Windows Server monitoring

Windows Server monitoring usually arrives as an afterthought in tools built for Linux, which is why so much of it is done with scheduled PowerShell and hope. The Servers Sentinel agent is a native Windows Service on amd64 and arm64, supported on Windows Server 2016, 2019, 2022 and 2025, and it reports exactly the same metrics and events as its Linux counterpart.

What is worth watching on Windows

• Stopped automatic services. The single most common Windows outage: a service set to start automatically that is not running. It is a binary condition and it should page.
• Pending reboots. A patched machine that has not restarted is running neither the old nor the new state cleanly. Windows tracks this; the agent reports it.
• RDP authentication. A public RDP port draws continuous password guessing. The agent reads the Security event log locally and flags a concentrated attack with its source addresses within seconds.
• Disk space on system volumes. Windows degrades badly and early when the system volume fills, well before it reaches zero.
• CPU, memory and network, with duration on the rule so a nightly job does not page anyone.

Installation

In an elevated PowerShell, using the token the panel gives you:

irm https://panel.example.com/install.ps1 | iex
Install-SentinelAgent -Token <ENROLLMENT_TOKEN> -Panel panel.example.com

For rollout across a domain there is an MSI that accepts the same TOKEN and PANEL properties, so it deploys by GPO like any other package. Full detail is in installing the agent.

Mixed fleets

If you run both Windows and Linux, the point is that you do not maintain two configurations. One protocol drives both agents, the same rules apply to both, and the same global templates with per-server overrides cover the whole fleet. A disk threshold set once applies to C: and to /var alike.