How to Install and Configure SNMP Service on Windows

3K

SNMP is a popular protocol that is used for the exchange of data between devices on a network. SNMP (Simple Network Management Protocol) is most commonly used in modern networks for monitoring, event notification, and device management.

To remotely query a network device via SNMP, it must have an SNMP agent installed.

Let’s see how to install and configure the SNMP service in Windows 10/11 and Windows Server 2022/2019.

Installing SNMP Service on Windows 10 and 11

The SNMP service is available as a separate Feature on Demand (FoD) on Windows 10 and 11, and is not installed by default.

On modern Windows 10 and 11 builds, you can install the SNMP service from the Settings app:

1. Click Start > Settings > Apps > Optional Features > Add an optional feature > View features (or run the URI command: Win+R > ms-settings:optionalfeatures);
2. Select Simple Network Management Protocol (SNMP) and WMI SNMP Provider (optional) to install;
3. Click Next > Install;
4. Windows will download the SNMP binaries from the Windows Update servers and install the service.

You can also install the SNMP service on Windows 11 and 10 using PowerShell:

1. Open Windows Terminal or PowerShell console as an administrator;
2. Check if the SNMP service is not installed (State=NotPresent):

   Get-WindowsCapability -Online -Name "*SNMP*"|select name,DisplayName,State

   

3. Install the SNMP service and the WMI SNMP Provider using the commands:

   Add-WindowsCapability -Online -Name "SNMP.Client~~~~0.0.1.0"
   
   Add-WindowsCapability -Online -Name "WMI-SNMP-Provider.Client~~~~0.0.1.0"

4. Wait for the installation to complete;
5. Use the Get-Service cmdlet to verify that SNMP service is installed:

   Get-Service -Name snmp*

   

Note. In previous Windows 10 builds (1803-), including Windows 8.1 and 7 you can install the SNMP service using the Turn Windows features on or off applet.

• Run the command: optionalfeatures.exe
• Install the Simple Network Management Protocol (SNMP) and the WMI SNMP Provider

Can’t Install the SNMP Feature on Windows: Error 0x800f0954

SNMP feature is part of the Feature on Demand (FoD) concept, which requires a direct connection to Microsoft’s online update servers for component downloads. You may receive error 0x800f0954 when installing SNMP on a computer that is on an isolated segment or corporate network.

Add-WindowsCapability failed error. Error code = 0x800f0954

This error occurs if your computer is on a corporate network configured to receive Windows updates from an internal WSUS server. The computer is trying to download SNMP binaries from the WSUS server instead of from Microsoft Update servers.

You can allow computers to download optional feature files directly from Windows Update instead of from WSUS:

1. Open the Local Group Policy Editor (gpedit.msc);
2. Go to Computer Configuration > Administrative Templates > System;
3. Enable the GPO option Specify settings for optional component installation and component repair and check the box Download repair content and optional features directly from Windows Updates instead of Windows Server Updates Services (WSUS);
   
4. Update the Group Policy settings on a computer:

   gpupdate /force

5. Restart the Windows Update service:

   Get-Service wuauserv| Restart-Service -Force

Now you can install any Windows optional feature.

In an environment that is not connected to the Internet, you can install SNMP from the offline FoD ISO image:

1. Download the FOD media from your Volume License Servicing Center (VLSC)
2. Mount the ISO image to a virtual DVD drive (for example, E:)
3. Install SNMP using the PowerShell command:

   Enable-WindowsOptionalFeature -Online -FeatureName SNMP -Source "E:\Sources\sxs"

Adding SNMP Service on Windows Server 2022/2019

Now let’s see how to the install SNMP service and WMI providers on Windows Server 2022/2019/2016.

SNMP is not installed by default on Windows Server. You can install the SNMP service:

• Via the Server Manager: Add roles and Features > Features > SNMP Service (you can also check SNMP WMI Providers).
  
• Using PowerShell (this is the only way to install SNMP on Windows Server Core):

  Install-WindowsFeature SNMP-Service,SNMP-WMI-Provider –IncludeManagementTools

Note. SNMP is considered as deprecated and may be removed in future Windows builds. Instead of SNMP, it is recommended to use the Common Information Model (CIM).

Enable and Configure SNMP Service on Windows Computer

The SNMP feature adds two new services snap-in:

• SNMP Service — this is the primary SNMP agent service, that tracks activity and sends information;
• SNMP Trap — receives trap messages from local or remote SNMP agents, and forwards messages to the SNMP management app.

Start both SNMP services manually if they are stopped and change the startup type to Automatic.

Open the SNMP Service properties and go to the Agent tab. Fill in the Contact and Location fields (you can specify the user’s contact name and computer location). Then select the list of services from which you want to collect data and send it to the monitoring device. There are five options:

• Physical;
• Applications;
• Internet;
• End-to-end;
• Datalink and subnetwork.

Click the Security tab. Here you can configure various security settings for your SNMP servers.

The list of Accepted community names contains the names of the communities whose SNMP hosts are authenticated to send SNMP requests to this computer. The community’s name has the same functions like login and password.

Click the Add button and specify the Community Name and one of the five access levels:

• None
• Notify
• READ ONLY
• READ WRITE,
• READ CREATE

READ WRITE is the maximum privilege level that allows the SNMP management application to make changes to the computer. For monitoring systems, it is usually enough to select READ ONLY (the monitoring server can only query the device, but cannot make any changes). In this example, we added a community name public with READ ONLY permissions.

Add a list of monitoring servers (IP addresses) to the Accept SNMP packets from these hosts from which you want to accept SNMP packets. This could be your monitoring system, for example, Zabbix, Nagios, Icinga, OpenNMS, PRTG, and Microsoft System Center Operations Manager (SCOM).

Tip. If you select the Accept SNMP packets from any host option, your SNMP agent will accept packets from any host without restrictions. This option is not recommended for use on public computers for security reasons.

Save the changes and restart the SNMP service.

Hint. To enable your Windows host to receive and send SNMP queries and traps, you need to open SNMP ports in Windows Defender Firewall. Two ports are used: UDP 161 (SNMP) and UDP 162 (SNMPTRAP). You can open inbound and outbound SNMP ports in Windows using the following commands:

netsh advfirewall firewall add rule name="SNMP UDP Port 161 In" dir=in action=allow protocol=UDP localport=161

netsh advfirewall firewall add rule name="SNMP UDP Port 161 Out" dir=out action=allow protocol=UDP localport=161

netsh advfirewall firewall add rule name="SNMPTRAP UDP Port 162 In" dir=in action=allow protocol=UDP localport=162

netsh advfirewall firewall add rule name=" SNMPTRAP UDP Port 162 Out" dir=out action=allow protocol=UDP localport=162

Configuring SNMP Settings in Windows via Group Policy

There are several GPO options that allow you to configure SNMP parameters for multiple Windows hosts from a central location. These parameters are located in the GPO editor (gpedit.msc) under Computer Configuration > Policies > Administrative Templates definitions > Network > SNMP.

• Specify communities — specify a list of communities for the SNMP service;
• Specify permitted managers — Specify a list of allowed hosts that can send SNMP queries to the Agen;
• Specify traps for public community — configure Simple Network Management Protocol trap settings.

Another way to configure SNMP parameters is through the registry. These parameters are set in the following Registry Editor key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters.

You can configure SNMP parameters as needed on a reference computer, export them to a REG file, and deploy the REG file to computers via GPO (Computer Configuration > Preferences > Windows Settings > Registry).

Windows only supports SNMP v1 and SNMP v2c versions. These versions of the protocol are not encrypted. This means that an attacker can intercept all your SNMP data and view it in clear text. Windows doesn’t support SNMP v3, which is an encrypted and more secure protocol.