# Auditbeat on Windows core with sshd

**URL:** https://discuss.elastic.co/t/auditbeat-on-windows-core-with-sshd/311920
**Category:** Beats
**Tags:** auditbeat
**Created:** [August 11, 2022, 11:42am UTC](https://discuss.elastic.co/t/auditbeat-on-windows-core-with-sshd/311920 "2022-08-11T11:42:56Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![dmgeurts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmgeurts/32/95115_2.png) [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)
#### Post date: [August 11, 2022, 11:42am UTC](https://discuss.elastic.co/t/auditbeat-on-windows-core-with-sshd/311920/1 "2022-08-11T11:42:56Z")

</div>

Just installed the first Aufitbeat agent to a Windows server and as this is a Windows Core server access is really only via ssh. Has anyone played with this setup? Auditbeat is reporting, but I'm not seeing sshd login being reported to Elasticsearch.

I'm not sure how to configure Auditbeat on Windows Server to ensure that sshd events are logged.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 8, 2022, 1:43pm UTC](https://discuss.elastic.co/t/auditbeat-on-windows-core-with-sshd/311920/2 "2022-09-08T13:43:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
