# Windows host — Grafana Alloy agent

Installs **Grafana Alloy** as a Windows service — the only agent. It collects
metrics (windows_exporter is built in) and the Windows Event Log, and
**pushes** both over HTTPS to the monitoring server. Nothing listens on the
host; it needs only outbound 443.

> Not yet tested end-to-end on a real Windows host (the script is parse-checked).

## Install

On the monitoring server, create the host's one-time enrollment code:

```bash
./host.sh add win-app01
```

Then on the host, in an **elevated** PowerShell ("Run as administrator"), run
the commands it prints:

```powershell
curl.exe -fsSLo install.ps1 https://<INGEST_HOST>/install-windows.ps1
powershell -ExecutionPolicy Bypass -File .\install.ps1 -EnrollCode <code>
```

The installer trades the code for this host's push token (the name comes from
the code), installs Alloy from `https://<INGEST_HOST>/` (checked against
`SHA256SUMS`), writes `C:\Program Files\GrafanaLabs\Alloy\config.alloy` and the
token (`monitor-token` next to it, readable by SYSTEM and Administrators only),
and waits until the server confirms it has received data.

**Upgrade or repair:** run it again **without** `-EnrollCode` — the token is
kept. **Re-enroll / rotate:** `./host.sh add <name>` again, use the new code.

If PowerShell refuses with *"…install.ps1 is not digitally signed"* (a file
downloaded with a browser is tagged as from the internet), run
`Unblock-File .\install.ps1` first; `-ExecutionPolicy Bypass` covers the rest.

## What gets shipped

- **Metrics** every 30 s from the collectors `cpu, cs, logical_disk, memory,
  net, os, service, system`, labelled `job="windows"`, `instance="<name>"`.
  Service series are trimmed to running/stopped and auto-start. Buffered on
  disk while the server is unreachable.
- **Logs:** the **Application** and **System** Event Log channels (Security is
  available in `config.alloy.template` but commented out — it's high-volume),
  labelled `host="<name>"`.

Covered by `prometheus/alerts/windows.rules.yml` plus `HostNotReporting`, and
the **Hosts Overview** / **Host Details** / **Windows Hosts** dashboards.

## Moving from the old agent

Hosts installed earlier ran `windows_exporter` (scraped on `:9182`). Alloy
replaces it; the installer warns if it is still present. Remove it via *Apps &
features* and delete the `windows_exporter (Prometheus)` firewall rule.

## Uninstall

```powershell
& "$env:ProgramFiles\GrafanaLabs\Alloy\uninstaller.exe" /S
Remove-Item "$env:ProgramFiles\GrafanaLabs\Alloy\monitor-token" -ErrorAction SilentlyContinue
```

Then on the server: `./host.sh remove <name>` (otherwise it alerts as not
reporting).