Windows tells you everything about itself, on the machine, while you are looking at it. Task Manager, Performance Monitor, Event Viewer — all excellent, all silent. Nothing in that box will call you when the D: drive fills at 4 AM or when the machine stops existing. Here is how to put real alerting on a Windows Server in about five minutes, without exposing RDP, WinRM or SNMP to the internet.
The instinct is to poll the server from outside: an uptime checker that pings it, or a monitoring box that reaches in over WMI or WinRM. Both run into the same wall. A domain controller, a file server or a line-of-business box normally has no public IP at all, and the ones that do should not be answering management protocols on the open internet.
The alternative most people reach for is an agent that needs a management server, a database and a web front end running somewhere inside the network — a lot of machinery to answer “is the file server still alive?”
Turn the connection around instead. Run a small agent on the Windows box that pushes out over HTTPS on 443, the same way the machine already talks to Windows Update. Nothing inbound, no port forward, no VPN, nothing for your firewall team to approve.
From an elevated PowerShell on the server:
The installer refuses to run unelevated rather than half-installing.
Three things worth knowing about what that did:
C:\Program Files\pylon-beacon, with its settings in beacon.conf next to the binary.Being precise here matters, because the Windows and Linux collectors are not identical:
| Metric | On Windows |
|---|---|
| CPU | Percentage, measured as the delta between two gathers. The very first push after a restart omits it — there is no previous sample to compare against yet. |
| Memory | Percentage in use, taken straight from Windows. |
| Disk | Percentage used per fixed drive — C:\, D:\ and so on, each reported separately rather than rolled into one number. |
| Uptime | Seconds since boot. Useful mostly as a way to catch a restart you did not order. |
| Network | Bytes in and out, as machine totals. |
Thresholds are the obvious half. CPU over 90%, disk over 85% — fine, set those.
The half that actually catches the bad night is silence. Every push is a dead-man’s switch: the agent says “still here” on an interval you choose, and when it stops saying it, that absence is the alert. A threshold can only fire while the machine is alive to report a number. A machine that blue-screened, lost power, lost its NIC or was deleted by someone else’s script reports nothing at all — and nothing is exactly what most monitoring treats as fine.
The check-in interval is the SLA, and a grace period rides on top so a slow minute is not an outage:
The recovery carries the vitals, so you often know why before you open anything.
The built-in metrics are deliberately generic. For anything specific to your server — a service that must be running, a queue depth, last night’s backup exit code — add a custom command. Anything that prints a number works:
Those arrive as metrics next to CPU and disk, and you can alert on them the same way. A service check becomes “alert when spooler_up drops below 1”.
Printers, switches, a NAS appliance, the badge reader — anything that will never run an agent. The Windows box you just set up can reach them on the LAN, so let it do the checking. The agent can run HTTP, TCP and ping probes against other addresses on your network, and each target becomes its own monitor with its own alerts:
One agent, several monitored devices. Nothing on those devices changes.
This is the pattern that scales in a small network: one or two agents on machines you control, probing everything else from inside.
| Signal | Page someone? |
|---|---|
| The machine went quiet | Yes. This is the one that means something is really wrong. |
| A fixed drive over ~85% | Yes, but as a warning with room to act — a full C: drive on a domain controller is a bad morning. |
| A custom service check failing | Yes, if the service actually matters to someone. |
| Memory percentage | Chart it. Windows will happily sit at 95% by design; it is not news on its own. |
| CPU spikes | Chart it. Busy is what servers are for. Page on the effect, not the CPU. |
A Windows Server that reports its own health every thirty seconds, pages you when it stops, carries a couple of checks specific to what that box is for, and watches a handful of devices around it that could never be monitored otherwise — without a single inbound firewall rule, management server or VPN.
The agent is open source and the free plan covers three machines, so the honest way to evaluate this is to put it on a real server and unplug something.
Agent documentation · Server monitoring · Monitoring a server with no public IP