How to Install and Configure SNMP Agent Service on Windows

SNMP (Simple Network Management Protocol) is a classic protocol used for monitoring, event notification, management, and information collection from network devices, including servers, routers, switches, workstations, printers, and other devices running an SNMP agent. SNMP is a lightweight and efficient protocol that uses UDP port 161 for SNMP queries and responses and UDP port 162 for SNMP traps and notifications. In this article, we’ll cover how to install and configure the SNMP service on workstations running Windows 11 and 10 desktop editions, as well as on Windows Server hosts.

How to Install SNMP Service on Windows Server

In Windows Server (all versions), the SNMP service can be installed from the Server Manager GUI. Select Add roles and features -> Features. Click SNMP Service (if needed, also check SNMP WMI Providers).

Click Next -> Install and wait till the installation is over.

Install SNMP Agent on Windows Server Core

In Windows Server Core, you can install SNMP using the Windows Admin Center web interface or PowerShell.
If you are using the Windows Admin Center, connect to your Windows Server host, and select Roles and Features -> SNMP Service.

As the Windows Server Core doesn’t have a graphical user interface and is primarily managed via the command prompt, you can install the SNMP service feature using the Install-WindowsFeature PowerShell cmdlet.

Check that the SNMP service is not installed:

Get-WindowsFeature SNMP*

Install the SNMP role and WMI provider:

Install-WindowsFeature SNMP-Service,SNMP-WMI-Provider -IncludeManagementTools

Make sure that SNMP services are running:

Get-Service SNMP*

By default, the SNMP service is running, and the SNMPTRAP is stopped.

How to Enable SNMP Service in Windows 11

The built-in SNMP agent can be installed not only on Windows Server, but also on workstations running desktop editions like Windows 11 and 10.

In the current versions of Windows 10/11, the SNMP service is a part of the Features on Demand (like RSAT or OpenSSH). You can install the SNMP service via the Settings app. Go to Settings -> Optional features -> View Optional Features -> View features.
Check the Simple Network Management Protocol (SNMP) and WMI SNMP Provider options in the list of available features. To start the installation, click Next (you will need an Internet connection to Microsoft Update servers).

To install the SNMP agent services using PowerShell, run the commands below:

Add-WindowsCapability -Online -Name SNMP.Client~~~~0.0.1.0
Add-WindowsCapability -Online -Name WMI-SNMP-Provider.Client~~~~0.0.1.0

Windows must download and install SNMP feature component files from Windows Update servers. If your computer cannot access the internet (offline or disconnected device), you can install the SNMP service using the Windows 11 Languages and Optional Features ISO image (Features on Demand media). Download the ISO image (https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-11-language-packs) and mount it to a virtual drive. Then, install the features from the local directory using DISM.

Dism /online /add-package /packagepath:"F:\Microsoft-Windows-SNMP-Client-Package~31bf3856ad364e35~amd64~en-US~.cab" /LimitAccess
Dism /online /add-package /packagepath:"F:\Microsoft-Windows-WMI-SNMP-Provider-Client-Package~31bf3856ad364e35~amd64~en-US~.cab" /LimitAccess

In older versions of Windows (up to Windows 10 1803), as well as in Windows 8.1 and 7, the SNMP service can be installed using the Turn Windows features on or off applet (optionalfeatures.exe).

Basic SNMP Agent Configuration in Windows

After installing the SNMP feature in Windows, you will see two new services in the services.msc management console.

• SNMP Service – the main SNMP agent service in Windows. It stores the agent configuration, monitors system activity, and provides information in response to queries from monitoring systems. The service listens on UDP port 161 and responds to active SNMP queries from monitoring platforms, such as a Zabbix server (when using SNMP poll).
• SNMP Trap (disabled by default). This service listens on UDP port 162 and processes incoming SNMP trap messages from local or remote SNMP agents. This service is only required when the Windows host itself receives and processes SNMP traps (for example, when a monitoring server such as PRTG or ManageEngine OpManager is running on this Windows host).

To configure the SNMP agent in Windows, open the SNMP Service properties. In addition to the standard service configuration tabs, the SNMP Service properties dialog includes several SNMP-specific tabs:

• Agent
• Traps
• Security

The Agent tab contains basic information about the device (administrator contact information, location). Here you can also select the type of information that the device can send when polling via SNMP.

The Traps tab is used to specify the monitoring servers to which the Windows SNMP agent should send SNMP traps. An SNMP trap is a unicast UDP notification sent asynchronously to a monitoring system (for example, when a critical event occurs). Configure the following settings here:

• Community name – a community string used as a shared authentication key, similar to a plain-text password. The monitoring server uses this value to identify and validate the SNMP community.
• Trap destinations – a list of IP addresses or host names of monitoring servers that should receive SNMP trap notifications from the Windows host.

The settings on the Traps tab are optional and are only required if the Windows host needs to send SNMP trap notifications.

The Security tab controls which hosts are allowed to query the SNMP agent on the computer. You can configure one or more SNMP community strings and define the access permissions associated with them, including which monitoring systems can get SNMP data and whether they are allowed to modify the agent configuration.

Community name – a text string that is used as a password for SNMP authentication in SNMP 1 and SNMP 2 protocol versions.

Community rights – set one of the five available access levels for the community:

• READ ONLY – allows getting information from a device. This is the most commonly used permission, which is sufficient for the monitoring system to query the host via SNMP.
• READ WRITE – allows getting information and editing a device configuration
• NOTIFY – allows receiving SNMP traps
• READ CREATE – used when a remote host needs to read, change, or create objects
• NONE

In the Accept SNMP packets from these hosts list, you can enter the names or IP addresses of the hosts allowed to query the device. If you don’t want to use the allowed device list, leave Accept SNMP packets from any hosts here (less secure).

In Windows Defender Firewall, open the rules allowing inbound and outbound traffic for SNMP requests (UDP 161) and SNMP traps (UDP 162), if used. You can enable the firewall rules using PowerShell.

There are several predefined rules for SNMP traffic in Windows Firewall:

Get-NetFirewallrule -DisplayName *snmp* |ft

• SNMPTRAP-In-UDP
• SNMPTRAP-In-UDP-NoScope
• SNMP-Out-UDP
• SNMP-In-UDP-NoScope
• SNMP-Out-UDP-NoScope
• SNMP-In-UDP

You can enable all SNMP firewall rules at once, or just one specific one:

Get-NetFirewallrule -DisplayName *snmp* | Enable-NetFirewallRule
Get-NetFirewallrule SNMP-Out-UDP | Disable-NetFirewallRule

If you configure the SNMP agent settings on Windows Server Core host, you won’t be able to use the SNMP service GUI to set its settings. Instead, you will have to make changes to the registry using PowerShell. SNMP service settings are located under the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters.

The following commands will set the agent description:

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\services\SNMP\Parameters\RFC1156Agent" -Name "sysContact" -Value "admin@woshub.com" -PropertyType REG_SZ
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\services\SNMP\Parameters\RFC1156Agent" -Name "sysLocation" -Value "MUN_DCn2" -PropertyType REG_SZ

For each SNMP trap, you will need to create a separate key with the community name under HKLM\SYSTEM\CurrentControlSet\services\SNMP\Parameters\TrapConfiguration.

New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\services\SNMP\Parameters\TrapConfiguration\public1"

Set the community permissions:

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities" -Name "public1" -Value 4 -PropertyType DWord

For each community, you can set a list of hosts they are allowed to accept queries from:

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\PermittedManagers" -Name "1" -Value "mun-mon1.woshub.com" -PropertyType REG_SZ

Restart your SNMP service to apply the new settings from the registry:

Get-Service SNMP|Restart Service

There are also several options in Group Policies that allow you to configure the SNMP agent on Windows. Check the following options under the following section of the GPO editor: Computer Configuration -> Policies -> Administrative Templates -> Network -> SNMP.

• Specify communities – define the SNMP community strings that the agent will accept in an incoming query. By default, these communities provide read-only access.
• Specify permitted managers – specify the IP addresses or host names of monitoring servers that are allowed to query the SNMP agent.
• Specify traps for public community – configure the recipients who should receive SNMP traps generated for the public community

To make sure if SNMP is working, use the snmpwalk tool (available in any Linux distro):

# snmpwalk -v 2c -c public1 -O e 192.168.12.200

In this example, we have polled our Windows host using SNMPv2.

The tool has returned basic device information (syscontact, sysname, syslocation) and a lot of data on the Windows host state.

Configure SNMP Traps for Specific Windows Events

If you want a Windows host to automatically and immediately send SNMP traps to your monitoring system when specific events appear in the Event Viewer, you can use the built-in evntwin.exe tool to configure event-to-SNMP trap translations.

1. Enable the SNMP Trap service and configure it to start automatically. In the SNMP Service properties, specify the community name and the trap destinations on the Traps tab. 
2. Run the evntwin tool (Event to SNMP Trap Translator), switch to Custom mode, and select the Event IDs that should trigger SNMP notifications.  In this example, I configure notifications for Event ID 1074, which is logged when a user or process initiates a Windows Server restart or shutdown.
3. This configuration can be applied to other Windows hosts by exporting the settings to a configuration file with a *.cnf extension.
4. Finally, apply this configuration to the SNMP service. This command will associate the Windows Events defined in the config file with automatic SNMP trap generation: evntcmd -s localhost custom-events-snmp-trap.cnf

After applying this configuration, Windows will generate and send SNMP traps when the specified Event Viewer events occur.