A community member inquired about automating device group assignment in ControlUp based on a specific registry key value. The initial approach discussed involved writing a PowerShell script to read the registry key and create a custom index in ControlUp, which could then feed into a workflow for moving devices to the appropriate device group. This method also opened possibilities for using the data in dashboards, creating alerts for registry changes, and triggering remediation workflows.
A practical PowerShell script example was shared to demonstrate how to write, read, and output a registry key value under the current user (HKCU). This script was integrated with ControlUp’s Device Events by printing the output between defined event markers. Subsequently, a more detailed script was contributed, which collects registry information along with system and timestamp metadata, outputs it as a compressed JSON object, and supports error handling if the registry key access fails. This script is intended to run periodically to populate ControlUp’s data index, providing the basis for alerting and workflow triggers.
The recommended implementation steps include adding the script to the environment to gather registry data regularly, setting up alerts to trigger on specific registry values, and using ControlUp workflows with webhooks to move devices to the correct device groups based on the registry data. While alerts were initially used for this purpose, the community acknowledged the drawback of proliferation—needing many alerts for multiple groups—and expressed a preference to rely more on workflows for automation, preserving alerts for genuine issues.
To advance beyond alerts, the suggestion was made to leverage ControlUp’s API to retrieve custom data directly, enabling workflows to act on this real-time data without spawning numerous alerts. This approach supports scalable device management workflows, automating group assignments effectively. A recommendation was offered to engage ControlUp Customer Success Management (CSM) or Professional Services for further assistance with complex workflow setups integrating API data extraction. The discussion underscores the evolving use of ControlUp’s scripting, alerting, and workflow capabilities to streamline device group management based on registry key states.
For further reference, ControlUp’s official documentation on custom data scripting, workflows, and alerts can be found at https://docs.controlup.com, and detailed learning modules are available via ControlUp Academy at https://cuacademy.controlup.com.
Read the entire article here...
Automation Related Training & Support Archives
Automation training and support-related archives from inside the ControlUp Community on Slack.
How to Pass Command Output Between Workflow Steps in ControlUp Using Data Index as a Workaround
In a recent discussion among ControlUp community members, the capability of passing output from the "Run System Command" node directly into the next step of a workflow was explored. The specific use case involved reading a device’s Organizational Unit (OU) from Active Directory (AD) and using that information to dynamically assign tags through the "Update Tags" node in a workflow. The question centered on whether the result of a command or script executed by the "Run System Command" node could be piped directly to the subsequent node for immediate processing.
The response clarified that currently, ControlUp's "Run System Command" or script execution nodes do not support the direct output transfer or piping of command results into subsequent workflow steps. This limitation means that you cannot directly feed command or script output into another node like "Update Tags" within the same workflow step sequence.
A recommended workaround involves using a data index alongside a script. The script, executed by the "Run System Command" node, can write the needed output (such as device OU information) to a ControlUp data index. The "Update Tags" node or any subsequent workflow step can then query and apply data from this index, thereby indirectly passing the information through the workflow with a slight delay compared to direct piping. Another mentioned option involves invoking a new flow via a REST API call from the script once execution completes, which offers a programmatic way to chain operations but also introduces additional complexity.
While there is no current timeline for enabling direct output passing from the "Run System Command" node, the ControlUp team acknowledged the usefulness of this feature and indicated plans to add it in the future to streamline workflows by eliminating the need for external data storage steps or additional scripts.
For further guidance on automating tags based on device attributes, workflows, and data indexing in ControlUp, users may refer to the official ControlUp documentation at https://docs.controlup.com and the ControlUp Academy at https://cuacademy.controlup.com, where detailed instructions and best practices for workflow automation and integrating Active Directory data can be found.
Read the entire article here...
Read the entire article here...
How to Correctly Reference Form Variables in ControlUp Workflows to Retrieve Device IDs
A user developing their first custom workflow in ControlUp encountered difficulty retrieving a specific device ID based on a machine name entered through a form trigger. The intended workflow started with an admin entering the machine "name" value from the _devices index into a form. This form submission was meant to trigger a workflow step that queries and returns only the device_id corresponding to the given machine name.
The user configured the "List Device ID" step to filter devices with the condition name = {{Start.DeviceName}}, expecting to receive one device_id as output. Instead, the query either returned a complete list of around 1200 device IDs or an empty array, failing to isolate the single target device.
The key to resolving this issue was understanding the correct variable reference syntax in ControlUp custom workflows. The user was incorrectly using {{Start.DeviceName}}, but the proper syntax for accessing form input data from the workflow trigger is {{Start.Form.DeviceName}} (or similar, using the start.form series of variables). Updating the filter condition to name = {{Start.Form.DeviceName}} enabled the workflow to correctly narrow down to the exact device and return only its device_id without extraneous results.
This highlights the importance of accurate variable referencing in ControlUp workflows, particularly when using custom form triggers to filter data. When filtering on form inputs, the recommended practice is to use the start.form variables to access form fields. For additional guidance on custom workflow variable usage, referencing ControlUp’s official workflow and automation documentation is advisable: https://docs.controlup.com/controlup-workflows.
Read the entire article here...
Read the entire article here...
ControlUp Community Meetup #17 — ControlUp AI: How It Works, Where It Helps, and What’s Coming
Our latest ControlUp Community Meetup recording is live. Shay Dezaldety breaks down the ControlUp AI Assistant: how it picks the right tools and data from your environment, how RBAC and approval gates keep admins in control, and a live demo troubleshooting poor digital experience, memory and Wi-Fi issues, and BSOD remediation. Copilot, not autopilot.
Read the entire article here...
Read the entire article here...
Support for Boolean Fields in ControlUp Indexes via PowerShell Scripts
A community member inquired about the official support for Boolean columns in ControlUp when written to via a PowerShell script. They noted that their script was functioning as expected, showing a dropdown with options for "true" and "false" instead of a plain text box for the Boolean field. This behavior indicates that Boolean fields are recognized and handled appropriately within the ControlUp system's indexing and UI.
The confirmation came from multiple users, including a ControlUp expert, that Boolean fields are indeed supported. ControlUp's platform supports defining columns with Boolean data types, enabling users to interact with these fields through dropdown selectors for true/false values, which enhances data consistency and ease of use.
This means that scripts or automation workflows that write Boolean values into ControlUp indexes can rely on native support for true/false states. This feature is useful for scenarios where binary states need to be tracked and toggled directly from the ControlUp interface without requiring manual text input.
For more detailed information on supported data types and scripting integration with ControlUp indexes, users can refer to the official ControlUp documentation at https://docs.controlup.com, and consider the ControlUp Academy (https://cuacademy.controlup.com) for deeper learning resources on scripting and data management in ControlUp.
Read the entire article here...
Read the entire article here...
Automating Detection and Remediation of Stuck BitLocker Encryption on Windows 11 Endpoints with ControlUp Real-Time Automation Engine
When deploying hundreds of Windows 11 endpoints managed by Intune, a common issue with BitLocker encryption is that the process sometimes becomes stuck at a certain percentage completion. While manually pausing and restarting the encryption process resolves the issue within minutes, automating this detection and remediation can save considerable time and ensure consistent endpoint security.
Using ControlUp Real-Time Automation Engine (CU4D), such automation is achievable by leveraging scripted detection and remediation. One approach is to create a single script that both detects the encryption status and initiates a restart of the encryption process if it remains stuck at the same percentage. This script can be deployed across all affected devices and scheduled to run periodically, for example, once per day, to identify any stuck BitLocker jobs and resolve them promptly.
A more modular approach involves creating two separate scripts: a detection script and a remediation script. The detection script would check the current encryption percentage, and if it identifies a stuck state, it writes the status to a custom index attribute within ControlUp. An alert can then be configured based on the value of this custom attribute. When the alert triggers due to a stuck encryption status, the remediation script executes automatically to restart the BitLocker encryption, ensuring a timely resolution without manual intervention.
This method harnesses ControlUp's ability to store custom scripted outputs in custom indices and link those to alert triggers, thus providing a robust, automated way to handle encryption stalls on Intune-managed Windows 11 devices. For further details on configuring custom scripts, custom indices, and alerts in ControlUp, administrators can refer to ControlUp's documentation at https://docs.controlup.com and explore automation capabilities in the ControlUp Academy at https://cuacademy.controlup.com.
Read the entire article here...
Read the entire article here...
How to Report Horizon Client Versions Across User Sessions Using ControlUp
A common requirement for managing VMware Horizon environments is the ability to report on the endpoint client versions—referred to as "HZ Client Version"—used by users to connect to the Horizon infrastructure. This need becomes particularly important in hybrid environments where users connect from both managed internal devices and unmanaged BYOD (Bring Your Own Device) endpoints. Tracking client versions helps administrators identify devices running outdated Horizon clients that require upgrades to ensure security, compatibility, and optimal performance.
Within ControlUp, the Horizon client version information can be accessed via several mechanisms. The VDI - Details view in the ControlUp console displays the HZ Client Version associated with each session, providing a straightforward way to see the current client version used. For programmatic or historical data extraction needs, ControlUp also offers a real-time data API (https://api.controlup.io/reference/gettables) which can retrieve live session details including client versions. Additionally, the "initial HZ client version" field recorded in the Session Activity report captures the client version that was used to start the session. This field, although labeled as "initial," effectively serves as a snapshot of the client version at session start.
However, because users in hybrid scenarios may connect multiple times throughout the week from different devices or update their Horizon client between sessions (for example, by disconnecting, updating, and reconnecting), it is important to consider that the client version can vary across sessions. The "initial HZ client version" is tied to each individual session start, so accumulating this information over a period allows administrators to identify all versions in use and target users on outdated clients. Pulling session activity reports over time and correlating the client versions used enables identification of BYOD devices needing updates even if the same user connects from multiple endpoints.
In summary, the "initial HZ client version" contained in ControlUp’s Session Activity reports is the key field for tracking Horizon client versions across user sessions. The ControlUp real-time data API further facilitates custom querying and automation for this reporting. For detailed exploration of session data, the VDI - Details view complements these options with an at-a-glance interface. Using these tools, administrators in hybrid environments are able to efficiently monitor and manage Horizon client versions on both managed and BYOD devices, ensuring compliance and performance consistency.
Read the entire article here...
Read the entire article here...
ControlUp Community Meetup 16: From DEX to Autonomous IT: A Fireside Chat with ControlUp CEO Jed Ayres
In this ControlUp Community Meetup, host Douglas Brown sits down with Jed Ayres, CEO of ControlUp, to discuss the growing complexity of IT, the evolution of Digital Employee Experience, and how AI is changing the way technology teams identify and resolve problems.
Read the entire article here...
Read the entire article here...
How to Deploy ControlUp Agent via GPO in VDI Environments with MSI Silent Install and PowerShell Automation
Deploying the ControlUp Agent for VDI environments via Group Policy Object (GPO) does not have a dedicated official knowledge-base article, as the installation approach aligns with generic MSI silent installs used in other deployment methods like SCCM or PDQ. The official ControlUp documentation regarding local machine connection and agent communication is the primary reference for deployment: https://support.controlup.com/docs/connect-to-your-machines-locally and https://support.controlup.com/docs/agent-outbound-communication.
For non-persistent VDI setups that use a gold master image, the recommended method is to install the ControlUp agent MSI directly on the master image with specific MSI properties: `MASTER_IMAGE=true`, along with the `AUTHKEY` and `RegistrationKey`. This avoids the need for repeated installations on cloned machines via GPO. For persistent, domain-joined virtual machines, using a GPO Computer Startup Script to run an msiexec command is preferred over GPO Software Installation because it allows passing required MSI properties. An example command line looks like this:
`msiexec /i \\share\ControlUpAgent-xxxx.msi /qn AUTHKEY="" RegistrationKey="" MASTER_IMAGE=true`
The authentication keys are retrieved from the Real-Time Console under Settings → Agent. The Registration Key is mandatory starting from version 9.0. Machines must be manually added to the organization tree unless the agent version is 9.0.5 or higher, which supports self-registration.
When GPO deployment is not optimal, if remote RPC or WMI connectivity is available, deploying the agent remotely via the ControlUp console or Monitor is simpler. For cloud-managed endpoints, Microsoft Intune is the officially documented deployment method.
A practical example was shared demonstrating a PowerShell script to deploy the ControlUp Agent MSI for VDI within a Nerdio scripted action context. The script copies the MSI from a UNC file share to a local temporary path, validates that the MSI file is correctly copied (including a check on the MSI magic bytes), and then executes the msiexec command with silent installation flags, the authentication keys, and logging enabled. It captures and reports installation exit codes and prompts when a reboot is required. The script also includes a post-installation check to list ControlUp-related services to confirm the agent installed and started as expected.
This approach encapsulates the best practice for deploying ControlUp agents in VDI environments using GPO, balancing MSI property requirements, version-specific authentication mechanisms, and practical scripting for automation. For detailed agent deployment contexts and command-line references, the ControlUp official documentation remains the authoritative source: https://support.controlup.com/docs/connect-to-your-machines-locally and https://support.controlup.com/docs/agent-outbound-communication.
Read the entire article here...
Read the entire article here...
How to Auto Log Off Idle Users in Azure Virtual Desktop Using ControlUp Triggers and Scripts
Several ControlUp community members discussed how to configure a trigger to automatically log off idle users from Azure Virtual Desktop (AVD) hosts using the ControlUp Agent for Virtual Desktop Infrastructure (VDI). One common solution is to leverage existing trigger packs within ControlUp, which include triggers designed to log off a user session after a specified period of inactivity. These triggers can be customized based on time thresholds that fit the organization’s session management policies.
An example script and detailed guidance were shared from ControlUp’s official script library, which provides automation for disconnecting or logging off idle sessions. This script can be adapted and deployed within ControlUp's automation policies to monitor session activity and log off users automatically when idle thresholds are met. The relevant resource is available at https://www.controlup.com/script-library-posts/disconnect-or-log-off-idle-sessions/.
Additional insights were shared from a ControlUp blog post that focuses on session resource optimization through automation. This post outlines best practices and practical examples of using ControlUp automation to manage session states efficiently, including auto-logout for idle sessions. The blog can be found here: https://www.controlup.com/blog/controlup-automation-session-resource-optimization/.
While native solutions like DaaS IQ might offer built-in functionality for auto-logging off idle users, many organizations have adopted ControlUp triggers as a practical workaround until formal approval or integration of native options is completed. The combination of ControlUp’s flexible triggers and scripting capabilities allows administrators to enforce session timeout policies effectively within AVD environments, optimizing resource utilization and enhancing security.
Read the entire article here...
Read the entire article here...