# Winlogbeat install error **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [October 9, 2018, 5:13pm UTC](https://discuss.elastic.co/t/winlogbeat-install-error/151691 "2018-10-09T17:13:59Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![paulc](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@paulc](https://discuss.elastic.co/u/paulc)\ **Post date:** [October 9, 2018, 5:14pm UTC](https://discuss.elastic.co/t/winlogbeat-install-error/151691/1 "2018-10-09T17:14:00Z")
I've followed the instructions via the winlogbeat guide and tried to take ownership of the .ps1 files but as far as I get is supposedly installing the service and setting the startuptype to automatic but when I try to start winlogbeat service I get a Windows Error 1053. I've also tried via command prompt but same result. Any suggestions on how to get this installed not only on my machine but a mass scale? ---
**Author:** ![popa](https://avatars.discourse-cdn.com/v4/letter/p/dec6dc/32.png) [@popa](https://discuss.elastic.co/u/popa)\ **Post date:** [October 10, 2018, 12:30am UTC](https://discuss.elastic.co/t/winlogbeat-install-error/151691/2 "2018-10-10T00:30:16Z")
There's a few pieces of information needed before we can help diagnose and resolve your issue. What version of Windows are you installing Winlogbeat on? Are you trying to deploy across a domain? Are you running any type of endpoint agents, do you have any software restriction policies in place, etc? Thanks. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [October 10, 2018, 9:11am UTC](https://discuss.elastic.co/t/winlogbeat-install-error/151691/3 "2018-10-10T09:11:55Z")
Can you try running winlogbeat in the foreground (not as a service) from a console to see if it starts this way or gives an error. ```auto PS C:\Program Files\Winlogbeat> .\winlogbeat.exe test config -c .\winlogbeat.yml -e ``` then ```auto PS C:\Program Files\Winlogbeat> .\winlogbeat.exe -c .\winlogbeat.yml -e ``` ---
**Author:** ![paulc](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@paulc](https://discuss.elastic.co/u/paulc)\ **Post date:** [October 12, 2018, 2:40pm UTC](https://discuss.elastic.co/t/winlogbeat-install-error/151691/4 "2018-10-12T14:40:24Z")
Workstation is Win10 Enterprise and there would be some Win7 installs mixed in there as well if we move forward with installing throughout Enterprise. Currently just trying to get it working on a micro-scale (just within Security Group). Endpoint agents? Besides SCCM, VMware, McAfee, Our Ticketing System Agent, and a potential Tachyon POC we have no agents to speak of. GPO policy determines local execution policies so how to override this on a mass scale? ![exepolicy](https://us1.discourse-cdn.com/elastic/original/3X/4/0/4002c2fb6f6e644b2f2ff29e1eb8c0eac933be9e.png) ---
**Author:** ![paulc](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@paulc](https://discuss.elastic.co/u/paulc)\ **Post date:** [October 12, 2018, 2:48pm UTC](https://discuss.elastic.co/t/winlogbeat-install-error/151691/5 "2018-10-12T14:48:33Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/e/e/ee2c3479cb7837925033b2376352a98d592dbf30.png) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [October 12, 2018, 11:57pm UTC](https://discuss.elastic.co/t/winlogbeat-install-error/151691/6 "2018-10-12T23:57:49Z")
It looks like you may have pasted or typed more than you wanted into the PowerShell prompt. I see two sets of `PS C:\Program Files\Winlogbeat>` in your screenshot. From the Winlogbeat dir run this in powershell: `.\winlogbeat.exe test config -c .\winlogbeat.yml -e` ---
**Author:** ![paulc](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@paulc](https://discuss.elastic.co/u/paulc)\ **Post date:** [October 16, 2018, 1:25pm UTC](https://discuss.elastic.co/t/winlogbeat-install-error/151691/7 "2018-10-16T13:25:16Z")
> [@andrewkroh](#): > > .\winlogbeat.exe test config -c .\winlogbeat.yml -e ![test](https://us1.discourse-cdn.com/elastic/original/3X/8/6/86ed7041da4357eef6747e8a7fa67346bbaa8872.png) ![dfdf](https://us1.discourse-cdn.com/elastic/original/3X/5/1/51b5a65d94ff9e7b993a1e85c60bbbc3cbf4fc9c.png) ---
**Author:** ![paulc](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@paulc](https://discuss.elastic.co/u/paulc)\ **Post date:** [October 16, 2018, 1:25pm UTC](https://discuss.elastic.co/t/winlogbeat-install-error/151691/8 "2018-10-16T13:25:58Z")
Appears to be an error with the logstash-forwarder.crt? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [October 17, 2018, 8:07pm UTC](https://discuss.elastic.co/t/winlogbeat-install-error/151691/9 "2018-10-17T20:07:08Z")
Use single quotes around your strings so that you don't have to escape the `\` characters in paths. Alternatively you can use `/` instead of `\` in the windows paths and they will get corrected automatically. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 14, 2018, 8:14pm UTC](https://discuss.elastic.co/t/winlogbeat-install-error/151691/10 "2018-11-14T20:14:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.