I have a Windows Server 2022 as my DC from which I am trying to start the wazuh service running in the client endpoints.

Question

I have Windows server 2022 as DC and client endpoints with wazuh agent installed in it. I made some changes from DC to client machines, but I have to restart the wazuh service for those changes to take effect. For this, I used startup scripts, which run on startup, but what's happening is that the wazuh service gets stuck in the stopping mode and does not change its state.

I have made changes in the script but no change in output.

Also I tried the script first directly on the client machine it works. But from DC its not working.

Can you help me with this as restarting the agent manually is not possible for 100 endpoints ?

script is:

@echo off

setlocal enabledelayedexpansion

echo Stopping Wazuh Agent...

:: Stop Wazuh service

net stop wazuh /y

timeout /t 5 /nobreak >nul

:: Check if service stopped, if not, force kill the process

sc query wazuh | find "STATE" | find "STOPPED" >nul

if %errorlevel% neq 0 (

echo Wazuh service did not stop properly. Killing process...

taskkill /F /IM wazuh-agent.exe /T

timeout /t 3 /nobreak >nul

)

:: Force a cleanup of any locked files

del /F /Q "C:\Program Files (x86)\ossec-agent\queue*.*"

:: Start Wazuh service

echo Starting Wazuh Agent...

net start wazuh

timeout /t 3 /nobreak >nul

:: Check if the service started successfully

sc query wazuh | find "STATE" | find "RUNNING" >nul

if %errorlevel% neq 0 (

echo ERROR: Wazuh agent failed to start!

exit /b 1

) else (

echo Wazuh Agent restarted successfully.

)

This is the last script I tried to kill the process of wazuh to help it start again.But as I said the service is stuck in stopping state.