How to Configure Nagios NRPE Agent on Windows Server 2012 R2

Nagios is one of the oldest and most widely deployed open-source infrastructure monitoring systems, and many organizations continue to rely on it for service and host monitoring. While Nagios traditionally monitored Windows servers via the NSClient++ agent, the NRPE (Nagios Remote Plugin Executor) protocol can also be used on Windows through NSClient++ which supports NRPE as a transport mechanism, enabling the same Nagios check commands used on Linux servers to also work against Windows targets. This guide covers installing NSClient++ (the standard Nagios agent for Windows), configuring it for NRPE-compatible communication, setting up service checks, testing from a Nagios server, and configuring Windows-specific health checks.

Prerequisites

  • Windows Server 2012 R2 with administrator access
  • A Nagios Core or Nagios XI monitoring server with check_nrpe plugin installed
  • Network connectivity between Nagios server and Windows target on TCP port 5666 (NRPE)
  • PowerShell 4.0

Step 1: Download NSClient++

NSClient++ (NSCP) is the official Nagios agent for Windows. It supports multiple protocols including NRPE, NSCA, check_mk, and a built-in REST API, making it compatible with Nagios, Icinga, Zabbix, and other monitoring systems. Download the latest 64-bit MSI:

$NSCPVersion = "0.6.3.938"
$NSCPUrl = "https://github.com/mickem/nscp/releases/download/$NSCPVersion/NSCP-${NSCPVersion}-x64.msi"

New-Item -ItemType Directory -Path "C:Temp" -Force
Invoke-WebRequest -Uri $NSCPUrl -OutFile "C:TempNSClient.msi"

Step 2: Install NSClient++ Silently

Install NSClient++ with a basic configuration passed as MSI properties. Define the Nagios server IP that is allowed to query the agent:

$NagiosServerIP = "192.168.1.10"  # Replace with your Nagios server IP
$NSCPPassword = "NagiosMonitor2024!"

Start-Process -FilePath "msiexec.exe" -ArgumentList `
    "/i `"C:TempNSClient.msi`"",
    "/quiet /norestart",
    "ADDLOCAL=ALL",
    "CONF_NRPESERVER=1",
    "CONF_NSCASERVER=0",
    "CONF_WEB=0",
    "CONF_CHECKS=1",
    "CONF_EVENTLOG=1",
    "CONF_NSCA=0",
    "CONF_SCHEDULER=1",
    "NRPEMODE=LEGACY",
    "ALLOWED_HOSTS=$NagiosServerIP",
    "CONF_PORT=5666",
    "PASSWORD=$NSCPPassword" `
    -Wait -PassThru

Write-Host "NSClient++ installed"
Get-Service nscp | Select-Object Name, Status, StartType

Step 3: Configure NSClient++ INI File

NSClient++ is primarily configured via the nsclient.ini file located at C:Program FilesNSClient++nsclient.ini. Replace the default configuration with a production-ready configuration:

$NSCPConfig = @"
; NSClient++ configuration for Windows Server 2012 R2
; Nagios/NRPE monitoring

[/settings/default]
allowed hosts = 127.0.0.1, $NagiosServerIP
password = $NSCPPassword
timeout = 30

[/settings/NRPE/server]
verify mode = none
insecure = true
allow arguments = true
allow nasty characters = false
port = 5666

[/modules]
NRPEServer = enabled
CheckSystem = enabled
CheckDisk = enabled
CheckEventLog = enabled
CheckHelpers = enabled
CheckExternalScripts = enabled
CheckNSCP = enabled
Scheduler = enabled
NSCPClient = disabled

[/settings/external scripts/scripts]
check_cpu_usage    = cmd /c echo scriptscheck_cpu.bat; exit
check_iis_status   = cmd /c sc query W3SVC | find "RUNNING" && exit 0 || exit 2
check_disk_c       = CheckDisk CheckAll "MinWarn=10%" "MinCrit=5%"
check_mem          = CheckMem MaxWarn=80% MaxCrit=90%
check_uptime       = CheckSystem CheckUptime MinWarn=1d

[/settings/system/windows/counters/]
disk_queue = PhysicalDisk(_Total)Current Disk Queue Length
cpu_queue  = SystemProcessor Queue Length

[/settings/log]
level = info
file = C:Tempnsclient.log
"@

Set-Content -Path "C:Program FilesNSClient++nsclient.ini" -Value $NSCPConfig -Encoding UTF8

Restart-Service nscp
Write-Host "NSClient++ configured and restarted"

Step 4: Open Firewall Rule for NRPE

New-NetFirewallRule `
    -DisplayName "Nagios NRPE Agent (5666)" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 5666 `
    -Action Allow `
    -RemoteAddress $NagiosServerIP

Write-Host "NRPE firewall rule created"

Step 5: Test the NRPE Connection from Nagios Server

On your Nagios/Linux server, test the NRPE connection using check_nrpe:

/usr/lib/nagios/plugins/check_nrpe -H ws2012r2-server.domain.local -p 5666 -c CheckVersion
# Expected: I (0.6.3.938 2024-...) seem to be doing fine...

/usr/lib/nagios/plugins/check_nrpe -H ws2012r2-server.domain.local -p 5666 -c CheckCPU -a "warn=80" "crit=95" "time=5m" "time=1m" "time=30s"
/usr/lib/nagios/plugins/check_nrpe -H ws2012r2-server.domain.local -p 5666 -c CheckMem -a "type=physical" "MaxWarn=80%" "MaxCrit=90%"
/usr/lib/nagios/plugins/check_nrpe -H ws2012r2-server.domain.local -p 5666 -c CheckDisk -a "CheckAll" "MinWarn=15%" "MinCrit=10%"

Step 6: Configure Custom Windows Service Checks

Add custom checks to monitor specific Windows services critical to your environment. Edit the nsclient.ini external scripts section:

$ExtraChecks = @"

[/settings/external scripts/wrapped scripts]
check_service_w3svc    = CheckServiceState W3SVC
check_service_mssql    = CheckServiceState MSSQLSERVER
check_service_winrm    = CheckServiceState WinRM
check_service_wuauserv = CheckServiceState wuauserv

[/settings/external scripts/scripts/check_iis_sites]
script = cmd /c echo ok && exit 0

"@

Add-Content -Path "C:Program FilesNSClient++nsclient.ini" -Value $ExtraChecks
Restart-Service nscp

Step 7: Configure the Nagios Server to Monitor WS2012 R2

On the Nagios server, create a host and service configuration file for the Windows Server:

; /etc/nagios/conf.d/winserver01.cfg

define host {
    use                     windows-server
    host_name               winserver01
    alias                   Windows Server 2012 R2 - Web Server
    address                 192.168.1.20
    hostgroups              windows-servers, web-servers
}

define service {
    use                     generic-service
    host_name               winserver01
    service_description     CPU Load
    check_command           check_nrpe!CheckCPU -a "warn=80" "crit=95" "time=5m" "time=1m"
    check_interval          5
    retry_interval          1
    max_check_attempts      3
}

define service {
    use                     generic-service
    host_name               winserver01
    service_description     Memory Usage
    check_command           check_nrpe!CheckMem -a "type=physical" "MaxWarn=80%" "MaxCrit=90%"
}

define service {
    use                     generic-service
    host_name               winserver01
    service_description     Disk Space C
    check_command           check_nrpe!CheckDisk -a "CheckAll" "MinWarn=15%" "MinCrit=10%"
}

define service {
    use                     generic-service
    host_name               winserver01
    service_description     IIS Web Service
    check_command           check_nrpe!check_service_w3svc
}

define service {
    use                     generic-service
    host_name               winserver01
    service_description     Windows Uptime
    check_command           check_nrpe!CheckSystem -a CheckUptime MinWarn=1d
}

Reload Nagios to apply the configuration:

nagios -v /etc/nagios/nagios.cfg
systemctl reload nagios

Step 8: Set Up Event Log Monitoring

Configure NSClient++ to alert on specific Windows Event Log events:

$EventLogConfig = @"

[/settings/eventlog]
buffer size = 1024
debug = false

[/settings/eventlog/real-time]
enabled = false

"@

Add-Content -Path "C:Program FilesNSClient++nsclient.ini" -Value $EventLogConfig

Test Event Log checks from the Nagios server:

/usr/lib/nagios/plugins/check_nrpe -H ws2012r2-server -p 5666 -c CheckEventLog `
    -a "log=Application" "MaxWarn=1" "MaxCrit=2" "filter=level in ('error','warning')" "scan-range=-10m"

Step 9: Verify Agent Status

Get-Service nscp | Select-Object Name, Status, StartType
netstat -ano | findstr ":5666"

# Local test of NRPE from the Windows server itself
& "C:Program FilesNSClient++nscp.exe" nrpe --query CheckCPU --argument "warn=80" "crit=95" "time=5m"

Summary

NSClient++ is now installed and configured on Windows Server 2012 R2 as a Nagios-compatible NRPE agent, providing comprehensive monitoring coverage including CPU utilization, memory usage, disk space across all volumes, Windows service status for critical services (IIS, SQL Server, WinRM), Event Log error alerting, and system uptime. The Nagios server configuration integrates the Windows host into the monitoring dashboard alongside Linux and other infrastructure targets, with standard NRPE check commands that follow the same OK/WARNING/CRITICAL status model used across the entire Nagios monitoring ecosystem. Alert thresholds are fully customizable to match your environment’s SLA requirements.