# Install winlogbeat on windows server 2003 without powershell **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [October 3, 2017, 5:06am UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506 "2017-10-03T05:06:41Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![tharu85](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Post date:** [October 3, 2017, 5:06am UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506/1 "2017-10-03T05:06:41Z")
I have a server with windows server 2003 installed and I need to forward that server windows event logs to logstash through winlogbeat. But there is no powershell in windows server 2003. So how can I install winlogbeat service without powershell ? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [October 3, 2017, 1:21pm UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506/2 "2017-10-03T13:21:11Z")
The `New-Service` powershell cmdlet is used by the script to create the winlogbeat service. You could try to [install Powershell 2.0](https://support.microsoft.com/en-us/help/968929/windows-management-framework-windows-powershell-2-0--winrm-2-0--and-bi) and see if the script works. Microsoft's website doesn't have much information on Powershell 2.0 so I don't know if `New-Service` is present in the version. Another option might be to use `sc.exe` to create the winlogbeat service. See [https://support.microsoft.com/en-us/help/251192/how-to-create-a-windows-service-by-using-sc-exe](https://support.microsoft.com/en-us/help/251192/how-to-create-a-windows-service-by-using-sc-exe) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 3, 2017, 1:45pm UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506/3 "2017-10-03T13:45:31Z")
New-Service was added in 3.0. You can tell by going to [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-service](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-service) and seeing what versions are listed in the dropdown at the top left. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [October 3, 2017, 2:02pm UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506/4 "2017-10-03T14:02:17Z")
I don't think the docs for 2.0 are available on that site. The drop down doesn't contain a 2.0 option even for cmdlets that were available in 2.0 such as `Get-ChildItem`. ---
**Author:** ![tharu85](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Post date:** [October 4, 2017, 6:15am UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506/5 "2017-10-04T06:15:07Z")
I am able to install " **install-service-winlogbeat.ps1**" using **Powershell v1.0** on windows server 2003. But when I am going to start the winlogbeat service, it gives following error message. I try to fixed it but unfortunately no luck. Can any body give me a direction to fixed this issue. ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/a/ca331f4d6c7a154ff9e055a44f6ac3467c8b61c5.png) Error code -\> Error 216: 0xd8 ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [October 5, 2017, 3:25pm UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506/6 "2017-10-05T15:25:39Z")
Can you please test your config and also try to start Winlogbeat on the CLI (rather than as a service). 1. Test the config 2. Start Winlogbeat in the foreground. ---
**Author:** ![tharu85](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Post date:** [October 6, 2017, 5:09am UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506/7 "2017-10-06T05:09:43Z")
Once I execute below command I received listed error message **PS E:\Graylog\winlogbeat-5.4.0-windows-x86\_64\> .\winlogbeat.exe -c .\winlogbeat.** **yml -e -configtes** Received Below Error ``` PS E:\Graylog\winlogbeat-5.4.0-windows-x86_64> .\winlogbeat.exe -c .\winlogbeat. yml -e -configtest Program 'winlogbeat.exe' failed to execute: The image file %1 is valid, but is for a machine type other than the current machine At line:1 char:17 + .\winlogbeat.exe <<<< -c .\winlogbeat.yml -e -configtest. At line:1 char:1 + . <<<< \winlogbeat.exe -c .\winlogbeat.yml -e -configtest ``` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [October 6, 2017, 1:53pm UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506/8 "2017-10-06T13:53:32Z")
Is this a 32-bit machine or OS version? If so you need to use the 32-bit version of Winlogbeat. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 6, 2017, 8:22am UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506/11 "2017-11-06T08:22:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.