This guide provides instructions for deploying the Windows Server integration at scale in an enterprise environment using Team API Keys for enhanced security and automated deployment workflows.

Important: API keys are encrypted using the Windows Data Protection API and cannot be set directly in configuration files. This guide shows proper methods for enterprise API key deployment.

Example Deployment Workflow

For enterprise deployments, Veza recommends one of these workflows:

Option A: MSI with APIKEY Parameter (Recommended)

Option B: Two-Step Deployment

1. Deploy the MSI to target machines using your preferred orchestration tool (SCCM, PDQ Deploy, etc.)

2. Deploy a standardized configuration file (without API key)

3. Execute a script to securely store the Veza API key:

Both approaches encrypt API keys using LocalMachine credentials via the Windows Data Protection API.

Automated Deployment with Team API Keys

have a narrower scope than standard API keys and can be used to push Windows Server metadata to the Veza platform while limiting the access granted to the deployed keys.

Create Providers

Team API Keys do not allow for creating new Integration Providers on the Veza platform. To ensure that Windows servers can push metadata once configured, create the required providers on the Veza platform before deploying the application.

Execute the following commands with a to ensure the providers are created.

This script creates two custom providers in your Veza tenant: "Windows Server" for local account metadata and "Windows Files" for file share permissions. These providers must exist before Team API Keys can be used to push data to them.

Create Team

With the Providers created, create a new in Veza that is scoped to only the Windows Server and Windows Files providers.

1. Click Administration in the left-hand navigation pane.

2. Click Team Managment in the tab list in the main pane.

3. Click Add Team.

4. Provide a Name and Description for the new Team.

Create Team API Keys

Team API Keys can be generated programmatically, allowing for flexible deployment options. A single Team API key can be shared to all deployed Windows Servers, or a unique key can be generated for each installation.

To generate a for Windows Server, construct a POST request to https://<tenant>.vezacloud.com/api/preview/teamkeys with the following payload:

Example:

The response body will include the generated API key:

Record the access_key value for use with the Veza for Windows integration.

Using Powershell to create and print a Team API key:

This script generates a Team API Key and prints its value to the console. The key is associated with the specified team ID and given a name (typically the server name) for tracking and management purposes.

Install with Per-Machine Team API Keys

An example installation Powershell script that generates a unique Team API Key per installation and employs a shared configuration file follows:

1. Detect the server's fully qualified domain name (FQDN)

2. Create a unique Team API Key named after the server

3. Install the Veza application silently with a shared configuration file and the newly-generated API key

Follow the steps in the Create Providers and Create Team sections before deploying an install script that follows this pattern.

Overview

The Veza integration for Windows Server comprises an OAA package and a collection of .NET 8.0 applications. These tools discover metadata from a Windows Server host and forward it to a Veza instance. The application package comes as an MSI installer for deployment on Windows Server.

For automated deployment at scale with per-machine unique Team API Keys, see the Enterprise Deployment guide.

Components

The Veza Windows OAA application includes:

1. A service that discovers local groups, user accounts, services, and scheduled tasks within the Windows Server OS.

2. A service to detect Active Directory filesystem permissions on SMB file shares.

3. A GUI application for configuring discovery services and setting up the Veza connection.

Prerequisites

• Windows Server 2012 R2 or newer

• .NET 8.0 Runtime (included in the installer)

• You will need the installation program from Veza, available

Deployment Specifications

System Requirements

Performance Impact

The Veza Windows integration is engineered to operate with minimal resource utilization across enterprise environments:

• CPU Utilization: Typically insignificant during standard metadata collection operations

• Memory Consumption: <50MB RAM during normal operational cycles

• Network Bandwidth: Optimized data transmission with lightweight payloads transmitted at configurable intervals (default: 60 minutes)

• Storage I/O: Negligible impact on storage subsystems outside of scheduled log maintenance or diagnostic activities

Operational Schedule

• By default, the application collects and sends metadata to Veza every 60 minutes

• This interval can be configured between 1 hour and 1 day to suit your organizational requirements by modifying the configuration file or in the application settings.

• For file share discovery, a minimum interval of 120 minutes is recommended

GUI Configuration:

1. Open Veza for Windows from the Start menu

2. Go to the Local Accounts tab and modify the Discovery Interval (minutes) field (minimum 60 minutes) to change the local accounts discovery interval.

3. For file share intervals, go to the Folders tab and modify the Discovery Interval (minutes) field (minimum 120 minutes)

Configuration File:

To manage these settings in the configuration file at C:\Program Files\Veza\Veza.config:

1. Set windows_local_accounts-interval for local accounts discovery interval (recommended minimum 60 minutes)

2. Set windows_files-interval for file share discovery interval (recommended minimum 120 minutes)

3. Both values should be specified in minutes as quoted integers (e.g., "120"). See the for complete details

Log Management

• The application stores 14 days of logging information

• Logs are automatically purged as they age out

• At the standard Info level, log storage is negligible

• At Debug level, logs may consume up to 1GB of disk space

Installation

Deployment Options

The Veza Windows integration supports both manual and automated deployment methods:

Manual Installation

Run the Veza.msi installation program and follow the on-screen prompts. By default, the application installs in C:\Program Files\Veza.

Silent Installation (for automated deployment)

The MSI package supports standard silent installation parameters for enterprise deployment:

Important: API keys are encrypted using the Windows Data Protection API and cannot be set directly in configuration files.

API Key Deployment Methods

Method 1: MSI Installation with APIKEY Parameter (Recommended)

This method encrypts the API key during installation:

Method 2: Post-Installation API Key Configuration

If you cannot include the API key in the MSI command:

Example Configuration File

Below is a standard configuration template that can be customized for your environment:

Required configuration parameters are listed and described in the table below:

GUI Configuration (manual deployment)

Post-installation, open Veza for Windows from the Start menu.

1. Under the Veza API tab, input your Veza instance URL into Veza URL.

2. Paste the previously created API key into Veza API Key.

3. Optionally provide the URL for the Insight Point Proxy.

To verify the successful connection, log in to Veza and open the Integrations page. You should see Windows Server enabled on the list of all integrations.

Note: The installed service needs to run with Administrative privileges.

Security Considerations

API Key Management

The Veza Windows integration uses an API key to authenticate with the Veza tenant. Important security considerations include:

• Key Generation: API keys are issued from the Veza tenant by users with administrative access

• Key Deployment Options:

  • Deploy a unique key per server for the highest security

  • Deploy a shared key across all servers for simplified management

See for more about Veza API keys.

Network Security

The Veza Windows integration requires:

• Outbound HTTPS (443) access to the Veza tenant or Insight Point

• All data is transmitted using TLS 1.2 or higher

No inbound connectivity is required.

Update Management

The Veza for Windows application follows a separate release cadence from the Veza platform:

• Updates are released only for bug fixes, security bulletins, and feature enhancements

• Updates are manually deployed via new MSI packages published by Veza

• No automatic updates are performed

• Update notifications are sent to tenant administrators

To update existing installations:

1. Download the latest MSI from Veza

2. Deploy using the same methods as the initial installation

3. The installation program will automatically upgrade the existing installation

Configuration settings are preserved during upgrades.

Standard Functionality

Windows Local Accounts

This service identifies local security principals on the Windows Server host. By default, it detects:

1. Local user accounts

2. Local groups

3. (Optional) Installed services

4. (Optional) Configured scheduled tasks

Properties

Note (*): Local groups on Windows Server can contain both Active Directory subgroups and local user accounts. The type property distinguishes between the two entities.

Windows Files

This service discovers filesystem permissions for specified paths and subdirectories based on the set depth. It primarily identifies:

1. Filesystem paths

2. Active Directory users and groups with permissions on each path

3. Permission inheritance

Limitations

• Designed for SMB file shares utilizing Active Directory permissions

• Metadata from security principals that do not correlate to Active Directory users or groups is omitted before sending data to Veza

• Enumerating large shares can be more memory-intensive and will increase the RAM requirement during execution

Configuration Options

These settings can be configured either through the GUI application (Veza for Windows from the Start menu) or by editing the configuration file at C:\Program Files\Veza\Veza.config. See the for file-based configuration details.

Local Accounts

In the Local Accounts tab, adjust settings as desired:

Files

In the Folders tab, customize as needed:

Troubleshooting

Common Issues

API Key Not Working During MSI Installation:

• Problem: API key included directly in configuration file

• Solution: API keys cannot be set in configuration files. Use MSI APIKEY parameter or post-installation configuration

• Example: msiexec /i Veza.msi /qn CONFIG="C:\path\to\Veza.config" APIKEY="your_key"

Configuration Parameters Not Applied:

• Problem: Configuration file path incorrect or MSI cannot access relative paths

• Solution: Use full filesystem path for CONFIG parameter, not relative paths

• Example: Use CONFIG="C:\Users\Administrator\Desktop\Veza.config" instead of CONFIG="Veza.config"

Connection Failures:

• Verify network connectivity to the Veza tenant

• Check API key validity in the Veza tenant

• Ensure correct URL format (e.g. https://tenant-name.vezacloud.com)

Performance Issues:

• If memory usage exceeds 50MB during normal operation, check file share sizes

• Reduce the number of discovery threads for file shares

• Increase discovery intervals

Log Analysis:

• You can adjust the service's log level using the dropdown menu. By default, logs are saved at C:\\Program Files\Veza\Local Accounts\logs\VezaWindows.log and C:\\Program Files\Veza\Folders\logs\VezaFiles.log.

• Set log level to Debug temporarily to gather more information for troubleshooting and support requests.

• Reduce the logging level after troubleshooting to minimize disk usage

Support

For additional assistance, contact Veza Support at [email protected] or through your account representative.