A common challenge in large IT environments is running remediation scripts efficiently across thousands of devices. Typically, scripts are scheduled to run daily or on another regular interval to enforce compliance or perform necessary changes, such as modifying a registry key or folder structure. However, this approach results in many unnecessary script executions on devices that are already compliant, leading to wasted resources and longer execution times.
One proposed solution is conditional script execution based on the actual state of each endpoint—running a script only if remediation is required. For example, if a device’s registry value meets the desired state, the script should be skipped for that device. This would allow the scheduled remediation to remain active while minimizing needless runs on already compliant machines. Without this capability, administrators often build checks into the script itself to exit early if no remediation is needed, but the script still needs to run on every device each time, causing inefficiency.
ControlUp already supports a similar concept through its Compliance Custom Issues feature, which enables creation of conditions to detect compliance status and trigger remediation scripts only on devices flagged as non-compliant. This method, though effective, operates as a two-step process: one to detect the compliance issue (writing to the compliance index) and another to run the remediation via alerts triggered by the compliance state. While this approach works well for security and compliance scenarios, there is interest in applying it to broader desktop management use cases, including non-security remediation tasks.
The key limitation is that the initial detection and remediation are decoupled, requiring two processes (condition detection and remediation execution) rather than a single conditional script execution embedded within the scheduling engine. Users have suggested enhancing the ControlUp scripting and scheduling functionality to integrate conditional execution directly—essentially embedding “if this condition is true, then run this script” logic at the scheduling level. This would allow scripts to run only when truly needed without separate detection steps, providing more efficient, self-healing capabilities across desktops and endpoints.
ControlUp’s existing resources on Custom Issues, adding custom remediations, and integrating scripts for compliance illustrate the current approach:
– https://support.controlup.com/docs/custom-issues
– https://support.controlup.com/docs/adding-custom-remediations-to-built-in-issues
– https://support.controlup.com/docs/how-to-add-scripts-to-controlup-for-compliance
These documents guide users on setting up compliance checks and scripts, but the underlying model still involves separate detection and remediation phases. The ongoing community discussion highlights demand for a deeper integration of conditional execution in scheduling scripts directly, which would optimize large-scale remediation efforts by running scripts strictly on endpoints that need them without running redundant checks or remediations daily.
Read the entire ‘Conditional Script Execution in ControlUp: Reducing Unnecessary Remediation Runs Through Compliance Custom Issues and Scheduling Improvements’ thread below:
Hi all
This is a big one for me please check it out and please upvote
ControlUp Feature Request
I’ve submitted an idea for scheduled scripts to only run when the device actually needs the remediation.
Instead of a daily script running across every targeted device, ControlUp could first check its state. Needs remediation = run it. Already compliant = skip it.
This could really help reduce unnecessary script executions across large environments.
I’ll have a look. But running scripts based on its “state” is a capability of ControlUp for Compliance
Reply via phone I hope I make sense
Let’s say you have a script that needs to make a registry or folder change across 5,000 devices. You can build intelligence into the script so that it checks the current state and exits if the device is already compliant.
The challenge is that the script still needs to execute on the device to perform that check.
For example, with a script scheduled to run once a day:
• Monday: 4,000 devices are remediated.
• Tuesday: The script runs across the fleet again, even though those 4,000 are already compliant. Another 500 are remediated.
• Wednesday: It runs across the fleet again, with only 250 devices still requiring remediation.
You also can’t simply stop the schedule because there are still devices that haven’t received the registry key or folder change.
Now multiply this by 5 or more remediation scripts, and the number of unnecessary script executions becomes significant.
I know we could use an index for detection and then trigger remediation through an alert, but that effectively creates two processes: one to check and report the state and another to perform the remediation.
What I’m proposing is moving that initial condition into the scripting/scheduling engine itself:
Target the fleet via RMM functionality → Check condition → Only execute the script on devices where the condition is true.
For example: If registry value!= “Blue”, run the script.
That way the remediation script only executes on devices that actually require the change, while the daily schedule can remain active to catch devices that were offline or unavailable on previous days.
that is exactly what compliance Custom issues is for – check a condition and run script
I get that but this will help in desktops as well
What Eugene is asking for is exactly the kind of thing I’ve wanted to do with ControlUp, turning it into more of an endpoint management tool, which would be awesome.
That said, if we can do this through Compliance, I’m definitely going to look into it tomorrow. I honestly never thought about using it that way.
this is the feature
• support.controlup.com/docs/custom-issues
• support.controlup.com/docs/adding-custom-remediations-to-built-in-issues
• support.controlup.com/docs/how-to-add-scripts-to-controlup-for-compliance
Thank you for the links. I knew about creating custom issues, but I never thought about using them for non-security purposes, just for general use cases.
Thats what i want to do in Desktops
For non Security Remediation – have this in Desktops
and you can get the scripts to run only if its needed
Self healing
Now you need a script to run to check somthing
that writes to index
then you need to create an alert that checks the index and then run a script
if the option is their for the Agent to check it and then the script to run only if its needed thats a super power for desktops
imagine, a script only runs when it needs to, no more once a day
Continue reading and comment on the thread ‘Conditional Script Execution in ControlUp: Reducing Unnecessary Remediation Runs Through Compliance Custom Issues and Scheduling Improvements’. Not a member? Join Here!
Categories: All Archives