Authenticate to review enrolled endpoints.
SHARED CATALOG · POLICY INFRASTRUCTURE
Known does not mean approved. No execution blocking, automatic approvals or compliance scanning is enabled.
Not loaded
WinGet does not provide verified signer identities. This filter remains empty until verified evidence is collected.
| Application | Publisher metadata | Versions |
|---|
Indexed SHA-256 lookup, separate from policy approval. Installer hashes do not cover every file an application installs.
Draft configuration only. Resolution: agent → company → global. No assignments exist by default. “No policy” explicitly stops inheritance; “Inherit” uses the next level. Editing a policy changes all scopes assigned to it.
Use exact hashes, verified signer certificate hashes, or exact WinGet package IDs. Package rules accept a versions array or versionScope: "all" (not both). All includes older and future cataloged versions; recorded version risks override allows in policy previews. No wildcard package IDs or publisher-name trust.
These settings do not deploy enforcement or change what endpoints can execute.
DEPLOYMENT
Download one MSI with everything the endpoint needs, already assigned to the right company.
Compatible agents automatically receive the newest published signed release at check-in. Active support/terminal sessions defer automatic updates; failed installs require review before retry. Updates preserve identity and company and do not automatically reboot Windows. Agents older than v0.8.8 need a bootstrap MSI once.
Leave the company unselected for a reusable installer: unlimited new endpoints, no enrollment expiry, all checked in to Unassigned for later assignment. Company-specific downloads remain single-use for 24 hours.
The controller URL must be reachable from the endpoint and covered by the controller TLS certificate.
Keep these installers private. Revoke a key to block new enrollments using that installer; already enrolled machines stay connected. Download a new installer for a replacement key.
Sign in to view installer keys.
OPERATIONS
Latest 250 jobs, retained across controller restarts. Leased means delivered, not finished. An update's staging result is not installation verification; see Downloads for update health.
| Machine / company | Action / target | Status | Requested | Controls |
|---|
PROACTIVE HEALTH
Evaluated every 15 seconds while this controller runs. Alerts stay open if evidence becomes unknown. Notifications are in-console only; no email, webhook, or automatic remediation is configured.
| Endpoint | Condition | State | Opened | Controls |
|---|
CPU, memory, fixed-disk space and security checks require fresh, sustained evidence. Offline and stale-inventory limits include their own delay. Watched services are evaluated when full inventory arrives (normally every 15 minutes), not on every heartbeat. Acknowledgement does not resolve a condition.
EVIDENCE & DIAGNOSTICS
Configuration changes, evidence quality, performance history, comparison and technician handoff. These views use inventory already collected; they do not run commands.
“Collected” is not “healthy.” Each provider may have limitations. Old agents do not report precise security-provider availability.
| Section | Quality | Collected | Duration | Limitations |
|---|
Suppresses alert attention only; does not pause collection, execution or security controls.
Overrides are merged with the global policy. Empty JSON object inherits everything. Only supported policy fields are accepted; saving restarts this endpoint's sustained-condition windows.
UTC avoids daylight-saving ambiguity. This does not authorize or schedule endpoint actions.
Requires at least 12 hourly samples over 12 hours. Missing data, capacity changes and inconsistent growth prevent a forecast. Estimates are not guarantees.
New agents normally collect stats every five minutes; older agents may sample faster. At most one sample per minute is retained for seven days. Displays the latest 1,440 recorded samples; gaps are not filled with invented values. CPU is an interval average, so brief spikes may be missed.
Observed differences, not proven causes. Changes retained 30 days, capped at 1,000 batches per endpoint; latest 100 batches shown. Reordering and transient service/task runtime states are ignored.
Choose a similar, known-working machine in the same company. Stale or unavailable source data is disclosed; this comparison never changes either endpoint.
Creates a deterministic summary of check-ins, evidence gaps, alerts, changes and recent jobs. Review before copying into a ticket.
| Time | Event | Actor | Details |
|---|