Example Deployment Workflow

For enterprise deployments where you need to install the integration for many unique servers, Veza recommends the workflow:

1. Deploy the MSI to target machines using your preferred orchestration tool (SCCM, PDQ Deploy, etc.)

2. Deploy a standardized configuration file to C:\Program Files\Veza\Veza.config

3. Execute a script to securely store the Veza API key:

# Store API key (this encrypts the key using Windows Data Protection API)
C:\Program Files\Veza\VezaWindowsTray.exe --api_key=<veza_api_key>

Using this approach, API keys as are encrypted and decrypted using LocalMachine credentials via the Windows Data Protection API.

Automated Deployment with Team API Keys

Create Providers

Team API Keys do not allow for creating new Integration Providers on the Veza platform. To ensure that Windows servers can push metadata once configured, create the required providers on the Veza platform before deploying the application.

# Set Veza tenant URL and API key
$vezaUrl = "https://<yourtenant>.vezacloud.com"
$vezaAPIKey = "your-personal-api-key"

$body = @{
 "name"="Windows Server"
 "custom_template"="application"
} | ConvertTo-Json
$header = @{
 "Accept"="application/json"
 "Authorization"="Bearer $vezaAPIKey"
 "Content-Type"="application/json"
}
Invoke-RestMethod -Uri "https://$vezaUrl/api/v1/providers/custom" -Method 'Post' -Body $body -Headers $header
$body = @{
 "name"="Windows Files"
 "custom_template"="application"
} | ConvertTo-Json
Invoke-RestMethod -Uri "https://$vezaUrl/api/v1/providers/custom" -Method 'Post' -Body $body -Headers $header

This script creates two custom providers in your Veza tenant: "Windows Server" for local account metadata and "Windows Files" for file share permissions. These providers must exist before Team API Keys can be used to push data to them.

Create Team

1. Click Administration in the left-hand navigation pane.

2. Click Team Managment in the tab list in the main pane.

3. Click Add Team.

4. Provide a Name and Description for the new Team.

5. In The Select Providers dropdown, check both Windows Server and Windows Files

6. Click Create Team.

7. In the Team Management view, click the name of the newly-created Team and record the Team ID at the end of the url (ex: https://example.vezacloud.com/app/teams/613df02b-9a40-4331-947c-5c327b54b228).

Create Team API Keys

Team API Keys can be generated programmatically, allowing for flexible deployment options. A single Team API key can be shared to all deployed Windows Servers, or a unique key can be generated for each installation.

{
    "team_id": "<team_id>",
    "name": "<key_name>"
}

Example:

{
 "team_id": "613df02b-9a40-4331-947c-5c327b54b228",
 "name": "server01.example.com"
}

The response body will include the generated API key:

{
 "value": {
     "id": "01968c1b-85b7-71eb-8876-843ef2463a8e",
     "access_key": "k1TzyiA…NiBuwP0Wzw",
     "name": "server01.example.com",
     "created_at": "2025-01-01T15:35:58.647121782Z",
     "last_access_at": "2025-01-01T15:35:58.647121782Z",
     "status": "ACTIVE",
     "team_id": "613df02b-9a40-4331-947c-5c327b54b228",
     "team_name": ""
 }
}

Record the access_key value for use with the Veza for Windows integration.

Using Powershell to create and print a Team API key:

# Set Veza tenant URL and API key
$vezaUrl = "https://<yourtenant>.vezacloud.com"
$vezaAPIKey = "your-personal-api-key"

# Set the Team ID from the previous step
$teamId = "your-team-id"

$body = @{
 "team_id"=$teamId
 "name"="server01.example.com"
} | ConvertTo-Json
$header = @{
 "Accept"="application/json"
 "Authorization"="Bearer $vezaAPIKey"
 "Content-Type"="application/json"
}
$resp = Invoke-RestMethod -Uri "https://$vezaUrl/api/preview/teamkeys" -Method 'Post' -Body $body -Headers $header
$resp.value.access_key

This script generates a Team API Key and prints its value to the console. The key is associated with the specified team ID and given a name (typically the server name) for tracking and management purposes.

Install with Per-Machine Team API Keys

An example installation Powershell script that generates a unique Team API Key per installation and employs a shared configuration file follows:

1. Detect the server's fully qualified domain name (FQDN)

2. Create a unique Team API Key named after the server

3. Install the Veza application silently with a shared configuration file and the newly-generated API key

Follow the steps in the Create Providers and Create Team sections before deploying an install script that follows this pattern.

$vezaUrl="https://<yourtenant>.vezacloud.com"
$vezaAPIKey="<veza-personal-api-key>"
$teamId="<veza-team-id>"

$fqdn=(Get-WmiObject win32_computersystem).DNSHostName+"."+(Get-WmiObject win32_computersystem).Domain

$vezaRequestHeader = @{
  "Accept"="application/json"
  "Authorization"="Bearer $vezaAPIKey"
  "Content-Type"="application/json"
}

$keyRequestBody = @{
  "team_id"=$teamId
  "name"=$fqdn
} | ConvertTo-Json

$keyResponse = Invoke-RestMethod -Uri "$vezaUrl/api/preview/teamkeys" -Method 'Post' -Body $keyRequestBody -Headers $vezaRequestHeader
$apiKey = $keyResponse.value.access_key

msiexec /i Veza.msi /qn CONFIG="\\deployment-share\Veza\Veza.config" APIKEY=$apiKey

Overview

The Veza integration for Windows Server comprises an OAA package and a collection of .NET 8.0 applications. These tools discover metadata from a Windows Server host and forward it to a Veza instance. The application package comes as an MSI installer for deployment on Windows Server.

Components

The Veza Windows OAA application includes:

1. A service that discovers local groups, user accounts, services, and scheduled tasks within the Windows Server OS.

2. A service to detect Active Directory filesystem permissions on SMB file shares.

3. A GUI application for configuring discovery services and setting up the Veza connection.

Prerequisites

• Windows Server 2012 R2 or newer

• .NET 8.0 Runtime (included in the installer)

Deployment Specifications

System Requirements

Performance Impact

The Veza Windows integration is engineered to operate with minimal resource utilization across enterprise environments:

• CPU Utilization: Typically insignificant during standard metadata collection operations

• Memory Consumption: <50MB RAM during normal operational cycles

• Network Bandwidth: Optimized data transmission with lightweight payloads transmitted at configurable intervals (default: 60 minutes)

• Storage I/O: Negligible impact on storage subsystems outside of scheduled log maintenance or diagnostic activities

Operational Schedule

• By default, the application collects and sends metadata to Veza every 60 minutes

• This interval can be configured between 1 hour and 1 day to suit your organizational requirements

• For file share discovery, a minimum interval of 120 minutes is recommended

Log Management

• The application stores 14 days of logging information

• Logs are automatically purged as they age out

• At the standard Info level, log storage is negligible

• At Debug level, logs may consume up to 1GB of disk space

• Log locations:

  • C:\Program Files\Veza\Local Accounts\logs\VezaWindows.log

  • C:\Program Files\Veza\Folders\logs\VezaFiles.log

Installation

Deployment Options

The Veza Windows integration supports both manual and automated deployment methods:

Manual Installation

Run the Veza.msi installation program and follow the on-screen prompts. By default, the application installs in C:\Program Files\Veza.

Command Line Installation

The MSI package supports standard installation parameters when invoked programmatically:

# Basic silent install
msiexec /i Veza.msi /qn

# Install with specific log file
msiexec /i Veza.msi /qn /l*v install.log

# Install to custom directory
msiexec /i Veza.msi /qn INSTALLDIR="D:\Applications\Veza"

# Install with an existing configuration file
msiexec /i Veza.msi /qn CONFIG="\\deployment-share\Veza\Veza.config"

# Install with an existing API key
msiexec /i Veza.msi /qn APIKEY="<api_key>"

# Install with existing configuration file and API key
msiexec /i Veza.msi /qn CONFIG="\\deployment-share\Veza\Veza.config" APIKEY="<api_key>"

Example Configuration File

Below is a standard configuration template that can be customized for your environment:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
 <configSections>
  <section name="PathConfigurationSection" type="Veza.Integrations.PathConfigurationDataSection, PathConfiguration, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
 </configSections>
 <PathConfigurationSection>
  		<PathConfigurations>
  		  </clear>
			  <add path=”\\fileserver01.example.com\Finance” depth=”1” />
			  <add path=”\\fileserver02.example.com\Human Resources\Benefits” depth=”1” />
  		</PathConfigurations>
 </PathConfigurationSection>
 <appSettings>
  <!-- Local Account Collection Settings -->
  <add key="windows_local_accounts-enabled" value="true" />
  <add key="windows_local_accounts-interval" value="60" />
  <add key="windows_local_accounts-services_enabled" value="true" />
  <add key="windows_local_accounts-tasks_enabled" value="true" />
  <add key="windows_local_accounts-save_json" value="false"/>

  <!-- Veza API Connection Settings -->
  <add key="veza-api_key" value="YOUR_API_KEY_PLACEHOLDER" />
  <add key="veza-url" value="https://YOUR_TENANT.vezacloud.com" />
  <add key="veza-loglevel" value="Info" />

  <!-- File Share Discovery Settings -->
  <add key="windows_files-enabled" value="true" />
  <add key="windows_files-interval" value="120" />
  <add key="windows_files-threads" value="1" />
  <add key="windows_files-save_json" value="false"/>
 </appSettings>
</configuration>

Required configuration parameters are listed and described in the table below:

GUI Configuration (manual deployment)

Post-installation, open Veza for Windows from the Start menu.

1. Under the Veza API tab, input your Veza instance URL into Veza URL.

2. Paste the previously created API key into Veza API Key.

3. Click Apply.

To verify the successful connection, log in to Veza and open the Integrations page. You should see Windows Server enabled on the list of all integrations.

Note: The installed service needs to run with Administrative privileges.

Security Considerations

API Key Management

The Veza Windows integration uses an API key to authenticate with the Veza tenant. Important security considerations include:

• Key Generation: API keys are issued from the Veza tenant by users with administrative access

• Key Deployment Options:

  • Deploy a unique key per server for the highest security

  • Deploy a shared key across all servers for simplified management

  • Deploy keys by department or region for balanced security and management

• Key Storage:

  • The API key is encrypted using Windows Data Protection API

  • Stored in the configuration file at C:\Program Files\Veza\Veza.config

• Key Rotation:

  • Keys are not automatically rotated

  • Keys can be manually deleted and replaced with new ones via the Veza tenant

• Key Compromise:

  • A compromised key would grant access to the endpoints listed in Veza APIs

  • Immediately delete and replace any compromised keys

See Authentication for more about Veza API keys.

Network Security

The Veza Windows integration requires:

• Outbound HTTPS (443) access to the Veza tenant or Insight Point

• All data is transmitted using TLS 1.2 or higher

No inbound connectivity is required.

Update Management

The Veza for Windows application follows a separate release cadence from the Veza platform:

• Updates are released only for bug fixes, security bulletins, and feature enhancements

• Updates are manually deployed via new MSI packages published by Veza

• No automatic updates are performed

• Update notifications are sent to tenant administrators

To update existing installations:

1. Download the latest MSI from Veza

2. Deploy using the same methods as the initial installation

3. The installation program will automatically upgrade the existing installation

Configuration settings are preserved during upgrades.

Standard Functionality

Windows Local Accounts

This service identifies local security principals on the Windows Server host. By default, it detects:

1. Local user accounts

2. Local groups

3. (Optional) Installed services

4. (Optional) Configured scheduled tasks

Properties

Note (*): Local groups on Windows Server can contain both Active Directory subgroups and local user accounts. The type property distinguishes between the two entities.

Windows Files

This service discovers filesystem permissions for specified paths and subdirectories based on the set depth. It primarily identifies:

1. Filesystem paths

2. Active Directory users and groups with permissions on each path

3. Permission inheritance

Limitations

• Designed for SMB file shares utilizing Active Directory permissions

• Metadata from security principals that do not correlate to Active Directory users or groups is omitted before sending data to Veza

• Enumerating large shares can be more memory-intensive and will increase the RAM requirement during execution

Configuration Options

Local Accounts

In Local Accounts, adjust settings as desired:

Files

In Folders, customize as needed:

Troubleshooting

Common Issues

1. If you encounter connection failures:

   • Verify network connectivity to the Veza tenant

   • Check API key validity in the Veza tenant

   • Ensure correct URL format (e.g. https://tenant-name.vezacloud.com)

2. For issues with high resource usage:

   • If memory usage exceeds 50MB during normal operation, check file share sizes

   • Reduce the number of discovery threads for file shares

   • Increase discovery intervals

3. Log Analysis:

   • You can adjust the service's log level using the dropdown menu. By default, logs are saved at C:\Program Files\Veza\Local Accounts\logs\VezaWindows.log and C:\Program Files\Veza\Folders\logs\VezaFiles.log.

   • Set log level to Debug temporarily to gather more information for troubleshooting and support requests.

   • Reduce the logging level after troubleshooting to minimize disk usage

Support

For additional assistance, contact Veza Support at support@veza.com or through your account representative.