> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/08-wazuh-security-monitoring-basics/enroll-client01.md).

# Enroll CLIENT01 in Wazuh

`CLIENT01` will be the first monitored endpoint in Wazuh.

Starting with one endpoint makes troubleshooting easier because we already know how its Windows Security and Sysmon logs behave locally.

## Objective

Install and enroll the Wazuh agent on `CLIENT01`, then confirm that the endpoint appears as active in the Wazuh dashboard.

## Before You Start

Confirm that:

* `WAZUH01` is running
* the Wazuh dashboard is accessible
* `CLIENT01` is running normally
* `CLIENT01` can reach `WAZUH01` over the lab network
* Sysmon is still installed on `CLIENT01`

## Add the Agent

Use the Wazuh dashboard or current official Wazuh documentation to obtain the enrollment steps for a Windows agent.

The exact installation command can change between Wazuh versions, so use the command generated by the platform you are actually running.

When prompted for a server or manager address, use the lab address of `WAZUH01`.

## Install on CLIENT01

1. Sign in to `CLIENT01` with an account that can install software.
2. Download or use the Wazuh Windows agent package from the official Wazuh source.
3. Follow the enrollment instructions generated for your Wazuh version.
4. Start the Wazuh agent service if the installer does not start it automatically.
5. Return to the Wazuh dashboard.

## Verify Agent Status

Locate `CLIENT01` in the agent list.

Confirm that it appears as connected or active.

Record:

```
Agent name: CLIENT01
Operating system: Windows
Status: Active
```

Do not publish enrollment keys, authentication secrets, or other sensitive agent information.

## Troubleshooting Basics

If the agent does not appear as active, check these areas first:

1. Is `WAZUH01` reachable from `CLIENT01`?
2. Is the Wazuh agent service running?
3. Was the correct Wazuh server address used?
4. Is Windows Firewall blocking required communication?
5. Does the Wazuh server show an enrollment or agent error?
6. Are the system clocks reasonably synchronized?

Change one thing at a time and document what you tested.

## Verification

The lab is complete when:

* the Wazuh agent is installed on `CLIENT01`
* the agent service is running
* `CLIENT01` appears in the Wazuh dashboard
* the agent status is active
* no credentials or enrollment secrets were added to the documentation

## Security Relevance

Endpoint visibility depends on reliable agent communication. Before relying on alerts, always confirm that the expected endpoint is actually connected and sending data.