Skip to content

Lab10.1WazuhWindows

Jump to bottom
Beth edited this page Apr 21, 2025 · 14 revisions

Domain Services

Start by installing active directory services on MGMT02 (Make sure to take a snapshot beforehand)

Open Server Manager, Manage > Add Roles and Features

  • Active Directory Domain Services

The server then needed to be promoted to a domain server, so I did so, adding a new forest and naming the domain elizabeth.local

Then I hit install to promote MGMT02 to a domain controller, and waited

WKS01 Domain Connection

https://learn.microsoft.com/en-us/answers/questions/901610/tcp-and-ud-ports-required-for-communication-betwee

Based on this research, it seems that the ports I need to allow for communication are as follows:

UDP

  • 88
  • 135
  • 389
  • 445
  • 464
  • 53
  • 1025 - 5000
  • 49152 - 65535

TCP

  • 88
  • 389
  • 135
  • 445
  • 464
  • 3268 and 3269
  • 53
  • 1025 - 5000
  • 49152 - 65535

image

image

Vyos Aside

During this I learned that you can edit a firewall such as edit firewall name LAN-to-MGMT to only edit rule within there, this reduces the amount of typing you have to do.

I also learned that you can copy rules, such as copy rule 30 to rule 31 to also reduce the amount of typing you have to do

Make sure to point the wks at mgmt02 for dns, and connect it to the domain!

In order to find the few ports I was missing from my research, I ran wireshark and allowed any ports I saw wks trying to use to connect to mgmt02

Wazuh

Connect wks01 to wazuh by following the instructions in the "deploy a new agent" tool and running the command it generates. Make sure to create a new windows group beforehand.

  • Make sure to run it in a privileged powershell prompt

You can start the wazuh service with NET START WazuhSvc

Clone this wiki locally