ControlUp Community

Connect, Learn, and Grow

ControlUp for VDI (Real-Time DX) Training & Support Archives

ControlUp for VDI (Real-Time DX) training and support-related archives from inside the ControlUp Community on Slack.

How to Deploy ControlUp Agent via GPO in VDI Environments with MSI Silent Install and PowerShell Automation

Posted on

Deploying the ControlUp Agent for VDI environments via Group Policy Object (GPO) does not have a dedicated official knowledge-base article, as the installation approach aligns with generic MSI silent installs used in other deployment methods like SCCM or PDQ. The official ControlUp documentation regarding local machine connection and agent communication is the primary reference for deployment: https://support.controlup.com/docs/connect-to-your-machines-locally and https://support.controlup.com/docs/agent-outbound-communication. For non-persistent VDI setups that use a gold master image, the recommended method is to install the ControlUp agent MSI directly on the master image with specific MSI properties: `MASTER_IMAGE=true`, along with the `AUTHKEY` and `RegistrationKey`. This avoids the need for repeated installations on cloned machines via GPO. For persistent, domain-joined virtual machines, using a GPO Computer Startup Script to run an msiexec command is preferred over GPO Software Installation because it allows passing required MSI properties. An example command line looks like this: `msiexec /i \\share\ControlUpAgent-xxxx.msi /qn AUTHKEY="" RegistrationKey="" MASTER_IMAGE=true` The authentication keys are retrieved from the Real-Time Console under Settings → Agent. The Registration Key is mandatory starting from version 9.0. Machines must be manually added to the organization tree unless the agent version is 9.0.5 or higher, which supports self-registration. When GPO deployment is not optimal, if remote RPC or WMI connectivity is available, deploying the agent remotely via the ControlUp console or Monitor is simpler. For cloud-managed endpoints, Microsoft Intune is the officially documented deployment method. A practical example was shared demonstrating a PowerShell script to deploy the ControlUp Agent MSI for VDI within a Nerdio scripted action context. The script copies the MSI from a UNC file share to a local temporary path, validates that the MSI file is correctly copied (including a check on the MSI magic bytes), and then executes the msiexec command with silent installation flags, the authentication keys, and logging enabled. It captures and reports installation exit codes and prompts when a reboot is required. The script also includes a post-installation check to list ControlUp-related services to confirm the agent installed and started as expected. This approach encapsulates the best practice for deploying ControlUp agents in VDI environments using GPO, balancing MSI property requirements, version-specific authentication mechanisms, and practical scripting for automation. For detailed agent deployment contexts and command-line references, the ControlUp official documentation remains the authoritative source: https://support.controlup.com/docs/connect-to-your-machines-locally and https://support.controlup.com/docs/agent-outbound-communication.

Read the entire article here...

How IP Restrictions Affect REST API Access and How to Configure the IP Allow List in ControlUp

Posted on

When IP Restrictions are enabled in a ControlUp organization, they apply not only to user sign-in at app.controlup.com but also to REST API calls that use API keys or tokens for authentication. Initially, there was confusion about this behavior, with one party assuming that IP Restrictions only affected user sign-ins via the web application and would not restrict API calls. However, further investigation clarified that IP Restrictions do indeed apply to API requests. The key issue encountered was that reporting workflows that fetch machine statistics via the REST API started returning "Unauthorized" errors after IP Restrictions were enabled. Although the API tokens used for authentication were verified as valid and not expired, the requests failed due to the IP restriction settings. The resolution involves adding the public egress IP addresses of the systems making the API calls (such as those running the reporting workflows) to the organization's IP Allow List in ControlUp. This setting is accessible under Settings → Security → IP Allow List in the ControlUp management console. Once the calling system’s IP addresses are added to the allow list, API calls from those IPs will be authorized, provided a valid API token is also used. For more detailed guidance, official ControlUp documentation and references include the API endpoint for managing IP allow lists (https://api.controlup.io/reference/orgipallowlistpubliccontroller_create) and the knowledge base article on IP Allow Lists (https://support.controlup.com/docs/ip-allow-list). These resources offer comprehensive instructions for configuring the IP Allow List to control API access securely.

Read the entire article here...

How to Auto Log Off Idle Users in Azure Virtual Desktop Using ControlUp Triggers and Scripts

Posted on

Several ControlUp community members discussed how to configure a trigger to automatically log off idle users from Azure Virtual Desktop (AVD) hosts using the ControlUp Agent for Virtual Desktop Infrastructure (VDI). One common solution is to leverage existing trigger packs within ControlUp, which include triggers designed to log off a user session after a specified period of inactivity. These triggers can be customized based on time thresholds that fit the organization’s session management policies. An example script and detailed guidance were shared from ControlUp’s official script library, which provides automation for disconnecting or logging off idle sessions. This script can be adapted and deployed within ControlUp's automation policies to monitor session activity and log off users automatically when idle thresholds are met. The relevant resource is available at https://www.controlup.com/script-library-posts/disconnect-or-log-off-idle-sessions/. Additional insights were shared from a ControlUp blog post that focuses on session resource optimization through automation. This post outlines best practices and practical examples of using ControlUp automation to manage session states efficiently, including auto-logout for idle sessions. The blog can be found here: https://www.controlup.com/blog/controlup-automation-session-resource-optimization/. While native solutions like DaaS IQ might offer built-in functionality for auto-logging off idle users, many organizations have adopted ControlUp triggers as a practical workaround until formal approval or integration of native options is completed. The combination of ControlUp’s flexible triggers and scripting capabilities allows administrators to enforce session timeout policies effectively within AVD environments, optimizing resource utilization and enhancing security.

Read the entire article here...

Troubleshooting Access Denied Errors When Upgrading ControlUp Monitor Servers Using PowerShell

Posted on

When upgrading a ControlUp monitor server from version 9.0.0.1680 to 9.2.0.733 using the PowerShell commandlet Invoke-CUMonitorUpdate, the process may fail with an "Access is denied" error. This failure occurs after the installation steps "Install Verify Service already installed" and "Install Copy Files" complete successfully, specifically at the step involving stopping the `cuMonitor` service. The error indicates that Windows denied access during the attempt to stop or control this service, despite running PowerShell as an administrator and having folder-level access to the monitor installation directory. The root cause is typically related to security settings or interference by antivirus (AV) or endpoint detection and response (EDR) software, which can block the service from stopping. Alternatively, a restrictive service Access Control List (ACL) can prevent the upgrade from proceeding. When attempting to upgrade through the ControlUp Console, a similar failure occurs silently because the console relies on remote commands (via admin share or WMI) that suffer the same permissions restrictions. To resolve this issue, manually stopping the `cuMonitor` service with elevated privileges is required. Running `sc.exe stop cuMonitor` on the monitor host as an administrator can successfully stop the service. If this command fails, it is necessary to configure AV/EDR exclusions for the ControlUp monitor executable and folder (`C:\Program Files\Smart-X\ControlUpMonitor\` and `cuMonitor.exe`) or adjust the service's ACL using `sc.exe sdshow cuMonitor` to inspect and modify permissions. Once the service is stopped, re-running the Invoke-CUMonitorUpdate commandlet completes the upgrade successfully. When upgrading through the ControlUp Console, ensure the account used has local administrator rights on the monitor host; otherwise, upgrade via the PowerShell commandlet locally on the machine is recommended for reliability. This approach has been verified to resolve the access denied error and enable the upgrade to proceed without interruption. For more details on managing ControlUp monitor services and upgrade procedures, refer to the official ControlUp documentation at https://docs.controlup.com or consult ControlUp support resources.

Read the entire article here...

Understanding ALERT RULES Licensing and Usage in ControlUp One EVENTS Tab

Posted on

Within the ControlUp One platform, the EVENTS tab includes an ALERT RULES section that is specifically designed for ControlUp for Desktops (CU4D). Users who do not have a CU4D license will encounter a license error when accessing the ALERT RULES tab, even though other areas like OVERVIEW and EVENT DETAILS function normally. This is because the ALERT RULES feature is directly tied to CU4D licensing and capabilities. The ALERT RULES in ControlUp One covers alerting for CU4D, ControlUp for VDI (CU4VDI), and Synthetic Monitoring; however, the creation and management of alert rules within this tab are exclusive to CU4D. For alerting related to ControlUp for VDI and Synthetic Monitoring, users must configure those alerts within their respective products. Once alerts are configured in each solution, they will be aggregated and displayed together in ControlUp One for centralized monitoring. In summary, the ALERT RULES function in the ControlUp One EVENTS tab is dedicated to CU4D alert creation, and attempting to access this function without the proper CU4D license will trigger a license error. Alert management for CU4VDI and Synthetic Monitoring requires using those individual products’ alerting tools, after which their alerts become visible collectively within the ControlUp One interface. This division maintains clear licensing boundaries and functional segregation across ControlUp’s different monitoring products. For more information, see ControlUp’s official documentation on alerting and licensing at https://docs.controlup.com and explore the ControlUp Academy for training on alert configuration and best practices at https://cuacademy.controlup.com.

Read the entire article here...

Troubleshooting Script-Based Action Visibility Delays Between ControlUp Console and Web App

Posted on

When a Script-Based Action (SBA) is created in the ControlUp Real-Time Console, it typically becomes available in the ControlUp web app almost immediately. The synchronization between the console and the web app occurs through the ControlUp store configuration, which is propagated via the monitor cluster. Generally, no additional manual steps are necessary for the new script action to appear in the web app interface. However, in scenarios where the script action does not immediately show up in the web app, several troubleshooting steps can help resolve the issue. The first recommended approach is to simply refresh the web console page to ensure the interface updates with the latest configuration changes. If the script action still does not appear, verifying user permissions is crucial, as lack of appropriate access often causes visibility problems. An explicit save of the configuration from the console using the File -> Save Configuration option may also accelerate the propagation process. As a last resort, restarting the monitor cluster can force synchronization across components. The most common root cause for delays or failures in SBA availability in the web app is permission settings. Ensuring users have the necessary rights to access and execute the script actions is essential. This sequence of steps—refresh, check permissions, save config, restart the cluster—provides a structured approach to troubleshooting SBA visibility issues across ControlUp environments. For further details on managing Script-Based Actions and permission configurations, refer to the official ControlUp documentation at https://docs.controlup.com and explore ControlUp Academy resources at https://cuacademy.controlup.com.

Read the entire article here...

Comprehensive User-Created Training and Operating Manual for ControlUp Real-Time DX Console

Posted on

A ControlUp community member has created a comprehensive Training and Operating Manual for the ControlUp Real-Time Digital Experience (DX) Console, originally developed as internal training material but now shared publicly to benefit the wider user community. The manual spans roughly 22 pages and includes detailed explanations, diagrams, and knowledge base references, aiming to deepen understanding of ControlUp’s architecture, setup, operations, and troubleshooting. The manual covers multiple critical areas for both new and experienced users. It begins with an overview of the console architecture and the data collector pattern, supported by detailed diagrams to visualize the system’s workings. Installation topics include the sequence of setup steps, pitfalls like the “shared-credentials trap,” mechanisms for Multi-Site Association, and agent auto-deployment processes. For everyday operations, the manual highlights powerful console features such as column grouping, Branch Mapping, and registry comparison. It also clarifies common confusions around event logs, particularly the differences between LogName and event ID. Troubleshooting guidance is a key focus, addressing connectivity challenges including those posed by corporate proxy environments, with practical PowerShell snippets included to assist in resolution. Advanced topics such as script actions with argument extraction from column values are also presented. The manual further differentiates ControlUp’s on-premises variants, specifically IOP, COP, and SOP configurations, which is valuable for users managing hybrid or fully on-premises deployments. This document is an independent user-created resource and is explicitly noted as unofficial; it does not carry warranty, support, or official endorsement from ControlUp. Users are encouraged to use it as a supplement to official resources and to consult ControlUp’s Knowledge Base and ControlUp Academy for formal guidance. The author invites feedback and corrections from the community to improve the manual’s accuracy and usefulness over time. This shared resource represents a valuable starting point and practical reference for ControlUp console users wishing to deepen their operational knowledge and troubleshooting skills. For official documentation and further training, users can visit the ControlUp Knowledge Base at https://docs.controlup.com and the ControlUp Academy at https://cuacademy.controlup.com.

Read the entire article here...

How to Initiate Remote Assist for VDI Sessions in ControlUp and Upcoming Improvements to Global Search and Enrich Plugin

Posted on

In ControlUp, currently the primary method to start a remote assist session for a VDI user involves navigating through the interface by selecting VDI > Details > drilling down to the specific pool, or by using the search grid to find a user, then right-clicking their session, choosing Session Management, and finally selecting Remote control. This workflow contrasts with some other remote support tools, such as ScreenConnect, which offer a global search feature enabling quick retrieval of any active session—physical or virtual—directly by searching the user's name. The new global search functionality in ControlUp primarily directs users to the session activity reports rather than live session data. This design choice was intentional to focus on long-term historical data rather than real-time session information. However, multiple community members highlighted the benefit of extending the global search to include live VDI sessions, which would allow quicker identification and management of active sessions and streamline remote assist workflows, particularly for VDI. The need for this improvement is tied to efforts by some organizations to consolidate tools, replacing separate remote assist products with ControlUp. The current process for VDI sessions is seen as less efficient compared to physical endpoints, where the user’s device appears directly in the global search, facilitating straightforward remote control initiation. Adding real-time VDI session data to the global search would align ControlUp’s user experience with that of other remote support tools and simplify support staff workflows. Additionally, the community suggested expanding ControlUp’s Enrich plugin—already valued for integrating with ticketing systems and enhancing remote support capabilities—to cover VDI environments. This expansion is confirmed to be on ControlUp’s roadmap and is expected to be developed later in the year, promising to further enhance VDI support operations. For more detailed guidance on starting remote control sessions and using ControlUp’s search features, users can consult the official ControlUp documentation at https://docs.controlup.com and explore the ControlUp Academy resources at https://cuacademy.controlup.com.

Read the entire article here...