diff --git a/libbeat/docs/shared-central-management.asciidoc b/libbeat/docs/shared-central-management.asciidoc
index d3e815e2715..7eb6bbd1a3e 100644
--- a/libbeat/docs/shared-central-management.asciidoc
+++ b/libbeat/docs/shared-central-management.asciidoc
@@ -176,8 +176,33 @@ The URL of the {kib} instance you will use for central management.
 The enrollment token generated by the {cm-ui} UI. The enrollment token will
 expire as soon as it's used.
 
+For example:
+["source","shell",subs="attributes"]
+----------------------------------------------------------------------
+{beatname_lc} enroll http://xyz.gov:5601 70f4b584e8024b96b682c46125a8d81
+----------------------------------------------------------------------
+
 Repeat this process to enroll additional {beats}.
 
+// Maintainers: If you update the following note, also update the note that
+// appears later in this file.
+
+[IMPORTANT]
+=====
+*Windows users:* If you installed {beatname_uc} as a service, you must also set
+`-path.data` to +"C:{backslash}ProgramData{backslash}{beatname_lc}"+ when you
+run the enroll command. For example:
+
++.{backslash}{beatname_lc}.exe enroll http://xyz.gov:5601 70f4b584e8024b96b682c46125a8d81a
+-path.data "C:{backslash}ProgramData{backslash}{beatname_lc}"+
+
+Why? The service installation script, +install-service-{beatname_lc}.ps1+,
+changes the default data path to match the convention used for Windows. If you
+run the enroll command without specifying the correct data path, {beatname_uc}
+will be enrolled in central management with the wrong UUID and unable to receive
+the configuration.
+=====
+
 [float]
 [[username-password-enrollment]]
 === Username and password-based enrollment
@@ -203,6 +228,30 @@ The method to use for getting the password. Available options are:
 *`--force`*::
 Overwrites the current settings without asking for confirmation.
 
+For example:
+
+["source","shell",subs="attributes"]
+----------------------------------------------------------------------
+{beatname_lc} enroll http://xyz.gov:5601 --username myuser --password stdin
+----------------------------------------------------------------------
+
+[IMPORTANT]
+=====
+*Windows users:* If you installed {beatname_uc} as a service, you must also set
+`-path.data` to +"C:{backslash}ProgramData{backslash}{beatname_lc}"+ when you
+run the enroll command. For example:
+
++.{backslash}{beatname_lc}.exe enroll http://xyz.gov:5601 --username myuser --password stdin
+-path.data "C:{backslash}ProgramData{backslash}{beatname_lc}"+
+
+Why? The service installation script, +install-service-{beatname_lc}.ps1+,
+changes the default data path to match the convention used for Windows. If you
+run the enroll command without specifying the correct data path, {beatname_uc}
+will be enrolled in central management with the wrong UUID and unable to receive
+the configuration.
+=====
+
+
 
 //[[central-management-API]]
 //== Enrollment API (not documented for beta)