How to Set Up SolarWinds Monitoring Agent on Windows Server 2025

SolarWinds offers two primary agent-based monitoring paths for Windows Server environments: N-central / N-able RMM for managed service provider workflows, and SolarWinds Orion / Server & Application Monitor (SAM) for enterprise network and application monitoring. Both rely on lightweight agents installed directly on monitored servers, communicating back to a central management platform over encrypted channels. On Windows Server 2025, the agent installation process is straightforward, but properly configuring monitoring probes — CPU, disk, service health, event log rules — and setting up automated remediation tasks separates a reactive monitoring setup from a proactive one. This guide covers downloading and installing the SolarWinds agent, joining servers to a monitoring site, deploying probes, and configuring threshold-based alerts and automated remediation.

Prerequisites

A SolarWinds N-central, N-able RMM, or Orion NPM / SAM deployment (on-premises or SaaS)
Windows Server 2025 target server with outbound connectivity to the SolarWinds management platform
Firewall rules allowing outbound TCP 443 and 444 from the agent to the N-central server (or TCP 17778 for Orion agents)
Local Administrator rights on the target server for agent installation
PowerShell 5.1 or later (included in Windows Server 2025)
The agent MSI or installer EXE downloaded from your SolarWinds management portal

Step 1: Download the SolarWinds Agent Installer

Agent installers are generated from your management portal and are pre-configured with your server’s address and site token. For N-central, log into the web console, navigate to Administration → Agents & Probes → Agent Installers, select the target customer/site, and download the Windows agent MSI.

You can also download and stage the installer using PowerShell if your portal provides a direct download URL:

# Example: Download N-central agent MSI from your management server
# Replace the URL with your actual N-central agent download URL
$AgentUrl = "https://ncentral.contoso.com/download/current/solarwinds-agent-windows.msi"
$InstallerPath = "C:TempSolarWinds-Agent.msi"

if (-not (Test-Path "C:Temp")) { New-Item -ItemType Directory -Path "C:Temp" | Out-Null }

# Download with certificate validation (ensure TLS 1.2+)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile($AgentUrl, $InstallerPath)

Write-Output "Agent installer downloaded to: $InstallerPath"
Get-Item $InstallerPath | Select-Object Name, Length, LastWriteTime

Step 2: Install the Agent Silently

Install the agent using msiexec in quiet mode. The MSI pre-embedded from your portal already contains your server address and activation token, so no additional parameters are required for standard deployments:

# Silent installation — the MSI includes server address and site token
$InstallArgs = @(
    "/i", "C:TempSolarWinds-Agent.msi",
    "/quiet",
    "/norestart",
    "/log", "C:TempSolarWinds-Agent-Install.log"
)

$InstallProcess = Start-Process -FilePath "msiexec.exe" `
    -ArgumentList $InstallArgs `
    -Wait -PassThru

if ($InstallProcess.ExitCode -eq 0) {
    Write-Output "SolarWinds agent installed successfully."
} else {
    Write-Error "Agent installation failed. Exit code: $($InstallProcess.ExitCode)"
    Write-Output "See log: C:TempSolarWinds-Agent-Install.log"
    exit 1
}

# For N-central deployments that require explicit server targeting,
# pass server address and customer token as MSI properties:
$CustomInstallArgs = @(
    "/i", "C:TempSolarWinds-Agent.msi",
    "/quiet", "/norestart",
    "SERVERADDRESS=ncentral.contoso.com",
    "CUSTOMERID=12345",
    "REGISTRATIONTOKEN=AbCdEf1234567890",
    "/log", "C:TempSolarWinds-Agent-Install.log"
)

After installation, verify the SolarWinds Agent Windows Service is running:

# Check agent service status
Get-Service -Name "SolarWinds.MSP.Agent*", "Windows Agent Service*", "SolarWinds Agent*" |
    Select-Object Name, Status, StartType

# Confirm agent process is communicating
Get-NetTCPConnection -State Established |
    Where-Object { $_.RemotePort -in @(443, 444, 17778) } |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State

Step 3: Join the Device to the Monitoring Site

In the N-central or Orion web console, the newly installed agent should appear in the device discovery queue within a few minutes. In N-central:

Navigate to All Devices → Import Devices
Find your server by hostname or IP address in the pending list
Assign it to the appropriate customer and site
Select a device class (Windows Server) to apply the default monitoring template
Click Import

For Orion NPM / SAM, add the node through Settings → Manage Nodes → Add Node, selecting Agent as the polling method and entering the server’s hostname.

Step 4: Deploy Monitoring Probes and Checks

Once the device is registered, deploy monitoring probes. In N-central, probes are deployed through service templates; the following PowerShell shows how to verify probe-relevant data locally to confirm what the agent will report:

# --- CPU utilization (sampled over 60 seconds) ------------------------------
$CpuSamples = 1..6 | ForEach-Object {
    (Get-CimInstance -ClassName Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average
    Start-Sleep -Seconds 10
}
$AvgCpu = ($CpuSamples | Measure-Object -Average).Average
Write-Output "Average CPU (60s): $([math]::Round($AvgCpu, 1))%"

# --- Disk space for all fixed drives ----------------------------------------
Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Used -gt 0 } |
    Select-Object Name,
        @{N="SizeGB";     E={[math]::Round(($_.Used + $_.Free)/1GB, 1)}},
        @{N="FreeGB";     E={[math]::Round($_.Free/1GB, 1)}},
        @{N="UsedPct";    E={[math]::Round($_.Used/($_.Used+$_.Free)*100, 1)}}

# --- Windows services status ------------------------------------------------
# List services that are configured to start automatically but are stopped
Get-Service | Where-Object {
    $_.StartType -eq "Automatic" -and $_.Status -ne "Running"
} | Select-Object Name, DisplayName, Status

# --- Event log error/warning check (last 24 hours) --------------------------
$Since = (Get-Date).AddHours(-24)
Get-WinEvent -FilterHashtable @{ LogName="System","Application"; Level=1,2; StartTime=$Since } |
    Group-Object Id | Sort-Object Count -Descending | Select-Object Count, Name -First 20

In the SolarWinds N-central console, configure service monitoring checks under Device → Properties → Services. Add checks for critical services such as DNS Server, W32Time, LanmanServer, and any application-specific services. Set alert thresholds for CPU (warn at 80%, critical at 95%) and disk (warn at 85%, critical at 95%).

Step 5: Configure Automated Remediation Tasks

N-central supports automated remediation — when a monitoring check fails, a script runs automatically to attempt recovery. Configure a remediation task that restarts a stopped service:

# This script is uploaded to N-central as an Automation Policy script
# It runs when a service monitoring check triggers a "Failed" alert
param(
    [Parameter(Mandatory)][string]$ServiceName
)

$Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue

if ($null -eq $Service) {
    Write-Output "SERVICE_NOT_FOUND: $ServiceName"
    exit 2
}

if ($Service.Status -eq "Running") {
    Write-Output "SERVICE_ALREADY_RUNNING: $ServiceName — no action taken"
    exit 0
}

Write-Output "Attempting to start service: $ServiceName (current status: $($Service.Status))"

try {
    Start-Service -Name $ServiceName -ErrorAction Stop
    Start-Sleep -Seconds 5

    $Service.Refresh()
    if ($Service.Status -eq "Running") {
        Write-Output "SERVICE_RESTARTED_OK: $ServiceName"
        exit 0
    } else {
        Write-Output "SERVICE_START_FAILED: $ServiceName — status is $($Service.Status)"
        exit 1
    }
} catch {
    Write-Output "SERVICE_ERROR: $_"
    exit 1
}

Upload this script in N-central under Configuration → Scripting → Automation Policies. Link it to a service monitoring check by editing the check, navigating to the Failure Response tab, and selecting your automation policy with $ServiceName set to the service being monitored.

Step 6: Configure SolarWinds SAM for IIS and SQL Server Monitoring

SolarWinds SAM (Server & Application Monitor) includes pre-built component monitors for IIS and SQL Server. Apply the templates in Orion → SAM → Application Monitor → Assign Application Monitor:

# Verify IIS is responding locally before configuring SAM
$IISStatus = Invoke-WebRequest -Uri "http://localhost/" -UseBasicParsing -TimeoutSec 10
Write-Output "IIS HTTP Status: $($IISStatus.StatusCode)"

# Check SQL Server connectivity for SAM component monitors
$SqlQuery = "SELECT @@VERSION AS SqlVersion, @@SERVERNAME AS ServerName"
Invoke-Sqlcmd -ServerInstance "localhost" -Query $SqlQuery -TrustServerCertificate |
    Select-Object ServerName, @{N="Version"; E={$_.SqlVersion.Split("`n")[0]}}

# Check SQL Server Agent job status (SAM monitors this)
Invoke-Sqlcmd -ServerInstance "localhost" -TrustServerCertificate -Query @"
SELECT job_name, run_status,
       CONVERT(varchar,run_date) + ' ' + CONVERT(varchar,run_time) AS LastRun
FROM sysjobs_view
ORDER BY run_date DESC, run_time DESC
"@

Step 7: Configure Threshold-Based Alerts and Email Delivery

In the N-central or Orion console, configure alert thresholds and email notification rules under Administration → Alert Manager → Alert Rules. To test that alerting is working correctly from the server side, trigger a test condition:

# Simulate high CPU to test CPU threshold alert (run for ~2 minutes)
# WARNING: This will spike CPU — run only on a non-production server for testing
$TestJob = Start-Job -ScriptBlock {
    $End = (Get-Date).AddMinutes(2)
    while ((Get-Date) -lt $End) { [math]::Sqrt([System.Double]::MaxValue) | Out-Null }
}
Write-Output "CPU load test running as background job ID: $($TestJob.Id)"
Write-Output "Monitor your N-central/Orion dashboard for the CPU alert."
# Stop the test after verifying alert fired:
# Stop-Job -Id $TestJob.Id; Remove-Job -Id $TestJob.Id

# Verify email alert delivery by checking mail relay logs or your inbox
# Check agent connectivity to management platform
Test-NetConnection -ComputerName "ncentral.contoso.com" -Port 443 | 
    Select-Object ComputerName, RemotePort, TcpTestSucceeded

Conclusion

Deploying the SolarWinds monitoring agent on Windows Server 2025 establishes a foundation for comprehensive, agent-based infrastructure visibility. From the silent MSI installation through probe deployment, automated remediation, and SAM application monitors, each layer adds operational intelligence that reduces mean time to detect and mean time to respond for service disruptions. By configuring threshold-based alerts with email delivery and automated service restart remediation, your monitoring platform moves from passive observation to active infrastructure management. Test your alert thresholds regularly, keep agent software updated through the N-central patch management workflow, and review remediation task logs to confirm automated actions are resolving — rather than masking — underlying issues.

How to Set Up SolarWinds Monitoring Agent on Windows Server 2025