Controller locked
Sign in to review enrolled machines.
Sign in to review enrolled machines.
RECOVERY
Set a company backup policy, then approve the first backup for each device. Daily backups begin after that first backup completes. Device policies can override company settings.
Active operations and saved restore points. Request a backup below, then approve it in Jobs. Verify recovery with a restore and boot test.
| Device | Status | Uploaded | Recovery / action |
|---|
Choose a completed point above to create full VHD files. Exported files expire after seven days; the encrypted restore point is preserved.
New policies retain one completed restore point per device by default. Protected points remain in addition to normal retention. Unchanged blocks are shared; each point has a complete disk map. Partial uploads count against storage until discarded. A new capture reserves its upload budget before it starts.
Windows snapshots stream to encrypted storage. Each backup scans allocated blocks and uploads new blocks. The device needs free space for snapshot changes.
Pilot backups capture crash-consistent filesystem snapshots. Supports basic internal GPT/MBR disks with 512-byte logical sectors up to 2040 GiB. Readiness creates snapshots and checks disk access. Validate application recovery and boot recovery with a restore test.
Prepare a restore point for authenticated download. Boot the destination into recovery media to restore the image, then test startup and applications.
| Device | Effective policy | Capture | Actions |
|---|
Enable encrypted controller backups on this management machine's D: drive. Each instance has separate storage. Older versions are removed after a replacement is verified. Recovery requires this machine's Windows identity and intake encryption key.
Includes controller data and configured identity files. Use Image backups for endpoint disks and a recovery bundle to recover onto a clean host.
Manage shared catalogs, approved vendor packages and app rules. Install software on a selected machine in Machines > Software.
Open to load the library
Search the local WinGet catalog for package names, versions and installer details.
Signer filters use verified certificate evidence collected for indexed files.
| Application | Publisher metadata | Versions |
|---|
Find an indexed file by its SHA-256 hash and review its recorded identity.
Configure policy previews and assignments. Policies resolve from machine to company to global. “Stop inheritance” clears the effective policy; “Inherit” uses the next level. Editing a policy updates every assigned scope.
Use exact hashes, verified signer certificate hashes, WinGet package IDs, or namespaced NuGet IDs (nuget:package.name). Choose either a versions array or versionScope: "all" for each package rule. Use exact package IDs. NuGet rules cover indexed versions. "All" includes older and future indexed versions; recorded version risks override allows in policy previews.
Assign a single machine in Machines > Software > App rules.
Saved settings control policy previews and scope assignments.
Promote a verified Software, Windows updates, or catalog install pilot within its company. The first selected target is the canary. Each later target waits for verified success; failure or uncertainty pauses the remainder. At most two install/staging jobs occupy deployment slots.
ENROLLMENT AND UPDATES
Download an installer to add machines, or manage updates for enrolled agents.
Choose Unassigned for a reusable installer that enrolls new machines until its key is revoked. Assign those machines to a company after enrollment. Company installers enroll one machine within 24 hours.
Create a company claim for manual agent configuration.
Claims are displayed once.
Publish a tested, signed release, then authorize rollout. Pause holds updates awaiting delivery; delivered installations may finish. Automatic updates wait for active support sessions to end. Agents older than v0.8.8 require an initial MSI upgrade.
Automatic rollout matches each device's reported controller URL, including its port. Verify the installed URL manually for older devices.
Keep these installers private. Revoke a key to block new enrollments using that installer; already enrolled machines stay connected. Download a new installer for a replacement key.
Sign in to view installer keys.
The controller URL must be reachable from the endpoint and covered by the controller TLS certificate.
Retirement revokes the endpoint credential and preserves its history. Link a replacement record to keep the relationship visible.
ADMINISTRATION
Review controller readiness and manage operator access.
OPERATIONS
Shows the latest 250 jobs with saved history. Leased means delivered to the device. Check Agent deployment for verified agent update results.
| Machine / company | Action / target | Status | Requested | Controls |
|---|
PROACTIVE HEALTH
Checks conditions every 15 seconds while the controller runs. Alerts stay open while evidence is unavailable. Configure Alert delivery and outbox below to receive notifications.
| Endpoint | Condition | State | Opened | Controls |
|---|
CPU, memory, fixed-disk space and security checks require fresh, sustained evidence. Offline and stale-inventory limits include their own delay. Watched services are checked when full inventory arrives, normally every 15 minutes. Acknowledgement records that an operator has reviewed the alert; resolution follows healthy evidence.
Configure an HTTPS webhook and enable delivery to receive new alert and resolution events. Acknowledge or suppress an alert before delivery to stop its pending notification.
EVIDENCE & DIAGNOSTICS
Review collected inventory, configuration changes, data quality and performance history. Compare machines or generate a technician handoff.
Review when each section was collected and how complete its data is. Current agents report security-provider availability.
| Section | Quality | Collected | Duration | Limitations |
|---|
Temporarily hides alerts from the attention list during maintenance.
Override selected global policy settings for this device. An empty JSON object uses the global policy. Saving restarts the time windows used to evaluate sustained conditions.
Schedule weekly alert suppression using UTC times.
Estimates when a disk may fill using at least 12 hourly samples over 12 hours. A forecast requires consistent capacity and growth data.
Shows up to 1,440 recorded performance samples from the last seven days. Current agents usually sample every five minutes. CPU values are averages over each sampling interval.
Shows the latest 100 groups of observed configuration changes. Retains up to 1,000 groups per device for 30 days.
Compare saved configuration with a known-working machine in the same company. Results include the age and availability of the source data.
Summarizes check-ins, data gaps, alerts, changes and recent jobs. Review the summary before copying it into a ticket.
| Time | Event | Actor | Details |
|---|