Knowledge Base
ConfigSentry

Windows Collector

Install and manage collectors on a Windows computer.

System Requirements

  • Windows 10 or 11, or Windows Server 2019 or later, with administrator permission to install services.
  • The Windows MSI and this collector's private Config JSON from the website.
  • Outbound HTTPS to https://www.secdit.com/configsentry/ and access to each appliance's SSH port.
  • SSH credentials with enough read access to retrieve the configuration. Use the lowest practical privilege.
  • If using syslog triggers, permit only the configured inbound UDP port through Windows Firewall.

How to install it

  1. On the website, create a collector and open Appliances → Collectors. Download its Windows MSI installer and private Collector Config JSON.
  2. Run the MSI as an administrator. Select that JSON when prompted, choose the installation folder, and finish setup.
  3. Open Configure ConfigSentry Collectors from the Start menu and confirm the instance appears. Check its Windows Service is running, then verify check-in and a first audit on the website.

The MSI installs the shared runtime and creates this collector's service. By default, instance data is under C:\ProgramData\Secdit\ConfigSentry. Keep the JSON private; never disable publisher or SmartScreen protections merely to install.

Management app options

Open Configure ConfigSentry Collectors from the Start menu. Select the collector you want to manage. Each collector has its own Windows Service; Windows Services can check or restart it.

Add new...

Import another collector's private Config JSON. The shared runtime stays in place; the new instance receives its own service and local data.

Configure...

Edit locally managed appliance host and SSH settings, credentials, and syslog settings for the selected collector.

Delete...

Remove the selected collector from this computer after confirmation. Other local collectors and the shared runtime remain.

Check for updates

Check for an approved signed runtime update for the selected collector and confirm installation if one is available.

Refresh and About

Refresh reloads the installed-collector list; About shows application information.

The customer path is the MSI and this graphical app; no command-line parameters are required for normal installation or management.

How to add a collector config file

Create the additional collector on the website and download its own Config JSON. In Configure ConfigSentry Collectors, choose Add new... and select that file. The new instance has its own identity and service but shares the installed runtime. Do not reuse another collector's JSON.

Configure an appliance and syslog

  1. Assign the appliance to the collector on the website. Open Configure... for that collector and fill in any host or SSH values marked Enter Locally.
  2. Check the collector's service, website check-in, and first audit. If credentials were added after the first attempt, request a Manual Audit.
  3. For config-change triggers, enable syslog on the website, check this collector's listen address and UDP port in Configure..., and permit that port through Windows Firewall. Point the FortiGate at the collector's address.

The default listen port is 2216/UDP, unless configured otherwise. See the FortiGate syslog guide for the appliance-side filter.

How to update it

When automatic updates are enabled, the collector checks for approved runtime and configuration changes. If disabled, use the management app to check for an update. For a manual MSI upgrade, download the current MSI from the website and run it over the existing installation; the current shared-runtime installer preserves existing collector instances. Check service health and website check-in afterwards.

How to remove a collector config

In Configure ConfigSentry Collectors, select that instance and choose Delete. Confirm the removal. This removes that collector's local service and files, but leaves the shared runtime and other collectors in place. The website record remains and must be deleted separately if no longer needed.

How to completely uninstall it

When you no longer need any collectors on this computer, uninstall Secdit ConfigSentry Collector from Windows Installed Apps. This removes the shared runtime and local collector instances. Save any Config JSON or local settings you need first. Do not manually delete shared folders while collectors remain; review any firewall rules you created separately.

Troubleshooting

  • No collector in the app: check that the MSI used the intended Config JSON; use Add new... if the MSI is already installed.
  • No check-in: verify its Windows Service is running and outbound HTTPS is available.
  • No first audit: review appliance assignment and local SSH settings, then request a Manual Audit.
  • No syslog events: check the listener address and UDP port, then permit only the required inbound traffic. See the Syslog Guide.
Back to Knowledge Base Linux Collector FreeBSD Collector