Enabling SNMP access to a Windows server is an easy procedure, but not an obvious one. Here is a step-by-step guide to enable SNMP v2 on Windows Server 2019. The procedure is the same for all versions from 2008 R2 through 2022
If this is your first time dealing with SNMP on Windows Server, I would recommend using version 2 and enabling only a “read-only community”. You don’t need more to safely monitor your server without risking misconfiguration of critical settings.
Before installing, please read the best practice recommendations for configuring SNMP service in Windows Server:
- Create complex community strings that would be difficult to guess. For v1/v2, ensure community strings have at least 12 characters mixing letters, numbers and special characters.
- Avoid using the default community strings like “public” or “private”. These are well known and make SNMP vulnerable.
- Follow the principle of least privilege. Only enable the absolute minimum level of SNMP access needed for functionality. Limit information that is exposed. For example, if your purpose is only to monitor your server, and nothing else, create a “Read Only” Community.
- Use access control lists to restrict which IP addresses can query SNMP data from the Windows server. Limit it only to infrastructure that needs to actively monitor the server. Only allow your monitoring servers to connect on UDP ports 161 and 162.
- On sensitive data scenarios, enable all authentication/privacy settings if using SNMP v3. Require user accounts with passwords to read data. Configure encryption for added security.
- Configure SNMP server settings using Group Policy in larger deployments with Active Directory for easier administration and consistency.
- Continuously audit and review users, community strings, and access controls on the SNMP server for unauthorized changes.
Following these best practices helps secure SNMP, while still allowing remote infrastructure to monitor critical Windows Server performance and availability metrics.
Step 1: Click on “Add roles and features”
If closed, Open the Server Manager program from the Windows Menu. On the “Quick Start” panel, select “2 – Add roles and features.
On the “Before you begin”, select the “Installation Type” from the left side menu. The panel warns you about general precautions concerning adding roles or modifying the set of features. But sure to comply: Have a strong Administrator password, make sure IP settings are set for your network interface and make sure Windows Server has been updated recently.
Step 2: Select Role-based or feature-based installation
On the “Select installation Type” panel, choose “Role-based or feature-based installation”. This will add new service or feature to the server, as opposed to adding a role based on the Virtual Desktop Infrastructure (Remote Desktop).
Step 3: Select Server
Select the server where SNMP is to be enabled. This would usually be the local server.
Step 4: Select Server Roles
Select “Server Roles”. A list of all available and enabled roles will be displayed.
Step 5: Select SNMP service
Select “SNMP Service” and the sub-item “SNMP WMI Provider”. This will enable the SNMP service, and install the required WMI extensions to interact with this service thru scripts and applications that implement the WMI libraries ann protocols. When done, click on the “Next” button.
Step 6: Add the “SNMP feature”
Add the selected features to the installation. Make sure to add the management tools, and then click the “Add Features” button.
Step 7: Confirm installation selections
On the “Confirm installation selections” panel, click “Install” to begin the process. You can optionally select to have the server restart automatically after install. Although not mandatory for SNMP services, it is a good practice to restart the server after installing system software or extensions.
Step 8: Installation progress
The installation process will begin after which you can close the window and perform other tasks, or wait until installation is completed.
Step 9: Start and Configure the SNMP Service
After installation is complete, go to the Windows Menu in the Desktop and look for the Services application on the Administrative Tools menu. The Services window will show a list of all the installed services, both running or stopped. Locate the “SNMP Service” and right-click the line to show the actions menu. Select “Properties“.
Step 10: Configure SNMPÂ on Windows Server
For SNMP v2c, at least, edit the default “Public” community. Replace it with a long hard to guess string and give it “READ-ONLY” rights. This will allow you to access the server’s parameters to be monitored in a safe way (inside a secure private network). Don’t use SNMP v1 or v2 outside a protected network. In any case, be sure to erase or overwrite the default “Public” community.
It is also a good practice to specify the static IPs of the monitoring servers or devices. Add IPs to the list of “Accept SNMP packets from these hosts”. That way, only those specific devices will be able to poll the server using SNMP.
As you can see, configuring SNMP on Windows Server is fairly easy. These 10 steps provide the minimum functionality to enable SNMP in the server and allow it to be monitored. Later, you can decide if you also want to enable administration thru SNMP.
