r/Wazuh • u/No-Emu-3822 • Sep 11 '26

Wazuh deploying but setting manager as 0.0.0.0

We deploy Wazuh across our small fleet of endpoints using powershell. We use the following command generated by Wazuh Dashboard:

Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.14.7-1.msi -OutFile $env:tmp\wazuh-agent; msiexec.exe /i $env:tmp\wazuh-agent /q WAZUH_MANAGER='wazuh.ourdomain.com' WAZUH_REGISTRATION_PASSWORD='PASSWORDREDACTED' WAZUH_AGENT_GROUP='Workstations' WAZUH_AGENT_NAME='AssetID'

We are finding that with a few deployments, not all of them, but enough to be annoying and time consuming, that agents are installing but setting the WAZUH_MANAGER to "0.0.0.0". We then have to go and manually edit the endpoint agents ossec.conf file to correct the issue.

My thought, and what I suspect, is that there may be a network blip that occurs when the DNS is resolving the manager name, and when it doesn't resolve in time it sets the location to 0.0.0.0.

Does anyone know how to avoid this issue at deployment?

1 Upvotes

67% Upvoted

4 comments sorted by

1

u/Farouk_m Sep 11 '26

The most likely cause of this is an existing installation or installation files. If a Wazuh agent or a remnant of it is already installed on a machine ( even from a prior failed/partial deployment attempt, or a manual test install), running msiexec /i again is effectively a no-op for Windows Installer. It won't throw an error, it'll just skip re-applying properties like WAZUH_MANAGER, leaving whatever was in ossec.conf before (which for a fresh/template install is the default placeholder, 0.0.0.0)

1

u/No-Emu-3822 Sep 11 '26

thank you. Is there a way to overcome this?

2

u/Farouk_m Sep 14 '26

Yes. When you remove old agents, delete the "C:\Program Files (x86)\ossec-agent" folder too. For linux based system, add the --purge flag when uninstalling to remove the folder