid embedding passwords directly in deployment scripts whenever possible. Instead, retrieve them securely from a secrets management solution.

Protect Authentication Credentials

Enrollment credentials should be treated like any other sensitive secret.

Recommended practices include:

• Store credentials in encrypted secret stores.
• Restrict administrator access.
• Never commit credentials to source control.
• Use environment variables or secure vaults during automation.
• Audit credential usage regularly.

Following established secret management practices helps reduce the likelihood of accidental exposure.

Disable Enrollment When Not Needed

If new agents are not being deployed, consider temporarily disabling enrollment services.

Reducing the availability of enrollment endpoints limits opportunities for unauthorized registration attempts.

Many organizations enable enrollment only during planned deployment windows.

Monitor Enrollment Attempts

Regularly review enrollment activity for signs of unusual behavior.

Watch for:

• Repeated failed authentication attempts
• Unexpected source IP addresses
• Duplicate agent registrations
• Large numbers of enrollment requests
• Unauthorized enrollment attempts

Monitoring these events allows administrators to identify potential attacks or configuration problems early.

Use Separate Enrollment Servers for Large Environments

Organizations managing thousands of endpoints may benefit from separating enrollment services from production management infrastructure.

Dedicated enrollment servers can help:

• Reduce load on the primary manager
• Improve scalability
• Simplify maintenance
• Isolate enrollment traffic
• Support geographically distributed deployments

As environments grow, separating enrollment from day-to-day monitoring can improve both performance and operational resilience while making the overall architecture easier to scale.

Common Wazuh Agent Auto-Enrollment Problems

Although Wazuh Agent Auto-Enrollment simplifies endpoint onboarding, enrollment failures can still occur due to configuration issues, network problems, authentication failures, or compatibility problems.

Understanding the most common problems helps administrators quickly identify whether the issue exists on the agent, manager, network, or enrollment configuration side.

Agent Cannot Reach the Manager

One of the most common enrollment failures occurs when the Wazuh agent cannot establish a connection with the manager.

Possible causes include:

• Incorrect manager IP address or hostname
• Firewall restrictions
• Network routing issues
• VPN connectivity problems
• Incorrect enrollment port configuration
• Manager service not running

When this occurs, the agent cannot begin the authentication process because it cannot communicate with the enrollment service.

Common troubleshooting steps include:

• Verify the manager address configured on the agent.
• Test network connectivity from the endpoint.
• Confirm required ports are open.
• Verify the Wazuh manager is running.

Authentication Failed

Authentication failures occur when the Wazuh manager rejects the agent’s enrollment request.

Common causes include:

• Incorrect enrollment credentials
• Invalid authentication configuration
• Expired certificates
• Incorrect agent configuration
• Unsupported authentication methods

Reviewing both the agent and manager logs is usually the fastest way to identify the exact reason authentication failed.

Invalid Enrollment Password

When password-based enrollment is enabled, the password configured on the agent must match the password configured on the Wazuh manager.

Common causes of invalid password errors include:

• Typographical errors
• Incorrect secrets stored in automation scripts
• Password rotation without updating deployments
• Multiple environments using different passwords

Best practices include storing enrollment credentials securely and avoiding hardcoding passwords into deployment files.

Duplicate Agent Names

Wazuh requires each enrolled agent to have a unique identity.

Duplicate agent names can occur when:

• Virtual machines are cloned
• Server templates reuse the same hostname
• Old agent records remain in the manager
• Automation scripts generate duplicate names

Duplicate identities can cause:

• Registration conflicts
• Incorrect event attribution
• Confusing dashboard results

Organizations should implement standardized naming conventions before deploying auto-enrollment at scale.

Agent Never Appears in the Dashboard

Sometimes enrollment appears successful, but the endpoint does not appear in the Wazuh Dashboard.

Possible causes include:

• Agent registration failed
• Dashboard index delay
• Manager communication failure
• Incorrect agent status filtering
• Indexer synchronization issues

Recommended checks:

• Verify the agent exists on the manager.
• Confirm the agent service is running.
• Review manager logs.
• Check dashboard filters and time ranges.

Related Guide: Wazuh Dashboard Not Loading? Complete Troubleshooting Guide

Certificate Validation Errors

TLS certificate problems can prevent successful enrollment.

Common certificate-related issues include:

• Expired certificates
• Incorrect certificate authority
• Hostname mismatch
• Missing trusted certificates
• Incorrect certificate permissions

Certificate validation failures should be resolved before disabling security controls, since TLS protects the confidentiality and integrity of agent communication.

Related Guide: How to Fix Wazuh Certificate Errors

Firewall Blocking Enrollment

Firewalls are a common cause of failed agent registration.

Potential firewall issues include:

• Enrollment ports blocked
• Network ACL restrictions
• Cloud security group rules
• Host-based firewall policies

Verify firewall rules on:

• The Wazuh manager
• The endpoint
• Network security devices
• Cloud infrastructure

Only allow required communication paths while following least-privilege security principles.

DNS Resolution Problems

If agents connect using a hostname instead of an IP address, DNS problems can prevent enrollment.

Common DNS issues include:

• Missing DNS records
• Incorrect hostname
• Stale DNS entries
• Internal DNS unavailable
• Split DNS configuration problems

Test hostname resolution from the agent before troubleshooting deeper configuration issues.

Version Compatibility Issues

Wazuh agents and managers should run compatible versions.

Compatibility issues may occur after:

• Partial upgrades
• Failed migrations
• Using outdated agent packages
• Deploying new agents against older managers

Before large deployments, verify supported versions and test enrollment in a staging environment.

Agent Registers but Never Sends Events

A successful enrollment does not always mean the agent is fully operational.

An agent may register successfully but fail to send events because of:

• Agent service problems
• Incorrect module configuration
• Communication failures after enrollment
• Disabled log collection
• Incorrect permissions

Verify:

• Agent status is active.
• Keepalive messages are received.
• Logs are arriving.
• Monitoring modules are enabled.

Troubleshooting Wazuh Agent Auto-Enrollment

When auto-enrollment fails, troubleshooting should follow a structured process.

Start with basic connectivity checks, then move toward authentication, configuration, and service-level validation.

Verify Manager Authentication Service

The first step is confirming that the Wazuh manager is accepting enrollment requests.

Check that:

• Authentication services are running.
• Enrollment configuration is correct.
• The manager is listening on the expected ports.
• No startup errors exist.

A disabled or misconfigured authentication service prevents every new agent from enrolling.

Check Firewall Rules

Verify that network security controls allow communication between agents and the manager.

Review:

• Host firewalls
• Network firewalls
• Cloud security groups
• VPN policies
• Proxy configurations

Testing connectivity before changing Wazuh settings helps determine whether the issue is network-related.

Review Manager Logs

The Wazuh manager logs provide detailed information about enrollment attempts.

Look for messages related to:

• Authentication failures
• Invalid passwords
• Duplicate agents
• Connection attempts
• Key generation
• Registration errors

Manager-side logs often provide the most accurate explanation of why enrollment failed.

Review Agent Logs

The agent logs show what happens from the endpoint perspective.

Common messages include:

• Unable to connect
• Authentication rejected
• Invalid configuration
• Certificate failures
• Enrollment retries

Comparing agent logs with manager logs provides a complete view of the registration process.

Test Network Connectivity

Before troubleshooting configuration, verify basic connectivity.

Useful checks include:

• Ping tests
• DNS resolution tests
• Port connectivity tests
• Firewall verification
• Route validation

A simple network issue can appear as an authentication failure if the agent cannot reach the manager correctly.

Verify Enrollment Configuration

Review the agent configuration carefully.

Confirm:

• Manager hostname or IP
• Enrollment server settings
• Authentication parameters
• Agent name
• Group assignment
• TLS settings

Small configuration errors can prevent successful registration.

Remove Stale Agent Entries

Old agent records can interfere with new enrollment attempts.

Stale entries commonly occur after:

• Reinstalling systems
• Rebuilding virtual machines
• Reusing hostnames
• Restoring backups

Before re-enrolling, remove obsolete agent records from the manager to prevent identity conflicts.

Re-enroll Existing Agents

Sometimes the simplest solution is to perform a clean re-enrollment.

Common scenarios requiring re-enrollment include:

• Lost agent keys
• Manager migrations
• Certificate changes
• Corrupted configuration
• Duplicate identities

A clean enrollment process ensures the agent receives fresh authentication credentials.

Related Guide: Why Is client.keys File Empty? Restoring Lost Wazuh Agents

Best Practices for Wazuh Agent Auto-Enrollment

Following deployment best practices ensures that auto-enrollment remains reliable, secure, and manageable as your environment grows.

Standardize Agent Naming Conventions

Consistent naming makes it easier to identify assets and investigate security events.

A good naming convention may include:

• Environment
• Location
• Operating system
• Role
• Unique identifier

Example:

PROD-NYC-WEB-001
DEV-AWS-LINUX-024
HQ-WIN-USER-105

Avoid random names or automatically generated identifiers that make asset tracking difficult.

Use Agent Groups from Day One

Agent groups should be part of your initial deployment design.

Using groups immediately allows you to:

• Apply correct policies automatically.
• Separate different endpoint types.
• Simplify configuration management.
• Scale security operations efficiently.

Adding groups later often requires unnecessary manual cleanup.

Automate Installation and Enrollment Together

The most efficient deployments combine:

1. Agent installation.
2. Configuration.
3. Enrollment.
4. Policy assignment.
5. Service startup.

Treating enrollment as part of the deployment workflow eliminates gaps where endpoints exist without monitoring coverage.

Related Guide: How to Automate Bulk Wazuh Agent Deployment with Ansible and SCCM

Use Infrastructure as Code

Infrastructure as Code makes security deployments repeatable and predictable.

Tools such as:

• Terraform
• Ansible
• Puppet
• Chef
• cloud-init

allow organizations to define Wazuh enrollment procedures alongside infrastructure configuration.

This reduces configuration drift and improves operational consistency.

Keep Enrollment Credentials Secure

Enrollment credentials should never be treated as ordinary configuration values.

Protect them by:

• Using secret management platforms.
• Limiting access permissions.
• Rotating credentials regularly.
• Avoiding plaintext storage.
• Auditing credential usage.

Compromised enrollment credentials could allow unauthorized systems to attempt registration.

Monitor Failed Enrollment Attempts

Repeated enrollment failures may indicate:

• Misconfigured deployments
• Broken automation
• Unauthorized registration attempts
• Credential misuse

Monitor failed attempts and investigate unusual activity.

Security teams should treat enrollment failures as operational events that may require investigation.

Regularly Remove Inactive Agents

Over time, environments accumulate inactive endpoints caused by:

• Decommissioned servers
• Retired laptops
• Destroyed cloud instances
• Temporary test systems

Regularly removing inactive agents keeps the dashboard clean and prevents confusion during incident investigations.

Test Enrollment After Every Upgrade

Wazuh upgrades can introduce changes affecting:

• Authentication
• Certificates
• Agent communication
• Configuration formats
• Enrollment behavior

After upgrading the manager or agents:

• Test new enrollments.
• Verify existing agents reconnect.
• Confirm policies apply correctly.
• Review logs for errors.

Testing prevents deployment failures from spreading across production environments.

Real-World Example

Scenario

A growing enterprise needs to deploy 5,000 Wazuh agents across a mixed infrastructure environment that includes:

• Windows employee workstations
• Linux production servers
• Cloud-based virtual machines
• Remote employee laptops
• Hybrid infrastructure across multiple locations

The organization wants every endpoint monitored by Wazuh immediately after deployment while maintaining consistent security policies across all systems.

Previously, administrators manually installed agents, created registrations, generated authentication keys, and configured each endpoint individually.

As the organization expanded, this approach became increasingly difficult to maintain.

Challenge

Manual Wazuh agent registration created several operational challenges:

• Deployment required significant administrator time.
• New endpoints waited days before receiving security monitoring.
• Agent configurations differed between systems.
• Authentication keys had to be manually managed.
• Human errors caused inconsistent deployments.
• Scaling security monitoring became difficult.

Registering thousands of endpoints individually would require administrators to repeat the same enrollment process thousands of times, creating unnecessary operational overhead.

The company needed a scalable approach that allowed new systems to automatically become monitored assets.

Solution

The organization implemented Wazuh Agent Auto-Enrollment as part of an automated endpoint deployment strategy.

The deployment workflow included:

1. Installing Wazuh agents automatically.
2. Configuring enrollment settings during installation.
3. Allowing agents to authenticate with the Wazuh manager.
4. Automatically generating agent keys.
5. Assigning endpoints to predefined agent groups.
6. Applying security policies automatically.

Different automation platforms were used depending on the endpoint type:

• Ansible was used for Linux servers and cloud instances.
• SCCM was used for Windows enterprise workstations.
• Microsoft Intune was used for remote laptops.

The organization also implemented security controls including:

• TLS-encrypted communication.
• Restricted enrollment networks.
• Protected enrollment credentials.
• Standardized agent naming conventions.
• Centralized policy management.

Related Guide: How to Automate Bulk Wazuh Agent Deployment with Ansible and SCCM

Results

After implementing automated enrollment, the organization achieved significant improvements:

Thousands of Agents Enrolled Automatically

New endpoints could register with the Wazuh manager without administrators manually creating agent records or distributing authentication keys.

This allowed security teams to monitor new systems immediately after deployment.

Deployment Time Reduced From Days to Hours

Automation eliminated repetitive enrollment tasks.

Instead of manually processing thousands of endpoints, administrators could deploy monitoring across the environment through existing automation pipelines.

Consistent Security Policies Across All Endpoints

Agent groups ensured that every system received the correct monitoring configuration.

Examples:

• Windows systems received Windows event monitoring policies.
• Linux servers received Linux audit and system log monitoring.
• Web servers received application log monitoring.
• Cloud instances received cloud-specific monitoring configurations.

Minimal Administrative Effort

Security teams no longer needed to manually manage thousands of registrations.

Administrative work shifted from repetitive enrollment tasks to higher-value activities such as:

• Threat investigation
• Detection engineering
• Security policy improvement
• Incident response

Faster Onboarding of New Devices

New servers, workstations, and cloud instances automatically became monitored assets during provisioning.

This reduced security gaps where newly deployed systems existed without endpoint visibility.

Simplified Ongoing Endpoint Management

With automated enrollment, centralized groups, and automated configuration management, administrators could manage thousands of endpoints from a consistent workflow.

Future changes could be applied through:

• Wazuh agent groups
• Configuration management tools
• Infrastructure-as-Code pipelines
• Centralized security policies

Frequently Asked Questions (FAQ)

Question: What is Wazuh Agent Auto-Enrollment?

Wazuh Agent Auto-Enrollment is a feature that allows newly installed Wazuh agents to automatically register with a Wazuh manager without requiring administrators to manually create agent records or distribute authentication keys.

During enrollment, the agent authenticates with the manager, receives a unique identity, and establishes secure communication.

This makes it easier to deploy Wazuh across large environments containing hundreds or thousands of endpoints.

Question: Is auto-enrollment secure?

Yes, when configured correctly, Wazuh Agent Auto-Enrollment provides a secure onboarding process.

Security best practices include:

• Using TLS encryption.
• Restricting enrollment access.
• Protecting enrollment credentials.
• Using strong authentication methods.
• Monitoring failed enrollment attempts.

Organizations should avoid exposing enrollment services unnecessarily and should limit registration access to trusted systems.

Question: Can I automatically assign agents to groups?

Yes.

Agent groups can be assigned during or immediately after enrollment, allowing newly registered endpoints to automatically receive the correct security policies.

Groups can be used to apply:

• File Integrity Monitoring configurations
• Log collection rules
• Active Response settings
• Security Configuration Assessment policies
• Custom monitoring configurations

Question: Can existing agents be re-enrolled?

Yes.

Existing agents can be re-enrolled when situations require new authentication credentials or a fresh registration.

Common reasons include:

• Lost agent keys
• Server rebuilds
• Manager migrations
• Certificate changes
• Duplicate agent identities

Before re-enrolling, administrators should remove stale agent records to prevent conflicts.

Question: Does auto-enrollment work on Windows, Linux, and macOS?

Yes.

Wazuh supports agent deployment across multiple operating systems, including:

• Windows
• Linux distributions
• macOS

The enrollment process remains similar across platforms:

1. Install the agent.
2. Configure the manager connection.
3. Provide authentication details.
4. Start the service.
5. Verify registration.

The main differences are the installation and automation methods used on each operating system.

Question: Can I automate enrollment with Ansible or SCCM?

Yes.

Automation tools are commonly used to combine Wazuh agent installation and enrollment into a single workflow.

Examples:

• Ansible for Linux servers and cloud environments.
• SCCM for enterprise Windows deployments.
• Intune for remote and cloud-managed devices.
• Terraform and cloud-init for cloud infrastructure.

This approach allows organizations to deploy monitored endpoints automatically as part of normal provisioning workflows.

Question: What port does Wazuh use for agent enrollment?

Wazuh agent enrollment uses the Wazuh authentication service.

The specific port depends on your configuration, but the default enrollment service commonly uses:

• 1515/TCP for agent enrollment.

After enrollment, agents typically communicate with the Wazuh manager using:

• 1514/TCP or UDP for agent communication.

Administrators should verify the configured ports in their Wazuh deployment before creating firewall rules.

Question: How do I verify that an agent enrolled successfully?

You can verify successful enrollment by checking:

• The Wazuh Dashboard.
• Agent status on the manager.
• Agent authentication keys.
• Manager logs.
• Agent logs.
• Incoming security events.

A successfully enrolled agent should appear as active and begin sending telemetry shortly after registration.

Question: Why is my Wazuh agent failing to enroll automatically?

Common causes include:

• Incorrect manager address.
• Firewall blocking enrollment traffic.
• Invalid enrollment password.
• DNS resolution problems.
• Authentication service not running.
• Certificate validation failures.
• Version incompatibility.
• Duplicate agent names.

Start troubleshooting by checking both manager and agent logs because they usually provide the exact reason enrollment failed.

Question: Can I disable auto-enrollment after deployment?

Yes.

Organizations can disable enrollment services when automatic registration is no longer required.

For example, after completing a large deployment, administrators may restrict or disable enrollment access to reduce the attack surface.

However, disabling enrollment does not affect already registered agents. Existing agents can continue communicating with the Wazuh manager using their existing authentication credentials.

Conclusion

Wazuh Agent Auto-Enrollment provides a scalable and secure way to onboard endpoints without the manual effort traditionally required for agent registration.

By automating authentication, key generation, and initial configuration, organizations can deploy Wazuh across thousands of systems while maintaining consistent security policies.

The biggest advantages include:

• Faster endpoint deployment.
• Reduced administrative workload.
• Fewer configuration mistakes.
• Consistent security monitoring.
• Easier management of large environments.
• Improved visibility across cloud, hybrid, and on-premises infrastructure.

For enterprise environments, auto-enrollment should be combined with centralized configuration management, agent groups, Infrastructure-as-Code practices, and continuous monitoring.

When integrated into automated deployment workflows, Wazuh becomes easier to operate at scale while providing security teams with faster visibility into newly deployed systems.