I need to install filebeat service with Powershell disabled

[JimP (James Peppercorn)]

Powershell is disabled by internal InfoSec dept. How else can I install filebeat as a service on Windows 2012 R2 Datacenter, please?

I see that when installed with Powershell the service has this.

"D:\filebeat-6.2.3-windows-x86_64\\filebeat.exe" -c "D:\filebeat-6.2.3-windows-x86_64\\filebeat.yml" -path.home "D:\filebeat-6.2.3-windows-x86_64" -path.data "D:\filebeat-6.2.3-windows-x86_64" -path.logs "D:\filebeat-6.2.3-windows-x86_64\\logs"

[andrewkroh]

Without PowerShell you will have to find an alternative way to create the service so that the Beat runs at startup. You could probably use sc.exe to create a service similar to how the install powershell script does it.

[JimP (James Peppercorn)]

Thanks. Here's what I ended up doing.

sc create filebeat binpath= "D:\filebeat-6.2.3-windows-x86_64\filebeate.exe"

Then open the registry to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\filebeat\

Modified the ImagePath to this full command (from .ps1) :

"D:\filebeat-6.2.3-windows-x86_64\\filebeat.exe" -c "D:\filebeat-6.2.3-windows-x86_64\\filebeat.yml" -path.home "D:\filebeat-6.2.3-windows-x86_64" -path.data "D:\filebeat-6.2.3-windows-x86_64" -path.logs "D:\filebeat-6.2.3-windows-x86_64\\logs"

Open Services.msc and run service filebeat. Change startup type to Automatic.