Software deployment

Tenvara installs, updates and removes software through the agent, using winget, MSI and EXE installers on Windows, Homebrew and macOS packages on Macs, and apt or dnf on Linux. You keep a catalogue of apps, then deploy them. Deployments are ongoing: required software is kept installed, removals are kept removed, and devices that join later get them too.

Open Devices > Software. The tabs across the top are Overview, Catalogue, Bundles, Deployments, Devices, Installed, Licence counts, Drift, App updates and History.

The overview shows how much is As deployed, installs that Failed (tried again with back-off), Drift being put right and App updates available, then Needs a look, the deployments with work in progress or failures, the apps with the most updates waiting and recent activity.

The catalogue#

The Catalogue tab lists the apps that can be installed, with their category, how each installs on Windows, macOS and Linux, who they are For, and how many devices have them, have updates and have deployments. The catalogue comes with well over a hundred common apps ready to use. Filter it by Category, Sources or For.

Add a package#

1. Click Add package.
2. Enter the Name, Publisher, Category and a one-line Description.
3. Under For, leave Every customer or limit it to one customer (useful for line-of-business apps).
4. Optionally add a Homepage, an Icon (an https link to a square picture) and Tags, then click Add package. Find the app searches winget and Homebrew as you type and fills in the name, publisher, description and homepage for you.
5. On the package's page, click Add under Installs with to add each way it installs (Find in winget or Find in Homebrew fills in the package id):
   • winget (Windows): the package id exactly as winget search shows it, installed for The whole machine or The signed-in user.
   • MSI or EXE (Windows): an installer you upload, with its install arguments.
   • Homebrew cask or Homebrew formula (macOS).
   • macOS package (a .pkg).
   • apt or dnf (Linux).

The agent uses the first source for the device's operating system whose package manager is available, so a Windows server without winget falls back to an MSI source.

A package's page shows its deployments, Installs with, the Installed versions across your devices, every device that has it (with the update available, if any) and its history.

Deploy software#

1. Click Deploy software (or Deploy on a package).
2. Choose the Package.
3. Choose What should happen:
   • Install and keep installed: installed on every device in the target and kept installed.
   • Offer it: made available without being forced.
   • Remove it: removed, and kept removed.
4. Choose the Devices: A customer, A site, A device group, Chosen devices or Every device. A customer, site or group includes devices it gets later. Deploying to a whole customer or to every device asks for approval first when approval rules say so.
5. Choose the Version: The latest or A set version. Tick Keep it up to date to install updates as devices report them.
6. Under When the app is in use, leave Default or choose Skip, try later, Warn, then close or Close at once for this deployment (below).
7. Choose When: Straight away, At a set time or In the maintenance window (the device's patch policy window).
8. Add Notes for whoever looks at it next, and click Deploy.

Bundles#

A bundle is a named list of catalogue apps in install order, such as New starter laptop or Developer tools. Open the Bundles tab, click New bundle, add the apps, drag them into order and mark each one required or optional.

Deploy sends the bundle to a customer, a device group, chosen devices or everyone, installed or offered, now, at a time or in the maintenance window, with the optional apps you tick. On each device an app waits until every earlier required app is installed there, and the next starts as soon as one finishes. The bundle shows one status per device (failed if any app failed, done when every app is in), and each app is still an ordinary deployment underneath, with its own retries, drift and history.

When the app is in use#

Installing or updating an app that someone has open can fail or lose their work. When the app is in use decides what happens, in Settings > Device management under Software (per customer), and can be changed for one deployment or a patch policy's app updates:

• Skip and try again later (the default): nothing is installed, the device shows Waiting: app in use, not a failure, and it is tried again after Try a skipped install again after (30 minutes), within the schedule and window.
• Warn, then close it: the tray tells everyone signed in, for example Notepad++ will be closed in 5 minutes for an update. Please save your work. After the minutes you set (Warn this long before closing it), the app is closed politely, then ended if it is still open, and the update installs. If someone clicks Update now on the notice, it goes ahead straight away.
• Close it at once: the app is closed and the update installs.

Tenvara knows which programs belong to an app from the package's Its programs, or from its detection rules.

Follow a deployment#

The Deployments tab lists every deployment with its intent, target, version, progress and state. Click one to open it.

• The counters show Installed, In progress, Failed (tried again with back-off), Drift (being put right) and Not applicable (no source for their operating system).
• Devices lists each device with its status, installed version, detail (such as The application is in use: close it and try again) and since when.
• History lists every action the deployment took.
• Try again now retries failed devices straight away, and Pause stops the deployment acting until you resume it.

Drift#

The Drift tab lists devices that are not as their deployments say: installs and removals that failed, required software that went Missing or is Out of date, and removed software that came back. Each is put right on the next check, and failures are tried again with back-off.

Installed software across the fleet#

The Installed tab lists every application in any device's inventory, catalogue or not, one row per product, with how many devices and customers have it, the newest version, how many devices have each version, the operating systems and the matching catalogue package. Filter by Publisher, operating system or Catalogue (in or out), or use the views Not in the catalogue and Most versions. Export or print it like any list.

Click an app to see its devices, with the version, the last signed-in user, any update available and how it is removed, and Update or Uninstall it on the devices you select. The Licence counts tab lists devices per app per customer, ready for licence true-ups (Adobe Acrobat Pro on 14 devices).

Uninstalling any app#

Every row of a device's installed software has Uninstall, whether the app is in your catalogue or not. Tenvara works out how to remove it: MSI installs and apps with a quiet uninstaller need nothing; common installers get the right silent switches suggested; anything else asks you for them. The agent looks the app up on the device itself and builds the command there, so nothing but the app's identity and the switches is ever sent. Apps installed for one user only, uninstallers in folders anyone can write to, and Mac apps outside Applications are refused, with the reason.

The removal is in the device's history and on the History tab with its output, and the app leaves the installed list as soon as it is gone.

Unwanted software#

Unwanted software in Settings > Device management holds rules for apps you do not want on customers' devices. For remote access and remote management tools, Tenvara has a finder of its own with a maintained catalogue: see Remote access and RMM tool finder. Each rule matches an app name and/or publisher pattern (* for any text), for every customer or one, with an alert severity and, optionally, Uninstall automatically (with silent switches where needed).

Each match raises one alert per device and rule, such as Unwanted software on ACME-PC-07: uTorrent, cleared when the app is gone or the rule is switched off. Automatic removals go through the same path as a technician's and show in history as Unwanted software with the rule's name. Each rule shows how many devices it is on now.

App updates#

The App updates tab lists apps with a newer version, as each device's agent reports it: catalogue apps (from winget, Homebrew, apt and dnf) and other apps that winget or Homebrew can update. Switch between By device and By app, select rows and use Update now to update straight away. Patch policies can also install catalogue app updates in the maintenance window (see Third-party apps in Patching).

An app outside your catalogue shows its versions on the device, for example Installed 11.2, latest 12.5, with Update beside it.

Installing winget#

A Windows device without winget cannot take winget installs or report app updates. When a device's last report says winget is missing, the Software section on its page offers Install winget: the agent installs Microsoft's App Installer and its frameworks, then checks the software again so its updates show. For many devices, tick them in the device list and choose More, then Install winget...; the result says why any could not take it.

Windows 10, Windows 11 and Windows Server 2022 and 2025 get winget from Microsoft. Windows Server 2019 can take it with Microsoft's warning that it is not supported there, and older versions are refused with the reason. See Installing winget and updating any app.

One device#

• The Software section on a device page shows its deployments, what is installed, updates and history, and which package manager it installs with and when it last checked.
• Install software (in the section or the device's ... menu) installs, updates or uninstalls one catalogue package on that device now: choose the Package and the Action (Install, Update or Uninstall). Leave Version empty for the latest.
• Uninstall on any installed app removes it, catalogue or not (see above).

The Devices tab lists every device with its deployments, failures, drift and updates, and the History tab lists every install, update and removal on every device, whether it came from a deployment, a technician or an app update.

Tip: Every install is checked afterwards. An installer that exits cleanly but leaves the app undetected is reported as failed, so As deployed means the software is really there.

When an update is not a failure#

Every install and update is checked against what the device really has afterwards, and History says what each one came to in its Outcome column. Its Real failures view, and the failed counts on the overview, list only real failures, because several cases look like one and are not:

• Runtimes that install side by side: .NET, ASP.NET Core, the Windows Desktop Runtime, Visual C++, Java, Python and PowerShell 7 install a new version next to the old one. An update has worked when the new version is there, for example "Installed 8.0.31 alongside 8.0.29". A new major version of a product line is offered as its own install, such as Install SSMS 20 (side by side).
• Remove older versions: on the device's Software section, an app with older versions beside the newest offers Remove older versions, which keeps the newest and removes older versions of the same generation. .NET runtimes on a server that hosts .NET web sites are left in place, with the reason. A vulnerability on an old runtime left alongside says so on the finding, with the same button.
• Per-user Store apps on Windows, such as Windows Terminal, are installed separately for each person. They are updated in that person's session, and when nobody is signed in the update waits: "Per-user Store app: updates when" the person "next signs in".
• A second copy on a Mac: an app installed by Homebrew and also by another installer (the vendor's package, nvm, MacPorts) is checked by the copy Homebrew updated, and the device says "Also installed outside Homebrew at" the path, with its version.
• Apple's Command Line Tools: when Homebrew cannot run because they are out of date, the device gets the finding "Homebrew can't run until Apple's Command Line Tools are updated". Its fix, Update Apple's Command Line Tools, asks for approval first and shows the size, and once they are installed the waiting updates are tried again.
• More than one copy: an app installed more than once on a device (64-bit and 32-bit, or for the machine and for one user) shows a row for each copy. An update installs exactly the copy that is there, in its architecture and scope, and an app reads Up to date only when no vulnerability says to update it.
• The Lite agent: devices on the Lite agent are never offered app updates. Their Software section, App updates, bulk updates and a vulnerability's Remediate say "This device has the Lite agent" with its system, and that app updates aren't available.