This guide provides instructions for deploying the Windows Server integration at scale in an enterprise environment using Team API Keys for enhanced security and automated deployment workflows.

Important: API keys are encrypted using the Windows Data Protection API and cannot be set directly in configuration files. This guide shows proper methods for enterprise API key deployment.

Example Deployment Workflow

For enterprise deployments, Veza recommends one of these workflows:

Option A: MSI with APIKEY Parameter (Recommended)

# Single command deployment with API key encryption during installation
msiexec /i Veza.msi /qn CONFIG="\\deployment-share\Veza\Veza.config" APIKEY="<team_api_key>"

Option B: Two-Step Deployment

1. Deploy the MSI to target machines using your preferred orchestration tool (SCCM, PDQ Deploy, etc.)

2. Deploy a standardized configuration file (without API key)

3. Execute a script to securely store the Veza API key:

Both approaches encrypt API keys using LocalMachine credentials via the Windows Data Protection API.

have a narrower scope than standard API keys and can be used to push Windows Server metadata to the Veza platform while limiting the access granted to the deployed keys.

Team API Keys do not allow for creating new Integration Providers on the Veza platform. To ensure that Windows servers can push metadata once configured, create the required providers on the Veza platform before deploying the application.

Execute the following commands with a to ensure the providers are created.

This script creates two custom providers in your Veza tenant: "Windows Server" for local account metadata and "Windows Files" for file share permissions. These providers must exist before Team API Keys can be used to push data to them.

With the Providers created, create a new in Veza that is scoped to only the Windows Server and Windows Files providers.

1. Click Administration in the left-hand navigation pane.

2. Click Team Managment in the tab list in the main pane.

3. Click Add Team.

4. Provide a Name and Description for the new Team.

Team API Keys can be generated programmatically, allowing for flexible deployment options. A single Team API key can be shared to all deployed Windows Servers, or a unique key can be generated for each installation.

To generate a for Windows Server, construct a POST request to https://<tenant>.vezacloud.com/api/preview/teamkeys with the following payload:

Example:

The response body will include the generated API key:

Record the access_key value for use with the Veza for Windows integration.

Using Powershell to create and print a Team API key:

This script generates a Team API Key and prints its value to the console. The key is associated with the specified team ID and given a name (typically the server name) for tracking and management purposes.

An example installation Powershell script that generates a unique Team API Key per installation and employs a shared configuration file follows:

1. Detect the server's fully qualified domain name (FQDN)

2. Create a unique Team API Key named after the server

3. Install the Veza application silently with a shared configuration file and the newly-generated API key

Follow the steps in the Create Providers and Create Team sections before deploying an install script that follows this pattern.

Overview

The Veza integration for Windows Server comprises an OAA package and a collection of .NET 8.0 applications. These tools discover metadata from a Windows Server host and forward it to a Veza instance. The application package comes as an MSI installer for deployment on Windows Server.

For automated deployment at scale with per-machine unique Team API Keys, see the Enterprise Deployment guide.

Components

The Veza Windows OAA application includes:

1. A service that discovers local groups, user accounts, services, and scheduled tasks within the Windows Server OS.

2. A service to detect Active Directory filesystem permissions on SMB file shares.

3. A GUI application for configuring discovery services and setting up the Veza connection.

• Windows Server 2012 R2 or newer

• .NET 8.0 Runtime (included in the installer)

• You will need the installation program from Veza, available

The Veza Windows integration is engineered to operate with minimal resource utilization across enterprise environments:

• CPU Utilization: Typically insignificant during standard metadata collection operations

• Memory Consumption: <50MB RAM during normal operational cycles

• Network Bandwidth: Optimized data transmission with lightweight payloads transmitted at configurable intervals (default: 60 minutes)

• Storage I/O: Negligible impact on storage subsystems outside of scheduled log maintenance or diagnostic activities

• By default, the application collects and sends metadata to Veza every 60 minutes

• This interval can be configured between 1 hour and 1 day to suit your organizational requirements by modifying the configuration file or in the application settings.

• For file share discovery, a minimum interval of 120 minutes is recommended

GUI Configuration:

1. Open Veza for Windows from the Start menu

2. Go to the Local Accounts tab and modify the Discovery Interval (minutes) field (minimum 60 minutes) to change the local accounts discovery interval.

3. For file share intervals, go to the Folders tab and modify the Discovery Interval (minutes) field (minimum 120 minutes)

Configuration File:

To manage these settings in the configuration file at C:\Program Files\Veza\Veza.config:

1. Set windows_local_accounts-interval for local accounts discovery interval (recommended minimum 60 minutes)

2. Set windows_files-interval for file share discovery interval (recommended minimum 120 minutes)

3. Both values should be specified in minutes as quoted integers (e.g., "120"). See the for complete details

• The application stores 14 days of logging information

• Logs are automatically purged as they age out

• At the standard Info level, log storage is negligible

• At Debug

The Veza Windows integration supports both manual and automated deployment methods:

Manual Installation

Run the Veza.msi installation program and follow the on-screen prompts. By default, the application installs in C:\Program Files\Veza.

Silent Installation (for automated deployment)

The MSI package supports standard silent installation parameters for enterprise deployment:

Important: API keys are encrypted using the Windows Data Protection API and cannot be set directly in configuration files.

Method 1: MSI Installation with APIKEY Parameter (Recommended)

This method encrypts the API key during installation:

Method 2: Post-Installation API Key Configuration

If you cannot include the API key in the MSI command:

Example Configuration File

Below is a standard configuration template that can be customized for your environment:

Required configuration parameters are listed and described in the table below:

Post-installation, open Veza for Windows from the Start menu.

1. Under the Veza API tab, input your Veza instance URL into Veza URL.

2. Paste the previously created API key into Veza API Key.

3. Optionally provide the URL for the Insight Point Proxy (e.g., http://insight-point:8080). Note that HTTP URLs represent internal network endpoints, see

To verify the successful connection, log in to Veza and open the Integrations page. You should see Windows Server enabled on the list of all integrations.

Note: The installed service needs to run with Administrative privileges.

The Veza Windows integration uses an API key to authenticate with the Veza tenant. For least privilege, use a scoped to OAA Push. Team API Keys limit access to pushing metadata only, without granting broader administrative permissions.

A Personal API Key is required once to create the "Windows Server" and "Windows Files" providers on the Veza platform. After the providers exist, all subsequent data collection can use Team API Keys. For detailed setup instructions, see the guide.

• Key Types:

  • Team API Key (recommended): Scoped to OAA Push role. Use for ongoing data collection from deployed servers

  • Personal API Key: Required for initial provider creation and other administrative tasks

• Key Deployment Options

See for more about Veza API keys.

The Veza Windows integration requires:

• Outbound HTTPS (443) access to the Veza tenant or Insight Point

• All data is transmitted using TLS 1.2 or higher

No inbound connectivity is required.

Insight Point Proxy Security

Proxy Configuration: HTTP URLs in proxy settings (e.g., http://insight-point:8080) represent internal network endpoints only, with all external connections using HTTPS/TLS encryption. You can use this option to enable Windows servers to reach Veza's cloud service via the Insight Point's encrypted tunnel.

For more about Insight Point connection flow and deployment considerations, see the .

The Veza for Windows application follows a separate release cadence from the Veza platform:

• Updates are released only for bug fixes, security bulletins, and feature enhancements

• Updates are manually deployed via new MSI packages published by Veza

• No automatic updates are performed

• Update notifications are sent to tenant administrators

To update existing installations:

1. Download the latest MSI from Veza

2. Deploy using the same methods as the initial installation

3. The installation program will automatically upgrade the existing installation

Configuration settings are preserved during upgrades.

This service identifies local security principals on the Windows Server host. By default, it detects:

1. Local user accounts

2. Local groups

3. (Optional) Installed services

4. (Optional) Configured scheduled tasks

Properties

Note (*): Local groups on Windows Server can contain both Active Directory subgroups and local user accounts. The type property distinguishes between the two entities.

This service discovers filesystem permissions for specified paths and subdirectories based on the set depth. It primarily identifies:

1. Filesystem paths

2. Active Directory users and groups with permissions on each path

3. Permission inheritance

Unresolved identities

When discovering file share permissions, the agent resolves each security principal to an Active Directory user or group. If a security principal cannot be resolved (for example, an orphaned SID from a deleted account or a principal from an untrusted domain), the agent records it as an unresolved identity on the folder.

Unresolved identities appear as an unresolved_identities property on the folder entity in the Veza graph. The property contains a list of SAM account names that could not be resolved. These identities are not created as separate entities and do not connect to any Active Directory user or group.

To find folders with unresolved identities, query for folder entities where the unresolved_identities property is populated.

By default, the agent tracks up to 100 unresolved identities per folder. To change this limit, set the windows_files-max_unresolved_identities_per_folder configuration parameter. If a folder exceeds the limit, additional unresolved identities are discarded and a warning is logged.

Limitations

• Designed for SMB file shares utilizing Active Directory permissions

• Enumerating large shares can be more memory-intensive and will increase the RAM requirement during execution

These settings can be configured either through the GUI application (Veza for Windows from the Start menu) or by editing the configuration file at C:\Program Files\Veza\Veza.config. See the for file-based configuration details.

In the Local Accounts tab, adjust settings as desired:

In the Folders tab, customize as needed:

API Key Not Working During MSI Installation:

• Problem: API key included directly in configuration file

• Solution: API keys cannot be set in configuration files. Use MSI APIKEY parameter or post-installation configuration

• Example: msiexec /i Veza.msi /qn CONFIG="C:\path\to\Veza.config" APIKEY="your_key"

Configuration Parameters Not Applied:

• Problem: Configuration file path incorrect or MSI cannot access relative paths

• Solution: Use full filesystem path for CONFIG parameter, not relative paths

• Example: Use CONFIG="C:\Users\Administrator\Desktop\Veza.config" instead of CONFIG="Veza.config"

Connection Failures:

• Verify network connectivity to the Veza tenant

• Check API key validity in the Veza tenant

• Ensure correct URL format (e.g. https://tenant-name.vezacloud.com)

Performance Issues:

• If memory usage exceeds 50MB during normal operation, check file share sizes

• Reduce the number of discovery threads for file shares

• Increase discovery intervals

Log Analysis:

• You can adjust the service's log level using the dropdown menu. By default, logs are saved at C:\\Program Files\Veza\Local Accounts\logs\VezaWindows.log and C:\\Program Files\Veza\Folders\logs\VezaFiles.log.

• Set log level to Debug temporarily to gather more information for troubleshooting and support requests.

• Reduce the logging level after troubleshooting to minimize disk usage

For additional assistance, contact Veza Support at support@veza.com or through your account representative.