How to Set Up SolarWinds Monitoring Agent on Windows Server 2022

Introduction to SolarWinds Monitoring on Windows Server 2022

SolarWinds is one of the most widely deployed network and systems monitoring platforms in enterprise environments. Two primary SolarWinds products apply to Windows Server 2022 monitoring: SolarWinds Server & Application Monitor (SAM), which is part of the SolarWinds Orion platform and focuses on server and application performance, and SolarWinds N-central (now N-able), which is a managed services platform for MSPs and IT departments managing large fleets of endpoints. This guide focuses primarily on the SolarWinds Orion platform with the SolarWinds agent, as it is the most common enterprise deployment, while also covering N-central agent concepts where they differ.

The SolarWinds Orion agent for Windows enables agentless-quality monitoring without requiring SNMP or WMI firewall rules to be open between the Orion server and every monitored endpoint. With an agent installed on Windows Server 2022, SolarWinds can collect detailed performance metrics, monitor Windows services, track IIS and SQL Server application health, and deliver alerts — all over a single encrypted connection from the agent to the Orion server.

SolarWinds Agent vs WMI vs SNMP: Choosing the Right Method

Before deploying the SolarWinds agent, it is important to understand the three primary monitoring methods and when each is appropriate:

WMI (Windows Management Instrumentation): Agentless monitoring that queries the Windows WMI subsystem remotely over DCOM/RPC. It requires TCP port 135 plus dynamic high ports, DCOM permissions, and a service account with remote WMI access. WMI monitoring is suitable for small environments where firewall changes are manageable. However, WMI can be unreliable over high-latency or high-packet-loss connections, and WMI failures are difficult to diagnose remotely. WMI polling creates periodic high-CPU spikes on heavily loaded servers.

SNMP (Simple Network Management Protocol): Industry-standard protocol for network device and server monitoring. SNMP v2c and v3 are supported by Windows Server 2022 via the SNMP Service feature. SNMP provides basic system metrics (CPU, memory, disk, network interfaces) through standardized OIDs, but does not support Windows-specific monitoring like service state checks, IIS application pool health, or event log monitoring without custom SNMP extensions. SNMP v2c uses community strings for authentication (insecure); SNMP v3 adds encryption and authentication.

SolarWinds Agent: A lightweight Windows service that runs on the monitored server and pushes data to the Orion server over a single outbound TCP connection (typically port 17778 or 443). The agent approach is preferred when: firewalls between Orion and monitored servers make WMI/SNMP impractical; servers are in DMZs or remote sites with limited connectivity; detailed application monitoring is required; or you want to reduce polling load on the Orion server. The agent supports all WMI-based templates plus additional agent-only capabilities.

Downloading the SolarWinds Agent

The SolarWinds agent installer is available through your Orion web console. Navigate to:

Orion Web Console > Settings > Manage Agents > Deploy Agent

Click Download Agent Software and select the Windows x64 MSI installer. The installer is version-matched to your Orion platform version — do not mix agent versions across major Orion releases as this can cause incompatibility issues.

Alternatively, the agent can be downloaded directly via the Orion API if you need to automate deployment across many servers:

# Download agent MSI from Orion server using PowerShell
$OrionServer = "orion.contoso.com"
$AgentInstallerUrl = "https://$OrionServer/Orion/AgentManagement/AgentManagement.asmx"
# Use the Orion REST API to get the current agent package URL:
Invoke-WebRequest -Uri "https://$OrionServer/api/v1/agents/agentpackages?platform=Windows" `
    -Headers @{Authorization = "Bearer $OrionApiToken"} `
    -OutFile "C:TempSolarWindsAgent.msi"

For N-central deployments, the agent installer (N-central Agent MSI) is downloaded from the N-central web console under Configuration > Agent/Probe > Download Agent, and includes the server address baked into the installer during download.

Silent Agent Installation

The SolarWinds Orion agent MSI supports silent installation with parameters passed on the command line. This enables deployment via Group Policy, SCCM, Ansible, or manual scripting. Run the following command as Administrator:

msiexec.exe /i SolarWindsAgent.msi /quiet /norestart `
    ORIONSERVER="orion.contoso.com" `
    SERVERPORT="17778" `
    ENABLESSL="1" `
    WRITEFILE="1" `
    TOKEN="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

Parameters explanation:

ORIONSERVER: The hostname or IP address of your SolarWinds Orion server.

SERVERPORT: The port used for agent-to-server communication. Default is 17778 for direct agent connections. Some environments use 443 to avoid firewall restrictions.

ENABLESSL: Set to 1 to enable TLS encryption for agent communication (strongly recommended for production).

TOKEN: The registration token from the Orion console. Generate a token at Settings > Manage Agents > Add Agent. The token authorizes the new agent to register with the Orion server without manual approval.

For PowerShell-based deployment across multiple servers:

$Servers = @("WS2022-APP01", "WS2022-DB01", "WS2022-WEB01")
$InstallerPath = "\fileserversoftwareSolarWindsAgent.msi"
$Token = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
$OrionServer = "orion.contoso.com"

foreach ($Server in $Servers) {
    Write-Host "Installing agent on $Server..."
    Invoke-Command -ComputerName $Server -ScriptBlock {
        param($Installer, $Orion, $Tok)
        Start-Process msiexec.exe -ArgumentList `
            "/i `"$Installer`" /quiet /norestart ORIONSERVER=`"$Orion`" TOKEN=`"$Tok`" ENABLESSL=1" `
            -Wait -PassThru
    } -ArgumentList $InstallerPath, $OrionServer, $Token
}

Verifying Agent Installation and Service Status

After installation, the SolarWinds agent runs as a Windows service. Verify the service is running:

Get-Service -Name "SolarWinds Agent" | Select-Object Name, Status, StartType

The agent service should show Status: Running and StartType: Automatic. If the service failed to start, check the agent log files at:

Get-Content "C:ProgramDataSolarWindsAgentLogsagent.log" -Tail 50

In the Orion web console, newly registered agents appear in Settings > Manage Agents. The agent status should transition from Unknown to Online within a few minutes of installation. If the agent does not appear, verify network connectivity from the server to the Orion server on port 17778:

Test-NetConnection -ComputerName orion.contoso.com -Port 17778

Assigning the Agent to a Node in Orion

Once the agent registers, associate it with a monitored node (or add a new node using the agent as the polling method). In the Orion web console:

1. Navigate to Settings > Manage Nodes > Add Node.

2. Select Agent as the polling method.

3. Choose the registered agent from the list of available agents.

4. Orion will discover the node properties (hostname, OS, IP) automatically from the agent.

5. Select the monitoring templates to apply (see the next section).

Alternatively, you can assign an existing unmonitored agent to a new node via the Orion REST API:

$Body = @{
    AgentId = "agent-guid-here"
    NodeName = "WS2022-APP01.contoso.com"
    IPAddress = "10.0.1.50"
} | ConvertTo-Json

Invoke-RestMethod -Uri "https://orion.contoso.com/api/v1/nodes" `
    -Method POST -Body $Body -ContentType "application/json" `
    -Headers @{Authorization = "Bearer $OrionApiToken"}

Applying Windows Monitoring Templates in SolarWinds

SolarWinds SAM includes a library of pre-built monitoring templates for Windows Server. Key templates to apply to Windows Server 2022 nodes include:

Windows CPU, Memory, and Disk Performance: These templates use the agent or WMI to collect CPU utilization percentage, memory used/available (physical and virtual), and per-volume disk usage and free space. Thresholds are typically set at Warning=80%, Critical=90% for CPU and disk.

Windows Services Monitor: Monitors the state of specified Windows services and alerts when a service enters a stopped state. Configure this template with a list of critical services: W32Time, DNS, NTDS (on domain controllers), W3SVC (IIS), MSSQLSERVER (SQL Server), and others relevant to the server’s role.

Windows Event Log Monitor: Watches the System and Application event logs for error events and forwards matching entries to Orion alerts. Configure filters for critical event IDs such as 41 (unexpected shutdown), 6008 (unexpected reboot), and application-specific error events.

To apply templates from the Orion web console: navigate to the node, click Edit Node, select SAM Component Monitors, and add templates from the Application Monitor Template Library.

IIS and SQL Server Application Monitors

IIS Application Monitor: The SolarWinds IIS Application Monitor template checks IIS service status, monitors application pool state, tracks active connections, and measures request rate and failed request counts. It can also perform synthetic HTTP health checks by sending GET requests to monitored URLs and verifying response codes and content.

After applying the IIS template, configure the HTTP health check component with the URL of your application:

Navigate to Node > SAM Application Monitor > IIS Monitor > Edit Component > URL to Monitor and enter the application health check URL (e.g., http://localhost/health).

SQL Server Application Monitor: The SQL Server monitor in SolarWinds SAM connects to SQL Server using a monitoring service account and tracks: SQL Server service state, active connections count, database size and free space, SQL Server buffer cache hit ratio, batch requests per second, and failed jobs in SQL Server Agent. The monitoring account requires at minimum VIEW SERVER STATE and VIEW DATABASE STATE permissions:

-- Run on SQL Server to create monitoring account
CREATE LOGIN [solarwinds_monitor] WITH PASSWORD = 'StrongP@ssw0rd!';
CREATE USER [solarwinds_monitor] FOR LOGIN [solarwinds_monitor];
GRANT VIEW SERVER STATE TO [solarwinds_monitor];
GRANT VIEW DATABASE STATE TO [solarwinds_monitor];
-- For SQL Agent job monitoring:
EXEC sp_addrolemember 'SQLAgentReaderRole', 'solarwinds_monitor';

Configuring Alerts in SolarWinds

SolarWinds alerts are configured in Alerts & Activity > Manage Alerts. Key alert conditions to configure for Windows Server 2022 nodes include:

CPU utilization above 90% for more than 5 minutes, memory utilization above 90%, disk free space below 10%, any monitored service entering a stopped state, and node availability dropping to unreachable. Each alert should have a reset condition (e.g., CPU drops below 80%) to prevent alert storms.

Alert actions typically include: sending an email to the on-call distribution list, creating a ServiceNow or JIRA ticket via webhook, and logging the alert to Orion’s alert database for reporting. Configure alert escalation so that if an alert is not acknowledged within 30 minutes, it triggers a second notification to senior staff.

Troubleshooting Agent Connectivity

If an agent shows as offline in Orion, work through the following diagnostic steps:

1. Verify the agent service is running:

Get-Service "SolarWinds Agent" | Select-Object Status

2. Test connectivity to the Orion server:

Test-NetConnection -ComputerName orion.contoso.com -Port 17778

3. Check Windows Firewall rules:

Get-NetFirewallRule | Where-Object { $_.DisplayName -like "*SolarWinds*" } |
    Select-Object DisplayName, Enabled, Direction, Action

4. Review agent logs for connection errors:

Get-Content "C:ProgramDataSolarWindsAgentLogsagent.log" -Tail 100 |
    Where-Object { $_ -match "ERROR|WARN|failed|connect" }

5. Re-register the agent if the registration token has expired:

& "C:Program Files (x86)SolarWindsAgentSolarWindsAgent.exe" `
    --register --server orion.contoso.com --port 17778 --token NEW_TOKEN_HERE

If none of these steps resolve the issue, check whether a proxy is required for outbound connections from the server to the Orion server, and configure it in the agent configuration file at C:ProgramDataSolarWindsAgentAgentConfig.xml.

Conclusion

Deploying the SolarWinds agent on Windows Server 2022 provides a robust, firewall-friendly monitoring solution that outperforms WMI and SNMP for detailed server and application monitoring. Silent MSI installation enables mass deployment through existing software distribution infrastructure, and SolarWinds’ extensive library of application monitor templates means you get meaningful visibility into IIS, SQL Server, Windows Services, and event logs with minimal configuration. Combine well-tuned alert thresholds with proper escalation paths to ensure your monitoring solution actively informs operations rather than generating noise.