Windows monitoring is the practice of collecting availability and performance data from Microsoft Windows servers and desktops, comparing that data against defined thresholds, and alerting when a value crosses one. The data includes processor load, memory and disk usage, the state of Windows Services and processes, event log entries, and performance counters. Collection happens either through an agent installed on the Windows machine or through a protocol the machine already exposes, such as SNMP or WinRM.

Monitoring turns a Windows failure from something users report into something your team already knows about:

• Shorter outages: A stopped Service, a full volume, or an unresponsive Host produces an alert instead of a support ticket.
• Capacity decisions backed by data: Performance data is graphed and retained, so growth in memory or disk consumption is visible before it becomes urgent.
• Fewer manual restarts: Event handlers can run a script on the Windows machine when a check goes Critical, restarting a Service without waking anyone.
• Patch visibility: A scheduled check reports whether a Windows machine has high priority updates waiting.
• Evidence for the post-mortem: State history and event log matches show what changed and when.

Windows Server Monitoring with NCPA

The Nagios Cross-Platform Agent (NCPA) is the recommended agent for Windows. The Windows Server Wizard connects to the agent, scans the target machine for drives, Services, and processes, and presents them for selection with editable Warning and Critical thresholds. Windows Server monitoring covers the full set of checks available on a server, from system health through to the applications running on it.

• System metrics: CPU usage, memory usage, disk usage per volume, and Host availability.
• Automatic discovery during setup: The wizard queries the machine so you pick from its actual drives and Services rather than typing names.
• Active or passive: NCPA answers checks from the Nagios XI server, or pushes results in over the Nagios Remote Data Processor (NRDP) for machines behind a firewall.
• One Host, many wizards: Reuse an existing Host Name in a later wizard and the new Service checks attach to that same Host.

Documentation: How To Monitor Windows Using NCPA | NCPA v3 Agent Installation Instructions

Windows Desktop Monitoring

Desktops run the same agent as servers. The Windows Desktop Wizard is a separate entry under Configure > Configuration Wizards and covers the same system metrics, Services, and processes. For laptops and remote machines that the Nagios XI server cannot reach directly, NRDS_Win sends check results inbound over port 80 or port 443, with plugins and configuration managed centrally.

Documentation: Passive Monitoring with NRDS_Win

Windows Service Monitoring

Service checks report the current state of any named Windows Service and go Critical when it is not running. Add the Service name in the wizard and give it a display name that will make sense in an alert, such as spooler shown as Print Spooler. Windows service and process monitoring goes deeper on service state tracking, batch jobs, and automated restarts.

Windows Process Monitoring

Process checks track running processes on the target machine. Through NCPA and through the WinRM Wizard you can alert on a process count, its memory usage, or its CPU usage, which catches both a process that has died and one that is consuming more than it should.

Windows Event Log Monitoring

The Windows Event Log Wizard reads event logs through NCPA and applies the filters you define, so only the entries you care about produce an alert. Windows event log monitoring covers the filtering patterns worth starting from.

• Select the logs to watch: Pick from the logs the wizard lists, or add one that is not listed with Add Another Check.
• Filter before alerting: Narrow each check so routine informational entries do not generate noise.
• SNMP trap alternative: Windows can also forward event log data to Nagios XI as SNMP traps.

Documentation: Monitoring Windows Event Logs Using NCPA | Monitoring Windows Event Logs Using SNMP Traps

Windows Application and Database Monitoring

Dedicated wizards cover the Microsoft applications that most often sit on a Windows Server.

• Microsoft Exchange: The Exchange Server Wizard uses NCPA to check core Exchange Services, web services, Outlook Web Access over HTTPS, SMTP, IMAP, and POP availability, blackhole list status, and version-specific metrics such as messages queued for delivery and remote queue length.
• Microsoft SQL Server: Separate MSSQL Server, MSSQL Database, and MSSQL Query Wizards cover SQL Server monitoring metrics such as buffer hits, connections, deadlocks, latch waits, and lazy writes, plus your own SQL queries. These are Premium features.
• Active Directory: The LDAP Server Wizard binds to a directory object with an LDAP Base, Bind DN, and password, confirming the directory is reachable and answering.
• Hyper-V: The Hyper-V Wizard reads CPU, memory, networking, local storage, virtual storage, and high availability storage counters through NCPA. This is a Premium feature.
• Microsoft 365: The Microsoft 365 Wizard checks subscription service availability.

Documentation: How To Monitor MS Exchange Servers | How To Monitor Microsoft SQL | How To Monitor Hyper-V | How To Monitor Active Directory with LDAP

Agentless Windows Monitoring with SNMP and WinRM

Where installing an agent is not an option, Nagios XI polls Windows over a protocol the machine already speaks.

• Windows SNMP Wizard: Enable SNMP on the Windows machine, supply the version, port, and community string, and the wizard scans for drives, Services, and processes.
• WinRM Wizard: Supply an IP address, username, and password, choosing HTTP or HTTPS. The wizard validates the credentials before it will advance, then offers memory usage, CPU usage, disk usage, Windows Services, and Windows processes.
• Windows SSH Wizard: Available for Windows 10 and Windows 11 with OpenSSH installed, covering ping, disk volume, memory, CPU, disk operations per second, Services, and processes. Use an agent instead where you can, because a compromised Nagios XI server would expose every machine it can reach over SSH.

Documentation: How To Monitor Windows Using SNMP | How To Monitor Windows Using WinRM

Windows Performance Counter Monitoring with NSClient++

NSClient++ is the alternate Windows agent, useful for older Windows versions and for environments where it is already deployed. The wizard was made Legacy in Nagios XI 2024R1 and returned to Current status in Nagios XI 2024R2+ with check_nrpe support. Windows performance counter monitoring covers which counters are worth watching.

• Two check methods: The Nagios Remote Plugin Executor (NRPE) method, check_nrpe, runs custom scripts and plugins and supports advanced CPU, memory, and disk checks. check_nt ships with checks for CPU, memory, uptime, disk usage, Services, processes, and performance counters, and is deprecated in NSClient++ 0.6 and later.
• Custom scripts: The external scripts module runs PowerShell and batch files, which is how Windows Update status is checked.
• Passive submission: The NRDP and Nagios Service Check Acceptor (NSCA) client modules push results to Nagios XI for roaming or firewalled machines.

Documentation: Monitoring Windows Using NSClient++ | Installing the Windows Agent NSClient++

Windows Alert Thresholds and Automated Response

Every metric a wizard offers carries its own Warning and Critical thresholds, set during configuration and editable afterward in the Core Configuration Manager (CCM).

• Tune the check schedule per Service: A Windows Update check set to a check interval of 1440 runs once a day, while a Service state check runs on a much shorter cycle.
• Confirm before alerting: Retry interval and max check attempts hold a Service in a soft state until the problem is confirmed.
• Event handlers: Assign the Service Restart – Windows event handler and a _SERVICE custom variable, and Nagios XI runs a restart script through NCPA or NRPE when the check reaches a hard Critical state.

Documentation: Restarting Windows Services With NCPA | Checking For Windows Updates

Windows Monitoring Security and Access Control

Give the monitoring path the smallest amount of access that returns the data.

• Set a strong NCPA token: The token authenticates the Nagios XI server to the agent and also protects the NCPA web interface. Use a value such as <NCPA_TOKEN> from your secret store, never a default.
• Scope WinRM accounts: A WinRM account must sit in the local administrators group or in a local group granted Execute(Invoke) permission through winrm configSDDL default. Create the dedicated group and grant only that permission.
• Use HTTPS for WinRM: Create an HTTPS listener bound to the server certificate thumbprint rather than leaving the default HTTP transport in place.
• Replace the NSClient++ default DH key: Update the key and configuration before using check_nrpe, and set an agent password for check_nt.
• Restrict the agent listener: Set allowed hosts in NSClient++ to the Nagios XI server addresses.

Setup measured in minutes. The wizards scan the target machine and hand you its actual drives, Services, and processes, so a Windows Server is producing checks before you have opened a config file.

One Host record per machine. System checks from the NCPA wizard, Exchange checks from the Exchange Wizard, and MSSQL checks all collapse onto a single Host when you reuse the Host Name, which keeps the Service Detail view readable.

Mixed environments in one place. The same server, thresholds, notification rules, dashboards, and reports cover Windows, Linux, macOS, network devices, and cloud instances.

Problems that fix themselves. Event handlers restart a failed Windows Service on the hard Critical, so the on-call engineer sees a recovery notification rather than a page.

Reach for machines you cannot poll. Passive checks over NRDP and NRDS_Win bring in results from laptops, branch sites, and hosts behind a firewall, using outbound HTTP or HTTPS from the Windows side.

Confirm these before running a wizard:

• Agent installed, if you are using one: NCPA or NSClient++ must be installed on the target Windows machine first.
• NCPA port open: TCP 5693 by default. The Windows installer adds the port permission for the bind port you specify.
• NCPA token set: Chosen during installation, or set as community_string in ncpa.cfg. The wizard validates it and will not advance until it succeeds.
• NSClient++ ports open, if used: TCP 12489 for check_nt, and the NRPE listener port you configure for check_nrpe.
• SNMP enabled, if used: The SNMP service running on the Windows machine, with the version, port, and community string ready.
• WinRM listener and account, if used: A configured listener plus an account in the local administrators group or in a local group with Execute(Invoke) permission.
• PowerShell present: Required on the target machine for script-based checks such as Windows Update status.
• Directory details for Active Directory checks: LDAP Base, Bind DN, and the password for the bind account, collected from Active Directory Users and Computers with Advanced Features enabled.
• SQL Server reachable: The MSSQL instance listening on a known port with a firewall rule allowing it, and a dedicated monitoring login. Do not use the sa account.

1. Install NCPA on the Windows machine. Run the installer, set a token, and accept the default bind IP of 0.0.0.0 and bind port of 5693. For a fleet, run the installer silently with the /S, /TOKEN, and /PORT arguments.
2. Open the wizard. In Nagios XI, go to Configure > Configuration Wizards and search for the Windows Server or Windows Desktop wizard.
3. Connect to the agent. Enter the IP address or FQDN, the port if you changed it from 5693, and the NCPA token, then click Next.
4. Select metrics and thresholds. Enter a Host Name, choose from the drives, Services, and processes the wizard found, and adjust the Warning and Critical values for each.
5. Complete Steps 3 through 5 and click Finish. Nagios XI creates the Host and Services and starts checking. Click the View status details for link to watch the first results arrive.

Documentation: Understanding and Using Configuration Wizards | Using NCPA For Passive Checks

Nagios XI answers state and threshold questions about a Windows machine: is the Host Up, is the Service running, is the volume above 90 percent, did a matching entry appear in an event log, is the queue longer than the number you set. Each check returns OK, Warning, or Critical against a value you defined, which is what makes it a dependable alerting layer rather than an interpretation layer.

Work that depends on retaining and searching the full contents of Windows event logs across many machines belongs to Nagios Log Server, which collects, indexes, and stores log data centrally. Traffic analysis using NetFlow, sFlow, J-Flow, or IPFIX (Internet Protocol Flow Information Export), along with packet capture and network scanning, belongs to Nagios Network Analyzer. Watching several Nagios XI servers from one screen belongs to Nagios Fusion. Each is licensed separately from Nagios XI.

Windows Monitoring

• Windows Server Monitoring
• Windows Service & Process Monitoring
• Windows Event Log Monitoring
• Windows Performance Counter Monitoring
• Microsoft Exchange Monitoring
• Microsoft SQL Server (MSSQL) Monitoring

Protocols Used to Monitor Windows

• SNMP Monitoring
• SSH Monitoring
• LDAP Monitoring
• DHCP Monitoring
• ICMP Monitoring

Server and Operating System Monitoring

• Server Monitoring
• Operating System (OS) Monitoring
• Linux Monitoring
• Disk Monitoring
• Microsoft 365 Monitoring
• Microsoft Azure Monitoring

Logs and Network Traffic

• Security Log Monitoring
• System & Application Log Monitoring
• IIS Log Monitoring
• Nagios Log Server
• Network Monitoring

Platform and Licensing

• • Nagios XI
  • Nagios Fusion
  • Pricing Plans

Install NCPA on one Windows Server, run the Windows Server Wizard, and you will have checks reporting within a few minutes. Add the rest of your Windows machines, layer on Exchange, MSSQL, Active Directory, and Hyper-V checks where you need them, and set thresholds that match how your environment actually behaves.