By the SNMP Monitoring team · Reviewed July 2026
Windows Server ships with an SNMP agent, but it's an old one. The built-in SNMP Service speaks only v1 and v2c — no SNMPv3, no encryption — and Microsoft has been quietly deprecating it for years. It's still perfectly usable for basic health polling on a trusted management network, and this guide walks the whole path: add the feature, set a read-only community, restrict which managers may talk to it, open the firewall, and test. Just go in knowing its limits, and where to reach for something better.
Parent: setup. Siblings: Ubuntu/Debian, CentOS/RHEL.
Security caveat first
Read this before you enable anything. The Windows SNMP Service is legacy:
- It supports SNMPv1/v2c only — the community string travels in cleartext, so anyone who can sniff the segment reads it.
- Its access control is weak: an accepted-community-names list and an accept-from-these-hosts list, both spoofable.
- Microsoft has deprecated the feature in newer Windows releases; it may not survive future versions.
So use it only on a trusted management VLAN, never across untrusted networks or the internet. Where security actually matters, prefer a v3-capable third-party agent, or pull the same data over WMI — see SNMP vs WMI. Don't expect this agent to give you v3; it can't.
Step 1: Add the SNMP Service feature
SNMP is an optional feature, off by default. Install it via Server Manager or, faster, PowerShell:
Install-WindowsFeature SNMP-Service -IncludeManagementTools
Success Restart Needed Exit Code Feature Result
------- -------------- --------- --------------
True No Success {SNMP Service, SNMP WMI Provider}
To do it by hand, or to confirm what the command did:
- Open Server Manager → Manage → Add Roles and Features.
- Skip to Features and tick SNMP Service (optionally SNMP WMI Provider).
- Click Install and let it finish — no reboot is normally required.
- Confirm the service is present in
services.mscas SNMP Service.
The optional SNMP-WMI-Provider exposes SNMP data through WMI as well; add it only if a tool needs that bridge.
Step 2: Configure community & security
With the service installed, its configuration lives in the service properties, not a text file. Open services.msc, find SNMP Service, right-click → Properties, and use the Security tab:
| Setting | What to set |
|---|---|
| Accepted community names | A random string, rights READ ONLY |
| Community rights | READ ONLY (never READ WRITE for monitoring) |
| Accept SNMP packets from these hosts | Your manager's IP(s) — not "any host" |
| Send authentication trap | Optional, for failed-auth alerting |
Add your community under Accepted community names with READ ONLY rights — never public, never READ WRITE. Then select Accept SNMP packets from these hosts and list only your polling server(s); leaving it on "Accept SNMP packets from any host" is the Windows equivalent of an unrestricted community. These two lists are all the access control this agent has, so set both.
Step 3: Agent tab
Switch to the Agent tab to populate the agent's identity and the service classes it reports:
- Contact and Location — fill these; they map to
sysContact/sysLocationand save time when an alert fires. - Service checkboxes — tick the categories that apply (Physical, Applications, Internet/End-to-end, Datalink). For a general server, Applications and Internet are the common picks.
These fields are cosmetic-but-useful: they're what a manager reads back to tell you which box and who owns it, so don't leave them blank.
Step 4: Firewall
The agent listens on UDP 161, and Windows Firewall will block inbound SNMP until you allow it. Add a rule scoped to your manager:
New-NetFirewallRule -DisplayName "SNMP-In" -Direction Inbound -Protocol UDP -LocalPort 161 -RemoteAddress 10.0.0.5 -Action Allow
Scoping -RemoteAddress to your poller means only that host can even reach the port — a useful second layer on top of the accept-from-hosts list. More on port rules in firewall setup.
Step 5: Test from a manager
From a Linux manager (or any box with net-snmp), confirm the agent answers:
snmpwalk -v2c -c S3cr3tR0str1ng 10.0.0.20 system
SNMPv2-MIB::sysDescr.0 = STRING: Hardware: Intel64 Family 6 - Software: Windows Version 10.0 (Build 20348)
SNMPv2-MIB::sysUpTime.0 = Timeticks: (7654321) 21:15:43.21
SNMPv2-MIB::sysContact.0 = STRING: netops@example.com
SNMPv2-MIB::sysName.0 = STRING: WIN-APP01
A sysDescr naming the Windows build and your sysContact coming back means the feature, community, host list, and firewall all line up. If it times out, re-check the accepted-hosts list and the firewall rule first — those are the usual culprits. See snmpwalk for more query options.
When to use WMI instead
Because the SNMP Service is legacy and cleartext, Windows-native monitoring often belongs on WMI, which is authenticated and integrated with Windows security. Reach for WMI (or a v3-capable agent) when you're collecting sensitive data, crossing untrusted networks, or want richer Windows-specific metrics than the standard MIBs expose. SNMP still wins when you need one uniform protocol across mixed vendors and want the same dashboards for Windows, Linux, and network gear. The trade-off is laid out in SNMP vs WMI, and Windows-specific monitoring in devices: Windows.
Frequently asked questions
How do I enable SNMP on Windows Server?
Install the optional feature with PowerShell — Install-WindowsFeature SNMP-Service -IncludeManagementTools — or via Server Manager → Add Roles and Features → Features → SNMP Service. Then open services.msc, edit the SNMP Service properties, set a read-only community and accepted hosts, and allow UDP 161 in the firewall.
Does Windows SNMP support SNMPv3?
No. The built-in Windows SNMP Service supports only SNMPv1 and v2c, which send the community string in cleartext. There is no native v3 (authentication/encryption) option. For encrypted access on Windows, use a third-party v3-capable agent or monitor over WMI instead.
How do I restrict which managers can poll Windows SNMP?
On the SNMP Service Security tab, select "Accept SNMP packets from these hosts" and list only your polling server's IP(s) instead of "any host." Pair that with a Windows Firewall rule that allows UDP 161 only from those addresses, so the port isn't even reachable from elsewhere.
Should I use SNMP or WMI on Windows?
Use SNMP when you want one protocol and one set of dashboards across mixed Windows, Linux, and network gear. Use WMI (or a v3 agent) when you need authenticated, encrypted collection or deeper Windows-specific metrics — the built-in SNMP Service is legacy v1/v2c and deprecated, so WMI is often the safer native choice.
Key takeaways
- Windows' built-in SNMP Service is legacy: v1/v2c only, cleartext, deprecated.
- Install with
Install-WindowsFeature SNMP-Serviceor Server Manager. - Set a random read-only community and list only your managers under accepted hosts.
- Fill Contact/Location on the Agent tab; allow UDP 161 to your poller in the firewall.
- Test with
snmpwalk -v2c -c <string> <host> system. - For sensitive or off-segment monitoring, prefer WMI or a v3 agent (SNMP vs WMI); for a zero-maintenance off-box health check, an external poller like ostr.io watches the server from outside.