# GPO to start Beats not working
**URL:** https://discuss.elastic.co/t/gpo-to-start-beats-not-working/248626
**Category:** Beats
**Tags:** auditbeat, metricbeat, filebeat, heartbeat, winlogbeat
**Created:** [September 15, 2020, 8:11am UTC](https://discuss.elastic.co/t/gpo-to-start-beats-not-working/248626 "2020-09-15T08:11:30Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Thelmo\_Henrique\_Sant](https://discuss.elastic.co/u/Thelmo_Henrique_Sant)
#### Post date: [September 15, 2020, 8:11am UTC](https://discuss.elastic.co/t/gpo-to-start-beats-not-working/248626/1 "2020-09-15T08:11:30Z")
Hi buddies,
I am trying to start beat services (filebeat, metricbeat, heartbeat, winlogbeat, auditbeat) using a GPO but I don't know why,it's not working.
In Group Policy Management, under "Computer Configuration" I did the following:
Preferences -\> Control Panel Settings -\> Services
- I create one service rule for each Beat. The service name is exactly the same as configured in the other machines (auditbeat, filebeat, heartbeat, metricbeat, winlogbeat). I check it twice.
- At "service action", I defined as "start service".
- At "Startup", I defined as "automatic"
- At "log on as:" I let "No change", but I tried using "Local system account" too, and didn't work.
- All the other options I defined as "No change".
When a machine starts, the GPO is executed (checked with gpresult), but the service don't start automatically.
If I go to the machine services, and try to start the services manually, it works correctly.
Does anyone have any idea of what could be happing?
I had other similar GPO created to start other services (not beats) and all of them work fine.
Thanks in advance for the help!
---
### Author:  [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [September 15, 2020, 8:22am UTC](https://discuss.elastic.co/t/gpo-to-start-beats-not-working/248626/2 "2020-09-15T08:22:09Z")
Can you try this [solution](https://discuss.elastic.co/t/winlogbeat-deploy-via-gpo/121063/4)
I used this solution and worked for me in the past
---
### Author:  [@Thelmo\_Henrique\_Sant](https://discuss.elastic.co/u/Thelmo_Henrique_Sant)
#### Post date: [September 15, 2020, 8:31am UTC](https://discuss.elastic.co/t/gpo-to-start-beats-not-working/248626/3 "2020-09-15T08:31:07Z")
Hi ylasri.
Thanks for the quick answer.
Yes, I saw this procedure. The problem is that I don't control too much Powershell.
To create this script, Do I need to copy the entire code to a unique powershell script or need to be 2 scripts (one for "delete service" and the other to "create the service")?
Could you help me with this doubt?
---
### Author:  [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [September 15, 2020, 8:40am UTC](https://discuss.elastic.co/t/gpo-to-start-beats-not-working/248626/4 "2020-09-15T08:40:16Z")
It's one script that do all 3 steps
---
### Author:  [@Thelmo\_Henrique\_Sant](https://discuss.elastic.co/u/Thelmo_Henrique_Sant)
#### Post date: [September 15, 2020, 9:25am UTC](https://discuss.elastic.co/t/gpo-to-start-beats-not-working/248626/5 "2020-09-15T09:25:01Z")
I am testing the Script and when I execute it, a window appears requesting a user and password:
This windows appears to you too?
---
### Author:  [@Thelmo\_Henrique\_Sant](https://discuss.elastic.co/u/Thelmo_Henrique_Sant)
#### Post date: [September 15, 2020, 10:18am UTC](https://discuss.elastic.co/t/gpo-to-start-beats-not-working/248626/6 "2020-09-15T10:18:58Z")
I tried a different thing and works for me. At the service rule configuration, I configure to "Restart the Service" in a case of failure and now it's work.
It was configured before as "No Change", but with this configuration now apparently it's working (I've tested with some few machines in my environment).
The script didn't work for me, probably because I don't know too much about scripting with Powershell.
Thanks for the Help!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 13, 2020, 12:19pm UTC](https://discuss.elastic.co/t/gpo-to-start-beats-not-working/248626/7 "2020-10-13T12:19:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.