Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud Apps
Cloud and workloads

Configure automatic log upload using on-premises Docker on Windows | Microsoft Defender for Cloud Apps

4 September 2026Doc update+15 / −13 lines

In brief

The documentation clarifies Windows Docker-based deployment steps, including rerunning LogCollectorInstaller.ps1, the Docker Desktop WSL 2 message, and separate Syslog and FTP forwarding guidance. Screenshot descriptions and prerequisite wording were also updated.

What Defender admins need to know

Administrators deploying the log collector have clearer instructions for completing deployment and configuring data sources. No administrator action is required for this documentation update.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Configure automatic log upload using on-premises Docker on Windows

Prerequisites

Before you deploy the log collector, make sure the following prerequisites are met:

  • Firewall log forwarding must be configured to send logs to the log collector host machine.

  • Architecture specifications:

    1. Name your proxy or firewall.

      Screenshot of the Add data source dialog with fields for name, source, and receiver type.

    2. Select the appliance from the Source list. If you select Custom log format to work with a network appliance that isn't listed, see Working with the custom log parser for configuration instructions.

    3. Select all Data sources that you want to connect to the collector, and select Update to save the configuration.

      Further deployment information appears in the dialog's Next steps section, including a command you'll use laterused in Step 2 – On-premises deployment of your machine to import the collector configuration. If you selected Syslog, this information also includes data about which port the Syslog listener is listening on.

    4. Use the Copy command to clipboard Copy button to copy the command to the clipboard and save it to a separate location.

    5. Use the Export data source configuration Export button to export the expected data source configuration. This configuration describes how you should set the log export in your appliances.

For users sending log data via FTP for the first time, we recommend changing the password for the FTP user. For more information, see Changing the FTP password.

Step 2 – On-premises deployment of your machine

The following steps describe deployment of the deployment inDocker-based log collector on Windows. The deployment steps for other platforms are slightly different.

  1. Open a PowerShell terminal as an administrator on your Windows machine.

    The machine automatically restarts after you run the command.

  2. When the machine is up and running again, run the same commandLogCollectorInstaller.ps1 script again: 

    & (Join-Path $Env:Temp LogCollectorInstaller.ps1)`

  3. After the restart is completed, open the Docker client and accept the Docker subscription agreement.

  4. If the WSL2WSL 2 installation isn't completed, Docker Desktop displays a message shows to indicateindicating that the WSL 2 Linux kernel ismust be installed using a separate MSI update package.

  5. Complete the installation by downloading the package. For more information, see Download the Linux kernel update package.

Step 3 - On-premises configuration of your network appliances

Configure your network firewalls and proxies to periodically export logs to the dedicated Syslog port of the FTP directorylog collector according to the directions in the Create log collector dialog. For Syslog data sources, forward logs to the collector's assigned Syslog port. For FTP data sources, export logs to the collector's FTP destination directory. For example: 

BlueCoat_HQ - Destination path: \<<machine_name>>\BlueCoat_HQ\

![Screenshot of the custom continuous report configuration page showing filters for data source, user groups, and IP address tags or ranges.](media/custom-continuous-report.png)

Optional - Validate installer signature

  1. Select Digital Signatures and make sure that it says This digital signature is OK.

  2. Make sure that Microsoft Corporation is listed as the sole entry under Name of signer.

    Screenshot of digital signature details confirming the file is validly signed by Microsoft Corporation.

    If the digital signature isn't valid, it will say This digital signature is not valid:

    Screenshot of digital signature details indicating the signature verification failed.

Next steps