Devices and agent
How the Tenvara agent behaves on every device: automatic updates, the check-in interval, remote session consent and which agent modules run.
Every device reports in through one Tenvara agent. Settings > Devices and agent (in the Devices and monitoring group, also the Devices settings link at the bottom of the Devices sidebar) sets how that agent behaves everywhere: whether it updates itself, how often it sends live status, what happens on the device when someone remotes in, and which of its modules run. A single device can override the modules from its own page.
Changes on this page are not saved until you press Save changes at the top. They reach online agents straight away, and offline agents the next time they connect.
Updates and check-ins
Update agents automatically
On (the default), agents take new releases as their rollouts offer them, and roll back if a release does not start. Turning it off stops every rollout.
- Each agent checks for an update a minute after it connects and every six hours after that, and is told straight away when a new release is available.
- Every update is signed by your Tenvara server and checked by the agent before it is installed. An agent refuses an update that is not signed by the server it enrolled with, is not for its platform, or does not match its checksum.
- On macOS and Linux, if the new version does not start and stay up, the agent puts the previous version back and reports the failed update. On Windows, the installer's own rollback does the same. A version that was rolled back is not tried again for 24 hours.
Turn it off to update by hand: the agent packages are in Devices > Enrolment, on the Installers tab, for your software deployment tools.
The Updates from the release feed card brings new releases of the agent and the backup helper to your install by themselves: with Check the release feed every day on, releases your licence covers are checked (the release signature, the file hashes and the Windows and macOS signatures), imported and rolled out. Check now asks straight away, and Recent checks lists what each check found. On a server without internet access, turn it off and upload releases on the Installers tab instead.
The Rollouts card sets how a release spreads: the Default channel (stable or beta), the Pilot share and Pilot devices that get it first, the Soak before everyone else follows, and how long a device has to answer an offer. See Agent updates and release channels.
Tip: Leave automatic updates on. Updates carry fixes for the agent itself, and new modules only work on agents new enough to have them.
Check-in interval
How often agents send live status: CPU, memory, disks and who is signed in. Between 10 and 600 seconds; 30 is the default. A shorter interval makes the device list more live at the cost of a little more traffic. It does not change how often monitoring checks run: that is set in monitoring policies.
Restart an agent that cannot connect
Restart an agent that cannot connect after makes an agent restart itself when it has not reached the server for this many minutes while its network works, and the device's activity says so. 0 turns it off; otherwise between 5 and 1440 minutes.
Remote session consent
What happens on the device when someone remotes in:
| Option | What happens | Best for |
|---|---|---|
| Connect straight away | The session starts at once. It is still logged, and the tray icon shows it is live | Servers and unattended machines |
| Tell the user | The session starts at once, and the person at the device sees a notice saying who has connected | Most workstations |
| Ask the user first | The person at the device must approve each session. If nobody answers in time, it does not start | Customers who want to approve every session |
Choose the option you have agreed with your customers. Every session is logged, whichever you choose.
Session limits
The Session limits card sets how long remote sessions may run and how long transferred files last:
- End a remote session after: screen and terminal sessions still open after this many hours are ended.
- People connected to one device at once: one more than this is told the device is busy.
- Keep transferred files for and Download links for transferred files work for: how long files sent to or fetched from a device stay on the server, and how long each one-time link works.
- Note a device going offline after: an agent away this long gets "went offline" on its device's timeline. Restarts and Wi-Fi blips reconnect well within it. Fold a return shorter than this into the offline line keeps a flapping agent to one line with a count.
Queued work
Work for a device that is offline waits for it. Queued work sets how long, separately for Scripts, App installs and removals and Patch scans and installs: between 1 and 168 hours, 24 by default. After that the work expires and never runs, and it shows as "Expired: the device was offline". Deployments keep trying until they succeed, and work inside a maintenance window expires when the window ends.
Modules
The agent carries every module; this list decides which ones run on a device unless that device says otherwise.
| Module | What it does on the device |
|---|---|
| Inventory | Hardware, software and network details, collected when the agent connects and every few hours |
| Remote control | See and control the screen from the browser, peer to peer |
| Monitoring | Metrics, services, patches and checks (ping, port, web, process, service, event log), with alerts |
| Backup | Endpoint backup through the backup helper, installed when a device is protected |
| Patch management | Operating system updates: scans, approved installs in maintenance windows, reboots by policy |
| Software | Installs, updates and removes the software you deploy (winget, Homebrew, packages) |
| Scripts | Runs signed scripts from the library, with live output |
| Printers | Adds, updates and removes the printers deployed to the device |
| Hypervisor role | On a Proxmox VE node: reports the cluster, guests and storage, and runs guest actions. Idle elsewhere |
| Web server role | On a Linux web server: reports sites, certificates and services, and runs hosting actions. Idle elsewhere |
| Diagnostics | Read-only checks a technician runs on demand: processes, memory, disks, startup items, services, network, crashes, security and battery |
| Chat | Chat with support from the tray, in a small window that opens your chat |
| Security monitoring | Reads the security event logs (Windows Event Log, the macOS unified log, journald) for Security, and reports the device's protection: antivirus, firewall, encryption and local admins |
| Background tools | A shell, files, processes, services, event logs and the registry for technicians without taking the screen, and Wake-on-LAN for neighbouring devices |
| Network probe | On the agent a site names as its network probe: scans the site's subnets, polls network kit over SNMP and receives SNMP traps. Idle elsewhere |
| Camera relay | On the agent a camera names as its relay: pulls the camera's stream only while a screen shows it and sends it on through your server, with a time limit. Idle elsewhere |
| BitLocker recovery keys | Keeps every BitLocker recovery password of the device's encrypted volumes in the credentials vault, whoever turned BitLocker on, and collects a new one when a key is added or replaced |
| Password rotation | Rotates the local administrator password into the credentials vault on a schedule and on demand, and on a domain controller syncs, rotates, resets and unlocks Active Directory accounts |
| Device actions | Restarts, shuts down, signs out or locks the device when a technician asks, restarts, repairs or uninstalls the agent, and sends its logs and health for troubleshooting |
| Docker hosts | On a machine with Docker Engine or Podman: reports the containers, images, volumes, networks and Compose projects, and runs Docker actions (Podman is only read). Idle elsewhere. See Docker hosts and containers |
| Tamper protection | Keeps the agent on the device: removing it needs the uninstall token, its service restarts itself, and stopping, killing or removing it is reported |
| Admin elevation | People ask from the tray to run a program as administrator or to be an administrator for a while; staff or rules approve, and the agent gives the rights and takes them back |
| Device hardening | Audits the device's security settings against the baselines assigned to it, and enforces and rolls them back when asked, never touching settings Intune or a domain Group Policy manages |
| Site probe | On the agent a site names as its connectivity probe: pings the gateway, the ISP's first hop and the internet to tell LAN, ISP and internet faults apart, watches the public address for failover to a backup line, and checks DNS and web services. Idle elsewhere |
| Tray menu | The tray's menu for the people at the device: report a problem with a screenshot, their open requests, your links and self-help actions, asking for remote help, the App store and messages from you |
| Virtual desktops role | On a Windows server with Remote Desktop Services roles: reports the roles, the sessions and the FSLogix profile containers, and runs virtual desktop actions. Idle elsewhere. See Virtual desktops |
| Device web pages | Relays the web page of a device on the agent's network (a NAS, printer, switch, firewall or UPS) to a technician who opens it through this agent, only to private addresses on the agent's own networks unless an administrator allows others, for a time-limited session. Idle otherwise. See Opening device web pages |
Each switch reads "on by default". Turning one off here stops it on every device that does not override it: the module stops, and a device asked to use it answers that the module is turned off for that device.
While the matching Tenvara module is switched off in Modules, its agent features are off on every device, whatever this list and the device say; the device page says so. They come back as they were when the module is switched on again.
Change the default modules
- Go to Settings > Devices and agent.
- Under Modules, switch modules on or off.
- Press Save changes.
Override one device
A single device can run a different set, for example remote control switched off on a server that must never be remoted into, or the web server role switched off on a machine you do not host sites on. Open the device and change its modules there. The device keeps its own choice until you set it back to follow the defaults.
Note: Agent modules are separate from Modules. Switching the Patch management module off in Modules hides the area and stops patching on every device; switching the agent's Patch management module off here, with the module still on, stops it only on the devices that follow this default.
Adding devices
Enrolment tokens and install commands are in Devices > Enrolment on the Enrolment tokens tab, the packages for software deployment tools are on its Installers tab, and devices waiting for approval are on Waiting for approval. See Installing the agent.
Was this page helpful?
Thanks for the feedback.