I ran into a minor problem with installing the OSSEC Agent on Windows 2008 64bit.
After successful installation, the agent would not start with the error, "Unable to start OSSEC (check config)." I was able to track the problem down to the registry entry: HKLM\system\currentcontrolset\services\OssecSrv ImagePath - c:\program files (x86)\ossec-agent\ossec-agent.exe If you have other directories that start with c:\program...., Windows may not be able to find the ImagePath specified. To fix the problem, simply add quotes "c:\program files (x86)\ossec- agent\ossec-agent.exe" I am using the deployment process described at http://philipshramko.blogspot.com/ . To automate the change within the msi, I added the following line to the ossec_distribute_keys_x64.cmd file Reg ADD HKLM\System\CurrentControlSet\services\OssecSvc /v ImagePath / t REG_EXPAND_SZ /f /d "\"C:\Program Files (x86)\ossec-agent\ossec- agent.exe\"
