> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/08-wazuh-security-monitoring-basics/enroll-dc01.md).

# Enroll DC01 in Wazuh

After `CLIENT01` is stable and reporting correctly, add the domain controller to Wazuh.

## Objective

Enroll `DC01` as a monitored Windows server and confirm that Active Directory security events can be reviewed centrally.

## Why Add DC01 Second

A domain controller produces security-relevant events involving authentication, users, groups, privileges, and directory changes.

It is also a more sensitive system than a normal workstation. Starting with `CLIENT01` gives us a known working Wazuh configuration before making changes to `DC01`.

## Before You Start

Confirm that:

* `WAZUH01` is healthy
* `CLIENT01` is active in Wazuh
* Windows and Sysmon event ingestion from `CLIENT01` has been validated
* `DC01` is operating normally
* a recent VMware snapshot or other suitable lab recovery point exists

## Enroll the Agent

Use the Wazuh dashboard or current official Wazuh documentation to generate the Windows agent enrollment steps for `DC01`.

Use the lab address of `WAZUH01` as the Wazuh server or manager address.

Install only the standard Wazuh agent required for this lab. Avoid making unrelated changes to the domain controller during the same exercise.

## Verify Agent Status

Return to the Wazuh dashboard and confirm:

```
Agent name: DC01
Operating system: Windows Server
Status: Active
```

## Generate a Safe Test Event

Use a small, controlled Active Directory action that has already been practiced in the earlier monitoring section.

For example, create a temporary lab user named:

```
wazuhtest01
```

Record the time of creation.

Then verify the corresponding account creation event on `DC01`. Where the configured audit policy records it, Windows Event ID `4720` represents a user account being created.

## Find the Event in Wazuh

Search Wazuh for the activity using:

* agent `DC01`
* the approximate time window
* Windows Event ID `4720` when available
* the temporary username `wazuhtest01`

## Clean Up

Delete the temporary `wazuhtest01` account after the test.

If account deletion auditing is enabled, you can also observe the related deletion event.

## Verification

The lab is complete when:

* `DC01` appears as an active Wazuh agent
* a known Active Directory event can be found locally
* the same activity can be located in Wazuh
* the temporary test account has been removed

## Security Relevance

Centralized domain controller monitoring gives analysts visibility into identity and privilege changes that may affect the entire Windows environment. Because of that importance, domain controller telemetry should be validated carefully.