Every machine you run, from one console.
Take over a screen from the browser, roll out patches in rings, install software and know what hardware, software and licences you own. The agent that protects your data does the IT work too.
Everything IT does to a machine.
Each module works on the same fleet list, the same endpoint groups and the same audit trail. The group you build for patching is the group you deploy software to.
Remote control
See and drive a Windows or Linux desktop from the browser, with the person at the machine asked first if you choose.
Remote terminal
A live command line on a Windows machine, with every command kept in a transcript.
Patch management
Windows updates, applications, macOS updates and Linux packages, rolled out ring by ring.
Software deployment
Install or remove packages on chosen machines or groups, confirmed against each machine's inventory.
Asset management
Hardware, installed software, licences, warranty and the devices around them that have no agent.
Disk encryption
BitLocker status, TPM readiness and encryption method across the fleet, with encryption by policy.
Agent deployment
Computers found in Active Directory, and the agent pushed to them without a visit.
Endpoint groups
Groups that keep themselves current from rules over hostname, IP range, OS, OU and AD group.
Scripts and tools
A reviewed script library with typed parameters, run on a group, a selection or the whole fleet.
Usage time
Daily computer time per person and machine. A day nobody measured is shown as unmeasured.
Devices and applications
USB, application and browser control on the same agent and the same groups.
Vulnerabilities and hardening
What is weak on each machine, next to the patches that fix it.
Fix it on their screen, from your browser.
Find the machine, connect, and work. The screen is cut into tiles and only the tiles that changed are sent to the browser. Nothing is installed on the technician's side.
- Control or view only. Drive mouse and keyboard, or watch without sending input.
- Consent and notice. Asking the person and telling them are two separate settings, and changing either is written to the audit log.
- Session history. Who connected to which machine, when, the stated reason and the consent outcome.
- Recordings. Replay a session in the console, or export it as an ordinary video file for a ticket.
- Windows and Linux. Linux desktops running X11 are supported, with the same consent rules.
A patch reaches everyone only after it worked somewhere.
An approved update always starts with a small canary group. Tracemark waits for results, checks the success rate against your threshold, and only then widens. If too few machines succeed, the rollout stops itself.
Approve
By hand, or automatically above a minimum severity. Either way it starts at canary.
Canary
A small group you choose installs first. There is no option to skip it.
Pilot
Opens when canary passes the success gate and its soak period ends.
Broad
The rest of the workstations, a capped number installing at once.
Servers
Optional last ring, so servers and domain controllers stay out of the early waves.
Installed is a claim. Verified is a fact.
An installer's success message moves a job to installed. A machine counts as patched only when its next scan no longer lists the update, so an update waiting for a restart stays open until the scan after it.
- Beyond Windows Update. Applications through winget, Apple updates on macOS, and apt, dnf or apk packages on Linux.
- Maintenance windows in each machine's own local time.
- Restart policy with a warning to the person before the machine restarts.
- Rejected stays rejected. A declined package can be pinned on the machine so it is not updated by hand.
- Honest percentages. Machines that never reported a scan are not counted as patched.
Groups that stay correct by themselves.
Describe a group once with rules. A new laptop joins the right group, patch ring and deployment on its next check-in, with no sync job to wait for.
Hostname patterns
FIN-* reaches every machine whose name starts that way.
Rules over attributes
Platform, OS and agent version, IP range, domain, signed-in user, matched on all rules or any.
Active Directory
Organisational units and AD group membership as conditions.
Live preview
See which machines a rule set matches before you save it.
Static members
Hand-pick machines when a rule is the wrong tool.
Blast radius
Every policy, ring and rollout that uses a group is listed, and a group in use is protected from deletion.
Know what you own and what you can stop paying for.
The agent reports hardware and installed software from every machine. Licence usage comes from real application launches. A machine that cannot report is shown as unmeasured, never as unused, so the reclaim figure is one you can act on.
- Licence reclaim splits seats into used, unused and unmeasured.
- Lifecycle and warranty dates, imported in bulk, with alerts before they expire.
- Devices without an agent found from the ARP cache the agent already holds. No packets are sent.
- Events for over-deployed licences and prohibited software, sent on to your other tools.
- Read-only API keys for your service desk or CMDB.
From an Active Directory list to managed machines.
A small Deployer service on a Windows machine in your domain does the pushing. The console tells it what to do and shows the result for every machine.
Discover
Computers are read from Active Directory. Workgroup machines are added by IP.
Check
Each machine is probed to see whether it can be reached before anything is sent.
Push
The agent is copied over the admin share and started by a scheduled task.
Enrol
The agent registers itself with your server and receives its policies.
Confirm
The machine counts as deployed only once its agent checks in.
What is included.
Endpoint Management is a set of modules on one agent and one console. Turn on the ones you need.
Find the machine and connect. Only the parts of the screen that changed are sent, straight to the browser.
- Live screen with mouse and keyboard, or view only
- Windows, and Linux desktops running X11
- Remote terminal on Windows, with a command transcript
- Consent and notification as two separate settings
- History of who connected, when, why and the consent outcome
- Recordings replayed in the console or exported as video
Approve an update and it moves through canary, pilot and broad, gated by the success rate of the ring before. Only a rescan marks a machine as patched.
- Windows updates and applications through winget
- Apple updates, with major OS upgrades kept out of rollouts
- apt, dnf and apk packages on Linux
- Automatic approval above a minimum severity, still starting at canary
- Maintenance windows, restart policy and install concurrency
- Optional server ring after broad
Pick the package, pick the machines, start. For larger rollouts add a canary and pilot group, and Tracemark widens only when installs show up in each machine's software inventory.
- Packages from a network share, browsed from the console
- Conditions that skip machines a package does not fit
- Typed steps before and after the install
- Several packages in a set order, with retries for failed machines
- Start time, install window, expiry and e-mail when a rollout halts or finishes
- Self-service requests approved by an administrator
A complete inventory of the managed estate, plus the devices on the same network that have no agent yet.
- Hardware and installed software per machine
- Licence usage in three states: used, unused, unmeasured
- Lifecycle and warranty dates, with import
- Unmanaged devices from ARP caches, identified by MAC address
- Events for expiring warranties, over-deployed licences and prohibited software
- Read-only external API
See which machines are encrypted, which are partly encrypted, and which cannot be encrypted yet and why.
- BitLocker status per machine and per volume
- TPM presence and readiness
- Encryption method and protectors in use
- Encryption by policy, with a preview of which machines would be encrypted and which cannot be
Bring every Windows computer under management from the console. Discovery, push and the result of each attempt are in one list.
- Computers discovered from Active Directory
- Agentless push over the admin share with a scheduled task
- Workgroup machines added by IP
- A separate local account for workgroup machines; the domain account is never sent to them
- Per-machine results with readable errors
- Exclusions for machines that must not be touched
One definition of "these machines" for every module: patch rings, deployments, device rules and data protection policies.
- Hostname patterns such as FIN-*
- Rules matched on all or any, including IP ranges
- Organisational units and AD group membership
- Hand-picked static members
- Live preview before saving
- A list of everything that uses the group
Writing a script and running it are separate permissions. Scripts are written and reviewed in the library, then run by operators from the Tools page.
- PowerShell and cmd
- Parameters with a type: text, number or a list of choices
- Parameters passed as escaped variables, never pasted into the code
- Run on a group, a selection or the whole fleet
- One run, one link: what each machine printed
How long each person spent at each machine, day by day, sampled by the agent.
- Active, idle and locked time
- Foreground applications grouped by rules you write
- Days with no data shown as unmeasured, never as zero
- The number of measured days next to every total
New agent builds reach the fleet in stages, and the agent checks every build before it installs it.
- Signed builds, verified on the machine before they are applied
- Unsigned builds refused
- Canary first, broad when you promote
- Check now from the console instead of waiting for the next cycle
- Automatic install on or off
How each module knows the job is done.
A green status should mean the work happened on the machine. This is what each module waits for before it reports success.
| Module | What it does | Counted as done when |
|---|---|---|
| Patch management | Installs approved updates ring by ring | The next scan no longer lists the update |
| Software deployment | Installs or removes packages | The package shows up in, or leaves, the machine's software inventory |
| Agent deployment | Pushes the agent to discovered computers | The new agent enrols and checks in |
| Agent updates | Replaces the agent with a newer build | The build's signature checks out on the machine |
| Licence reclaim | Counts seats nobody uses | The machine reports application launches; others stay unmeasured |
| Usage | Measures daily computer time | The agent sampled that day; otherwise the day is unmeasured |
Questions.
Is the user asked before a remote session starts?
You decide. Asking for consent and notifying the user are two separate settings. Every session is listed in the history with who opened it, the stated reason and the consent outcome, and changes to these settings are written to the audit log.
How do you know a patch really installed?
The installer's result only moves a job to installed. A machine is marked as patched when its next scan no longer finds the update, so an update waiting for a restart stays open until the scan after it.
Can we deploy the agent to machines outside the domain?
Yes. Paste the IP addresses of workgroup machines into the deployment page. The Deployer pushes to them with a separate local administrator account and never sends the domain account to them.
How are agent updates protected?
Every build is signed when it is built. The agent checks the signature before applying an update and refuses a build that is unsigned or does not match. New builds go to the canary ring first.
Does Asset Management scan our network?
No. Devices without an agent are found from the ARP cache each agent already has, so no packets are sent and no subnet is swept.
What does the usage report show for a machine that was switched off?
That day is shown as unmeasured. A missing day is never shown as zero hours, and every total states how many days it covers.
Works well with
See it on your own fleet.
We connect to a test machine, roll a patch through rings and show your inventory, on hardware of your choice.