GPO to start Beats not working

Elastic Stack Beats
, , , ,
1

Hi buddies,

I am trying to start beat services (filebeat, metricbeat, heartbeat, winlogbeat, auditbeat) using a GPO but I don't know why,it's not working.

In Group Policy Management, under "Computer Configuration" I did the following:

Preferences -> Control Panel Settings -> Services

  • I create one service rule for each Beat. The service name is exactly the same as configured in the other machines (auditbeat, filebeat, heartbeat, metricbeat, winlogbeat). I check it twice.
  • At "service action", I defined as "start service".
  • At "Startup", I defined as "automatic"
  • At "log on as:" I let "No change", but I tried using "Local system account" too, and didn't work.
  • All the other options I defined as "No change".

beats
beats834×465 100 KB

When a machine starts, the GPO is executed (checked with gpresult), but the service don't start automatically.

beats2
beats2757×576 96.5 KB

If I go to the machine services, and try to start the services manually, it works correctly.

beats3

Does anyone have any idea of what could be happing?

I had other similar GPO created to start other services (not beats) and all of them work fine.

Thanks in advance for the help!

2

Can you try this solution
I used this solution and worked for me in the past

3

Hi ylasri.

Thanks for the quick answer.

Yes, I saw this procedure. The problem is that I don't control too much Powershell.
To create this script, Do I need to copy the entire code to a unique powershell script or need to be 2 scripts (one for "delete service" and the other to "create the service")?

Could you help me with this doubt?

4

It's one script that do all 3 steps

5

I am testing the Script and when I execute it, a window appears requesting a user and password:

beats3
beats3921×609 108 KB

This windows appears to you too?

6

I tried a different thing and works for me. At the service rule configuration, I configure to "Restart the Service" in a case of failure and now it's work.

beats4

It was configured before as "No Change", but with this configuration now apparently it's working (I've tested with some few machines in my environment).

The script didn't work for me, probably because I don't know too much about scripting with Powershell.

Thanks for the Help!

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.