# Windows DDI Discovery Node Agent for DNS/DHCP Management | ManageEngine DDI Central

**DDI Central · Windows Discovery Node Agent**

## Lightweight Windows DDI Discovery Node Agent  
### Built for Scale and Security

Discover, sync, and manage Windows DNS/DHCP servers with continuous and centralized visibility. Meet the DDI Central Windows Discovery Node Agent — a lightweight, secure agent that puts DNS/DHCP processing directly onto your Windows servers. No WinRM. No remote PowerShell. Just a single HTTPS channel delivering real-time discovery, continuous sync, and centralized visibility from one Management Console.

- Single HTTPS channel
- Continuous discovery
- DNS + DHCP in one sweep
- Built for DMZs

## What Is the Windows DDI Discovery Node Agent?

The DDI Central Windows Discovery Node Agent enables agent-based communication between your onboarded Windows DNS/DHCP servers and the DDI Central Management UI. It's a lightweight service installed directly on each Windows DNS/DHCP server, establishing a persistent, HTTPS-based channel between the server and the console.

Once installed, the agent takes over all configuration control and DNS/DHCP process management on behalf of the App Console — replacing WinRM-based (agentless) communication. Every onboarded server processes its own discovery, updates, and configuration tasks locally. The round trip to the app console is reserved only for sync and updates, giving admins centralized, continuous visibility from the Management UI.

**Your infrastructure, your choice.** DDI Central supports both agent-based and agentless (WinRM) communication in parallel. Pick the model that fits your security policy — or run both side by side.

## Why processing at the node changes everything

From one-time discovery to continuous DDI visibility. With agentless WinRM, the App Console does all the heavy lifting — remotely executing PowerShell on every server. The Discovery Node Agent flips this model.

### Agentless · WinRM  
#### Console does all the work

Every server depends on the console for discovery, updates, and sync. Round trips on every action.

### Agent · HTTPS  
#### Processing lives at the node

Each server processes locally. Round trips are reserved for sync and updates — quiet, fast, always current.

- Processing is internalized within each onboarded Windows server — no round trips for routine work.
- The console round trip is reserved only for sync and updates.
- The result: faster operations, lower network chatter, and an always-current console.

## Lightweight agent, heavyweight capabilities

Small on the server. Big on what it can do.

### Minimal footprint
Low CPU and memory usage, designed to never impact server performance.

### Simple installation
Installs in minutes on any Windows Server DNS/DHCP node via a guided wizard.

### Secure by design
All communication flows over a single encrypted HTTPS port. Nothing else to open.

### Full feature parity
Discovery and management capabilities equivalent to WinRM-based communication.

### Centrally managed
Configuration and updates are pushed from the DDI Central console — no server-by-server maintenance.

### Built for locked-down environments
Ideal for high-security networks, DMZ segments, and sites with strict WinRM restrictions.

## Why the Discovery Node Agent matters for Windows infrastructure

### Scalability
WinRM struggles at scale. The Discovery Node Agent handles high-volume deployments reliably — the recommended choice for managing more than 10 Windows servers. Apply collective policies to server groups and scale without friction.

### Security compliance
A fully capable alternative for organizations that restrict or prohibit WinRM. The agent thrives where WinRM can't — DMZs, air-gapped-adjacent segments, and compliance-heavy environments.

### Simplified connectivity
One HTTPS port. That's it. No PowerShell remoting, no WinRM configuration, no firewall gymnastics.

### Real-time change detection
The agent detects DNS/DHCP configuration changes on the Windows server as they happen and syncs them to the App Console automatically — so your console always reflects the live state.

### Bulk import at scale
Onboard hundreds of servers in one go. Import via CSV or XLSX — Agent-Based or Agentless. Choose the import type, upload the file, and DDI Central onboards them all.

### Console-driven agent updates
Update the agent itself directly from the main console. No manual patching, no logging into individual servers.

## What makes DDI Central's Discovery Node Agent stand out

1. ### One agent, complete discovery  
   Some DDI agents in the market support only one Discovery Job per instance — meaning two servers for DNS and DHCP separately. The DDI Central agent discovers both DNS and DHCP with a single agent, in a single sweep.

2. ### Discovery that never stops  
   Discovery isn't a one-time onboarding event. The agent continuously discovers configurations and pushes every change to the App Console — keeping it in perfect sync.

3. ### Zero-script, wizard-driven installation  
   No commands. No scripts. A simple wizard on any Windows server you want to manage — configure and you're onboarded.

4. ### Centralized, continuous visibility  
   View and manage every onboarded server from a single console. Health, configurations, sync status — one pane of glass, always up to date.

5. ### Flexibility without compromise  
   Agent-based and agentless communication coexist in the same deployment. Switch at your own pace, or mix models per site.

6. ### Bulk import for both models  
   Import large volumes of Windows servers via CSV or XLSX for both Node Agent and WinRM-configured servers. One import, entire fleet onboarded.

7. ### Persistent HTTPS-based communication  
   A secure HTTPS channel between each Windows server and the App Console. Reduces dependency on WinRM ports and remote PowerShell.

8. ### Internalized processing  
   The agent handles DNS/DHCP configuration and process management locally on the Windows server, reducing unnecessary round trips.

9. ### Better suited for scale  
   Recommended for environments with more than 10 Windows DNS/DHCP servers — supports scale, improves reliability, applies collective policies to target groups.

10. ### Centralized updates and policy control  
    Push agent config and updates from the DDI Central console. Apply policies across Windows server groups by site, role, environment, or security zone.

## Built for secure and scalable Windows DNS/DHCP operations

### Reduce WinRM dependency
Use the Discovery Node Agent where WinRM is restricted, prohibited, or difficult to maintain across many Windows DNS/DHCP servers.

### Simplify connectivity
Agent-based communication uses HTTPS, reducing the need for WinRM configuration, WinRM ports, and remote PowerShell operations.

### Keep configurations continuously updated
The agent detects DNS/DHCP configuration changes in real time and automatically syncs them with the DDI Central App Console.

### Improve operational control
Admins view onboarded servers, monitor changes, track health, manage updates, and apply policies — all from the main Management UI.

### Support high-security environments
Ideal for DMZ segments, segmented networks, and organizations with strict server access and communication policies.

## Windows agent-based vs agentless communication

Choose the right model for your Windows DNS/DHCP infrastructure.

| Feature Comparison | Agent-Based · Discovery Node Agent | Agentless · WinRM |
|---|---|---|
| Setup | Wizard-based install — no scripts or commands | WinRM configuration required on every managed server and the console |
| Communication channel | Single secure HTTPS port | WinRM protocol + remote PowerShell execution |
| Installation on Windows server | Yes, lightweight agent | No |
| WinRM dependency | Not required | Required |
| PowerShell dependency | Reduces dependency on remote PowerShell | Uses remote PowerShell via WinRM |
| Processing model | Locally, on each onboarded Windows server — agent handles sync, monitoring, and DNS/DHCP config management | Entirely console-side; managed servers rely on the console for every action |
| DNS and DHCP discovery | Discovered together in a single sweep | Depends on console-driven WinRM communication |
| Discovery behavior | Continuous discovery + real-time change sync after onboarding | Initiated through onboarding or scheduled sync cycles |
| Round trips | Only for sync and updates | Every discovery, config update, and sync operation |
| Change detection | Agent detects and syncs changes automatically | Depends on console-driven discovery or sync |
| Connectivity requirement | Single HTTPS channel | WinRM ports and configuration |
| Centralized visibility | Yes, with continuous updates from onboarded servers | Yes |
| Centralized management | Yes | Yes |
| Agent / config updates | Pushed centrally from the console | Not applicable (no agent to maintain) |
| Scale fit | Built for large fleets | Best suited for smaller environments where WinRM is approved |
| Recommended deployment size | Larger Windows DNS/DHCP deployments (10+ servers) | Smaller or standard Windows environments |
| Security fit | Ideal for DMZs and WinRM-restricted, segmented environments | Requires WinRM enabled and permitted |
| Bulk onboarding | CSV / XLSX (Agent-Based import type) | CSV / XLSX (Agentless import type) |
| Collective policy application | Apply policies to target server groups | Managed per connection |
| Feature parity | Full | Full |

## When should you choose the Discovery Node Agent?

Use the Windows DDI Discovery Node Agent when any of the conditions below describes your environment.

### One console. Two communication models. Continuous Windows DDI control.

DDI Central lets teams manage Windows DNS/DHCP infrastructure using either agentless WinRM or agent-based communication through the Discovery Node Agent. Agentless remains available where WinRM is approved and manageable. For larger deployments, stricter security policies, segmented networks, and continuous-visibility requirements, the Discovery Node Agent delivers a more scalable and operationally efficient model.

- You manage more than 10 Windows DNS/DHCP servers
- You want to discover DNS and DHCP together from onboarded servers
- You need continuous configuration discovery after onboarding
- Your organization restricts or prohibits WinRM
- You want secure HTTPS-based agent communication
- Your Windows DNS/DHCP servers sit in DMZ or segmented environments
- You want local DNS/DHCP process management on each server
- You need centralized visibility across distributed servers
- You want to apply collective policies to Windows server groups
- You want agent updates pushed from the main console

## Frequently Asked Questions

Answers to the most common questions about the Windows DDI Discovery Node Agent, agent-based vs agentless communication, onboarding, and centralized management.

### What is the DDI Central Windows Discovery Node Agent?

It's a lightweight service installed directly on your Windows DNS/DHCP servers that enables agent-based communication with the DDI Central App Console over a persistent, secure HTTPS channel. Once installed, the agent handles all data transfer and DNS/DHCP process management locally on the server — replacing the need for WinRM-based communication.

### How is agent-based communication different from agentless (WinRM)?

With agentless communication, the App Console does all the processing — connecting to each server over WinRM and executing PowerShell scripts remotely for discovery, updates, and sync. With the Node Agent, processing happens locally on each onboarded server, and the console round trip is reserved only for sync and updates.

### Do I have to choose one communication method for my entire environment?

No. Agent-based and agentless communication run in parallel within the same deployment. You can mix models per site or per server based on your security policy, or migrate gradually at your own pace.

### When should I use the Discovery Node Agent instead of WinRM?

The Node Agent is recommended when managing more than 10 Windows servers, or in high-security environments, DMZ segments, and sites where WinRM is restricted or prohibited.

### Will the agent slow down my Windows servers?

No. The agent is designed with a minimal footprint — low CPU and memory usage — so it won't impact DNS/DHCP server performance.

### Do I need to run scripts or commands to install the agent?

No scripts, no commands. Installation is fully wizard-driven — run the installer on any Windows server you want to manage, configure the agent, and it's onboarded.

### Can one agent discover both DNS and DHCP?

Yes. A single Discovery Node Agent discovers both DNS and DHCP in one sweep — no need to deploy separate agent instances for each service.

### Is discovery a one-time event during onboarding?

No. The agent continuously discovers configurations and syncs every change — configurations, health, and settings — to the App Console in real time, so the console always reflects the live state of your servers.

### How do I onboard a large number of Windows servers at once?

Use the bulk import option. From the Import option in the Servers section, choose Agent-Based or Agentless as the import type and upload a CSV or XLSX file. Servers must be available and reachable during the import, and import speed scales with the number of servers in the file.

### How is the agent itself updated and configured?

Centrally, from the DDI Central console. Agent configuration and updates are pushed from the main console — no logging into individual servers or manual patching.

### What ports and protocols does the agent use?

All communication flows through a single secure HTTPS port. No WinRM configuration, no PowerShell remoting, and no complex firewall rules required.

### Does the agent offer the same capabilities as WinRM-based management?

Yes. The Discovery Node Agent delivers discovery and management capabilities equivalent to WinRM-based communication — the difference is where the processing happens and how the servers connect.

### Can I view all onboarded servers in one place?

Yes. Every onboarded server — agent-based or agentless — is visible from the Management UI Console, giving admins and users centralized, continuous visibility into configurations, health, and sync status.

### Can I apply policies to multiple servers at once?

Yes. You can apply collective policies to target groups of servers, making fleet-wide configuration management fast and consistent.