1. Installing SNMP feature on windows server 2019: Using Server Manager:
  2. Open Server Manager.
  3. Click Manage in the top-right corner and select Add Roles and Features.
  4. Click Next until you reach the Features section.
  5. Scroll down and check the box for Simple Network Management Protocol (SNMP).
  6. Click Add Features in the pop-up window if prompted.
  7. Click Next and then Install

Using PowerShell :

  1. Open PowerShell as an Administrator.
  2. Run the following command:
Install-WindowsFeature SNMP-Service -IncludeManagementTools

sn_1

Misconfiguration:

Configure Vulnerable Settings

The primary vulnerability in older SNMP versions (v1 and v2c) comes from using guessable community strings, which act like plaintext passwords. The most common default string is “public”.

  1. Press Win + R, type services.msc, and press Enter. sn_2
  2. Find the SNMP Service in the list, right-click it, and select Properties. sn_3 sn_4
  3. Go to the Security tab. This is where you’ll set the weak configurations. sn_5
  4. Set a Weak Community String:
    • Under the Accepted community names section, click Add.
    • Set the Community rights to READ ONLY (or “READ WRITE” for a more critical vulnerability).
    • In the Community Name box, type public. sn_6
    • Click Add.
  5. Allow Access from Any Host:
    • Below the community names, select the radio button for Accept SNMP packets from any host.
    • Security Note: In a real environment, this is a major security risk. It allows any device on the network to query your server’s SNMP data. For secure setups, you would always choose “Accept SNMP packets from these hosts” and specify the IP address of your monitoring server.
  6. Click Apply and then OK.
  7. Restart the Service:
    • Right-click the SNMP Service again in the services.msc window and select Restart to apply all your changes.

Your server is now configured with the notoriously insecure “public” community string, accessible from any host on the network. This setup is ideal for testing vulnerability scanners (like Nmap or Nessus) to see how they detect this misconfiguration.