GPO to start Beats not working

[Thelmo_Henrique_Sant (Thelmo Henrique Santos Mauleon)]

Hi buddies,

I am trying to start beat services (filebeat, metricbeat, heartbeat, winlogbeat, auditbeat) using a GPO but I don't know why,it's not working.

In Group Policy Management, under "Computer Configuration" I did the following:

Preferences -> Control Panel Settings -> Services

• I create one service rule for each Beat. The service name is exactly the same as configured in the other machines (auditbeat, filebeat, heartbeat, metricbeat, winlogbeat). I check it twice.
• At "service action", I defined as "start service".
• At "Startup", I defined as "automatic"
• At "log on as:" I let "No change", but I tried using "Local system account" too, and didn't work.
• All the other options I defined as "No change".

When a machine starts, the GPO is executed (checked with gpresult), but the service don't start automatically.

If I go to the machine services, and try to start the services manually, it works correctly.

Does anyone have any idea of what could be happing?

I had other similar GPO created to start other services (not beats) and all of them work fine.

Thanks in advance for the help!

[ylasri (Yassine LASRI)]

Can you try this solution
I used this solution and worked for me in the past

[Thelmo_Henrique_Sant (Thelmo Henrique Santos Mauleon)]

Hi ylasri.

Thanks for the quick answer.

Yes, I saw this procedure. The problem is that I don't control too much Powershell.
To create this script, Do I need to copy the entire code to a unique powershell script or need to be 2 scripts (one for "delete service" and the other to "create the service")?

Could you help me with this doubt?

[ylasri (Yassine LASRI)]

It's one script that do all 3 steps

[Thelmo_Henrique_Sant (Thelmo Henrique Santos Mauleon)]

I am testing the Script and when I execute it, a window appears requesting a user and password:

This windows appears to you too?

[Thelmo_Henrique_Sant (Thelmo Henrique Santos Mauleon)]

I tried a different thing and works for me. At the service rule configuration, I configure to "Restart the Service" in a case of failure and now it's work.

It was configured before as "No Change", but with this configuration now apparently it's working (I've tested with some few machines in my environment).

The script didn't work for me, probably because I don't know too much about scripting with Powershell.

Thanks for the Help!