When IP Restrictions are enabled in a ControlUp organization, they apply not only to user sign-in at app.controlup.com but also to REST API calls that use API keys or tokens for authentication. Initially, there was confusion about this behavior, with one party assuming that IP Restrictions only affected user sign-ins via the web application and would not restrict API calls. However, further investigation clarified that IP Restrictions do indeed apply to API requests.
The key issue encountered was that reporting workflows that fetch machine statistics via the REST API started returning "Unauthorized" errors after IP Restrictions were enabled. Although the API tokens used for authentication were verified as valid and not expired, the requests failed due to the IP restriction settings.
The resolution involves adding the public egress IP addresses of the systems making the API calls (such as those running the reporting workflows) to the organization's IP Allow List in ControlUp. This setting is accessible under Settings → Security → IP Allow List in the ControlUp management console. Once the calling system’s IP addresses are added to the allow list, API calls from those IPs will be authorized, provided a valid API token is also used.
For more detailed guidance, official ControlUp documentation and references include the API endpoint for managing IP allow lists (https://api.controlup.io/reference/orgipallowlistpubliccontroller_create) and the knowledge base article on IP Allow Lists (https://support.controlup.com/docs/ip-allow-list). These resources offer comprehensive instructions for configuring the IP Allow List to control API access securely.
Read the entire article here...
Authentication Related Training & Support Archives
Authentication training and support-related archives from inside the ControlUp Community on Slack.
Automating VDI Registration in ControlUp Console
Automating the addition of Virtual Desktop Infrastructure (VDI) machines to the ControlUp console upon agent installation can streamline management and monitoring processes. While ControlUp for Desktops offers a command-line installation method that automatically registers machines, a similar approach for VDIs requires specific configuration.
To achieve automated registration of VDIs, you can utilize the Install-CUAgent PowerShell cmdlet, which is part of the ControlUp Automation module. This cmdlet allows for the download and installation of the ControlUp Agent on local machines, including VDIs. By providing the necessary authentication key during installation, the agent registers the machine with your ControlUp environment. For non-domain-joined machines, an API authentication token is required. ([support.controlup.com](https://support.controlup.com/docs/install-cuagent-install-an-agent?utm_source=openai))
For non-persistent VDIs, such as those created from a master image, it's essential to configure the agent to handle these scenarios appropriately. By setting the agent as a master image, it ensures that new VDIs created from this image will automatically register with the ControlUp console, preventing duplicate entries and maintaining an accurate device inventory. ([support.controlup.com](https://support.controlup.com/v1/docs/agent-outbound-communication?utm_source=openai))
Additionally, enabling folder synchronization with your VDI infrastructure can further streamline management. This feature ensures that VDIs are correctly registered and prevents stale machines from cluttering the interface. By integrating with your VDI environment, ControlUp can automatically detect and manage VDIs, enhancing the efficiency of your monitoring and management processes. ([support.controlup.com](https://support.controlup.com/docs/connecting-to-your-vdi-infrastructure?utm_source=openai))
By implementing these methods, you can automate the addition of VDIs to the ControlUp console, ensuring accurate device registration and efficient management of your virtual desktop environment.
Read the entire article here...
Read the entire article here...
How to Use ControlUp Live View to Identify Processes Causing CPU Spikes in VDI Environments
When attempting to diagnose CPU spikes and identify the specific processes responsible using ControlUp, the most effective approach is to utilize the Live view, also known as the VDI page in the ControlUp Web UI. This view provides real-time, granular insights into process-level CPU consumption across virtual desktop infrastructure (VDI) environments. Unlike historical reports, which show aggregated past data such as CPU Utilization Max but lack immediacy, the Live view updates metrics approximately every three seconds, enabling administrators to track CPU spikes as they happen and correlate them with individual processes.
Accessing this Live view requires either appropriate licensing or configuration that may prompt for a user principal name (UPN) login depending on how ControlUp is set up in the organization. When correctly logged in, administrators can drill down into specific machines experiencing CPU spikes and see a detailed, sortable list of CPU-intensive processes. This functionality helps pinpoint the exact processes causing resource bottlenecks, which is critical since the total CPU utilization of a machine does not always equal the sum of all visible processes. This discrepancy arises because kernel interrupts and other system-level operations that consume CPU are not attributed to individual user processes.
Users noted that if access to the Live view is initially unavailable or the relevant VDI tab not visible, it may be due to missing licenses or particular configuration settings controlled by the ControlUp administrator in the environment. In such cases, reaching out to the administrator and providing the UPN for authentication often resolves access issues. Without this, troubleshooting CPU spikes becomes difficult, and users may resort to external scripting solutions like PowerShell, which can be less reliable and less integrated.
Once logged into the Live view, operators can monitor real-time CPU usage per user and process, identify the top five consumers, and respond quickly to performance incidents causing a slowdown in the VDI environment. While the Live view is potent for immediate troubleshooting, storing long-term granular process data in a live manner is impractical due to data volume and cost, so ControlUp uses historical reports for trend analysis. Overall, the Live view is regarded as an essential and powerful feature in ControlUp’s suite for understanding and resolving CPU utilization spikes in virtualized desktop environments.
For further information on configuring and accessing the Live view in ControlUp, administrators can consult the official ControlUp documentation at https://docs.controlup.com and the ControlUp Academy at https://cuacademy.controlup.com. These resources cover licensing requirements, configuration steps, and best practices for effectively using real-time monitoring to maintain optimal VDI performance.
Read the entire article here...
Read the entire article here...
Troubleshooting Offline Windows Servers in ControlUp
Some Windows servers appear as offline, but when a user logs in through the hypervisor's remote console, they show as online again. A screenshot was requested and a possible solution was suggested. It was advised to submit a case to support@controlup.com with logs and screenshots for further analysis. Different ways to change logging levels were shared and it was asked if the server has AV in place. A possible explanation was offered and it was mentioned that logs would provide more insight into the issue. One user stated that they had put in exceptions for the AV, and another needed to wait before reporting. Screenshot and log files were recommended to help find a solution.
Read the entire article here...
Read the entire article here...
How to Install ControlUp Agent on VDI Instant Clones?
A team member asked for documentation on installing a ControlUp agent on a VDI instant clone Gold Image. Another member suggested using the msi method with the MASTER_IMAGE variable for automated deployment. The MSI download can be found at https://www.controlup.com/download-center/.
Read the entire article here...
Read the entire article here...
Utilizing Ping Identity for Multi-Factor Authentication on ControlUp
A user is excited about new features on the ControlUp platform, including added support for Ping Identity as an Identity Provider. They are unsure of how to use Ping for multi-factor authentication and see that a "pairing code" is needed, but another user clarifies that this is the "secret key" from a "software token app." The article will focus on the new support for Ping Identity and how to use it for multifactor authentication on ControlUp.
Read the entire article here...
Read the entire article here...
Analyzing Citrix Reconnect Times with ControlUp
A user was looking for inspiration on gathering data from ControlUp agents to analyze long connect/reconnect times for a Citrix Shared Desktop session. Members shared that ControlUp recently added a feature to measure Citrix session reconnect times with a breakdown of processes, and offered a script that measures reconnect stages. Another user mentioned working on a solution for measuring endpoint authentication and requested assistance from members with a working Imprivata setup. The conversation concluded with the user planning to reach out to the members for further assistance.
Read the entire article here...
Read the entire article here...
Troubleshooting the SECOCL64.exe Crash in ControlUp.
The conversation on the company ControlUp discusses a crash occurring with the SECOCL64.exe application. Possible causes mentioned include a bug in the application binary, incompatible DLL injection, or a corrupt installation. It is suggested to check the event viewer, verify the installed version, and look for conflicting software. Other solutions suggested include reinstalling or repairing the application and checking for Windows updates. A custom dashboard will soon be released to make it easier to track crashes in an organization. It is also recommended to update audio drivers and disable DLL injections. Registries to enable crash dumps for SECOCL64 are provided for root cause proof.
Read the entire article here...
Read the entire article here...
How to Set Up ControlUp Alerts to Post into a Google Chat Space
A user is asking for help setting up ControlUp alerts to post into a Google Chat Space using webhooks. The issue seems to be on Google's side, as the alerts successfully trigger when tested on an external site. Suggestions for workaround or solutions are given, such as using ControlUp Workflows. Examples and instructions on how to format the HTTP POST within a ControlUp Workflow are provided. The user is able to successfully get it working with Workflows, but is still investigating what type of variables are supported to make the message more meaningful.
Read the entire article here...
Read the entire article here...
Troubleshooting VDI Errors in ControlUp Environment
A team member reported an error in their VDI environment, with 600 VDIs affected. One solution is to use the Controllers pane to copy the reg key to the other VDIs, but this only works if they are persistent - alternatively, one can open the golden image or set a group policy to correct the key. Opening a support ticket is also recommended if the issue persists.
Read the entire article here...
Read the entire article here...