A recent user shared an effective method to troubleshoot and resolve device registration failures detected via the Device Registration Failure Tracking Dashboard in ControlUp. The issue typically manifests when endpoints fail to register correctly, possibly due to mismatched or outdated registration codes that prevent successful detection and installation of necessary software components.
The solution revolves around a PowerShell script (PS1) used within an Intune Script and Remediation framework paired with a Win32 application deployment set as a required install. This script checks if the device's registration code matches the expected value—defined by modifying a single variable ($ExpectedRegCode) in the script. If the detected registration code does not match, the script initiates an uninstall command to remove existing components causing conflicts. It subsequently restarts the Intune Management Extension service to trigger a forced synchronization and installation of the latest published application version. This approach ensures that devices automatically correct registration code discrepancies by clearing stale state and obtaining the correct app package and registration anew.
This method leverages ControlUp’s Device Registration Failure Tracking Dashboard to pinpoint affected endpoints quickly, making remediation targeted and efficient. It is particularly useful in environments managed by Microsoft Intune, where automated script remediation helps maintain compliance and consistency of Win32 app deployments tied to device registration status.
Administrators planning to apply this solution should customize the $ExpectedRegCode variable within the script to reflect their environment’s correct registration string. The process assumes familiarity with Intune’s Script and Remediation capabilities and Win32 app deployment mechanics. ControlUp documentation and Microsoft’s official Intune script remediation guides provide valuable context for further customization and expansion of this workflow.
Read the entire article here...
Microsoft Intune
Resolving macOS Network Extension Approval Prompts During ControlUp Agent Deployment
When deploying the ControlUp macOS agent via ControlUp for Digital Experience (CU4D), users may encounter a system prompt asking for approval related to a Network Content Filter extension. This prompt is legitimate and a standard security feature of macOS. Apple requires explicit user or Mobile Device Management (MDM) approval for network extensions because they run in the background and have the capability to inspect network traffic.
The specific prompt appears due to the agent’s use of a network extension to facilitate Unified Communications and Collaboration (UC&C) live monitoring. While the agent itself continues functioning without this approval, enabling the extension is necessary to capture and provide real-time UC&C data, which is vital for comprehensive digital employee experience monitoring focused on communication tools and services.
Deployment of the ControlUp macOS agent often involves using remote control utilities like ScreenConnect, and configuration of these network extension approvals can be managed through MDM solutions such as Jamf or Microsoft Intune. By applying configuration profiles through MDM, administrators can reduce or prevent these approval prompts from appearing to end users, streamlining the deployment process and improving user experience.
For further details and step-by-step instructions on deploying the macOS agent and handling configuration profiles in MDM environments, refer to ControlUp’s official documentation at https://support.controlup.com/docs/configuration-profiles-for-mdm-deployment. This article has been validated with recent versions of Jamf and Intune, ensuring compatibility and applicability in modern macOS management setups.
Read the entire article here...
Read the entire article here...
How to Update Device Registration Codes for Existing ControlUp Agents After Code Expiration
ControlUp has deprecated the old Device Registration Codes across all tenants, requiring a transition to new codes for agent deployment. While new agent installations using the latest Device Registration Code proceed without issues, existing devices that were registered prior to the code expiration retain the old registration code in the Windows registry. This persistence causes a problem when these devices become inactive and are removed from ControlUp. Upon attempting to re-register, the ControlUp Agent reads the outdated, expired Device Registration Code from the registry, which leads to a registration failure.
The recommended approach to resolve this for existing devices differs from the process for new installations. The latest Agent Manager deployment automatically uses the new Device Registration Code for fresh agent installs; however, it does not automatically update the registration code already stored in the registry of existing agents. Therefore, device re-registration fails if the persisted old code is expired. There is no official migration tool provided by ControlUp to update this registry value across existing installations en masse. The key registry path involved is `HKLM\SOFTWARE\Avacee\SIP` and the relevant value is `DeviceRegistrationCode`.
For an immediate workaround, ControlUp acknowledges that updating the registry manually or via script on affected devices is effective. This involves stopping the SIP Agent service, updating the `DeviceRegistrationCode` registry value to the current valid code, and restarting the service. Given that agent version auto-updates are managed separately (either by ControlUp version control or via user-managed software deployment like SCCM or Intune), it is the administrator’s responsibility to ensure deployment tools push such remediation scripts or silent Agent Manager reinstalls outfitted with the new Device Registration Code to devices at scale.
In practice, many organizations use deployment platforms such as Intune or SCCM to run remediation scripts that overwrite the expired registration code in the registry of existing agent installations, thereby preventing registration failure without full reinstallation. This approach balances efficiency and scale, allowing smooth transition without requiring large-scale agent removal and fresh installation. Administrators should plan to deploy these registry updates proactively to avoid disruptions caused by automatic agent attempts to re-register post device inactivity cleanup.
For further details on Agent Manager deployment and registry settings, consult the ControlUp documentation at https://docs.controlup.com/.
Read the entire article here...
Read the entire article here...
Automating Detection and Remediation of Stuck BitLocker Encryption on Windows 11 Endpoints with ControlUp Real-Time Automation Engine
When deploying hundreds of Windows 11 endpoints managed by Intune, a common issue with BitLocker encryption is that the process sometimes becomes stuck at a certain percentage completion. While manually pausing and restarting the encryption process resolves the issue within minutes, automating this detection and remediation can save considerable time and ensure consistent endpoint security.
Using ControlUp Real-Time Automation Engine (CU4D), such automation is achievable by leveraging scripted detection and remediation. One approach is to create a single script that both detects the encryption status and initiates a restart of the encryption process if it remains stuck at the same percentage. This script can be deployed across all affected devices and scheduled to run periodically, for example, once per day, to identify any stuck BitLocker jobs and resolve them promptly.
A more modular approach involves creating two separate scripts: a detection script and a remediation script. The detection script would check the current encryption percentage, and if it identifies a stuck state, it writes the status to a custom index attribute within ControlUp. An alert can then be configured based on the value of this custom attribute. When the alert triggers due to a stuck encryption status, the remediation script executes automatically to restart the BitLocker encryption, ensuring a timely resolution without manual intervention.
This method harnesses ControlUp's ability to store custom scripted outputs in custom indices and link those to alert triggers, thus providing a robust, automated way to handle encryption stalls on Intune-managed Windows 11 devices. For further details on configuring custom scripts, custom indices, and alerts in ControlUp, administrators can refer to ControlUp's documentation at https://docs.controlup.com and explore automation capabilities in the ControlUp Academy at https://cuacademy.controlup.com.
Read the entire article here...
Read the entire article here...
How to Deploy ControlUp Agent via GPO in VDI Environments with MSI Silent Install and PowerShell Automation
Deploying the ControlUp Agent for VDI environments via Group Policy Object (GPO) does not have a dedicated official knowledge-base article, as the installation approach aligns with generic MSI silent installs used in other deployment methods like SCCM or PDQ. The official ControlUp documentation regarding local machine connection and agent communication is the primary reference for deployment: https://support.controlup.com/docs/connect-to-your-machines-locally and https://support.controlup.com/docs/agent-outbound-communication.
For non-persistent VDI setups that use a gold master image, the recommended method is to install the ControlUp agent MSI directly on the master image with specific MSI properties: `MASTER_IMAGE=true`, along with the `AUTHKEY` and `RegistrationKey`. This avoids the need for repeated installations on cloned machines via GPO. For persistent, domain-joined virtual machines, using a GPO Computer Startup Script to run an msiexec command is preferred over GPO Software Installation because it allows passing required MSI properties. An example command line looks like this:
`msiexec /i \\share\ControlUpAgent-xxxx.msi /qn AUTHKEY="" RegistrationKey="" MASTER_IMAGE=true`
The authentication keys are retrieved from the Real-Time Console under Settings → Agent. The Registration Key is mandatory starting from version 9.0. Machines must be manually added to the organization tree unless the agent version is 9.0.5 or higher, which supports self-registration.
When GPO deployment is not optimal, if remote RPC or WMI connectivity is available, deploying the agent remotely via the ControlUp console or Monitor is simpler. For cloud-managed endpoints, Microsoft Intune is the officially documented deployment method.
A practical example was shared demonstrating a PowerShell script to deploy the ControlUp Agent MSI for VDI within a Nerdio scripted action context. The script copies the MSI from a UNC file share to a local temporary path, validates that the MSI file is correctly copied (including a check on the MSI magic bytes), and then executes the msiexec command with silent installation flags, the authentication keys, and logging enabled. It captures and reports installation exit codes and prompts when a reboot is required. The script also includes a post-installation check to list ControlUp-related services to confirm the agent installed and started as expected.
This approach encapsulates the best practice for deploying ControlUp agents in VDI environments using GPO, balancing MSI property requirements, version-specific authentication mechanisms, and practical scripting for automation. For detailed agent deployment contexts and command-line references, the ControlUp official documentation remains the authoritative source: https://support.controlup.com/docs/connect-to-your-machines-locally and https://support.controlup.com/docs/agent-outbound-communication.
Read the entire article here...
Read the entire article here...
How to Implement Native macOS and Windows Self-Service Disk Cleanup via ControlUp Edge DX Without External Tools
A ControlUp community member developed a native self-service disk cleanup solution for macOS and Windows users, designed to be triggered via ControlUp Edge DX without requiring IT intervention or external tools. The goal was to allow users to safely free disk space through a simple, native dialog that displays current disk usage and offers a checklist of safe-to-clean areas such as Trash, application caches, container caches, logs, Xcode build cache, and old temporary files. Each item is described in plain language and sorted by the space it occupies, allowing users to select and confirm the cleanup themselves.
On macOS, the dialog is implemented using only built-in osascript capabilities—no additional tools like swiftDialog or extra installations are necessary. For both macOS and Windows, the solution emphasizes safety by running a dry-run by default, excluding critical system folders and personal directories such as Documents, Downloads, Keychains, and SSH keys from cleanup. The cleanup operates within the context of the logged-in user, not root, ensuring user-specific data protection. After cleanup, the system verifies the amount of space reclaimed against the actual free volume.
Triggering this cleanup from an Edge DX alert, either automatically due to disk usage thresholds or on-demand, enables a small dashboard that reports on reclaimable and freed disk space, all without requiring elevated permissions, Intune writes, or admin consent. One of the more challenging technical aspects was delivering the cleanup dialog from a root-level agent into the user’s session, given the restrictions of macOS and Windows environments.
The community member shared that while the script could likely be optimized or shortened by more experienced developers, this version works reliably and safely. Detailed setup documentation is available by request. Additionally, to complement the cleanup tool, the developer created an analytics dashboard to track the cumulative space saved by the script. This solution offers a practical way for organizations using ControlUp Edge DX to empower their end users with safe, controlled disk cleanup capabilities, minimizing helpdesk workload without compromising disk security or user privacy.
For more on creating and managing custom alerts and actions within ControlUp Edge DX, consult the official documentation at https://docs.controlup.com/edge and explore ControlUp Academy at https://cuacademy.controlup.com for training on extending ControlUp functionality.
Read the entire article here...
Read the entire article here...
Monitoring CPU Thermal, Power, and Frequency Throttling with Custom ControlUp Scripts and Dashboards
A common challenge in monitoring CPU performance is that traditional CPU utilization metrics often fail to reveal the underlying causes of slowdowns, especially in cases related to thermal or power throttling that reduce CPU frequency without triggering high CPU%. To address this, a detailed custom PowerShell script and accompanying dashboard have been developed to report CPU temperature, frequency, and distinct throttling signals in a granular and actionable way. This solution creates a dedicated data index named `custom_cpu_throttle` to track multiple independent throttling signals, enabling more precise diagnostics of CPU performance issues.
The core innovation of this approach lies in splitting CPU throttling indicators into three separate categories: thermal throttling (hardware/BIOS-related issues such as overheating or dust), power throttling (policy-related causes like power plans, Intune profiles, or BIOS max-state configurations), and frequency throttling (cases where the CPU clock speed drops below 85% of the rated max under load, capturing otherwise silent throttling scenarios common on AMD processors or CPUs with boost frequencies). By differentiating these factors, the method captures scenarios where traditional Event ID 37 logs or CPU utilization metrics miss critical performance degradations.
The script captures a range of per-device metrics during each run, including temperature and its source, throttle status types, current and maximum CPU frequency with a ratio percentage, and comprehensive throttling evidence logs that correlate performance drops with frequency and utilization data. This data feeds into a customizable ControlUp dashboard that aggregates key performance indicators, categorizes throttle types, tracks frequency trends, and identifies devices exhibiting the hottest or most throttled behavior. The dashboard also correlates these metrics with user experience signals like application crashes and digital employee experience (DEX) scores, enabling targeted troubleshooting from a single pane of glass.
Technical details specify that the solution runs on Microsoft Windows devices using PowerShell scripts triggered every two minutes (120 seconds) with a 60-second timeout and sends data to the `custom_cpu_throttle` index only when devices are online. The solution supports filtering by device, throttle type, and status for focused analysis. While the script covers many AMD-specific throttling scenarios, some complexities remain given AMD's diverse behaviors, though unrealistic values are filtered out to maintain accuracy. This tool is well-suited for IT administrators and helpdesk teams looking to resolve performance tickets where CPU utilization appears normal but throttling impacts response times, such as in Outlook or other user-facing applications.
For detailed setup or a walkthrough, the script (`SP-CPU-Throttle-v2.ps1`) and ControlUp dashboard configuration (`SP-CPU-Throttle-Dashboard.json`) are available on request. This solution is an example of extending ControlUp’s monitoring capabilities via custom scripts and dashboards to deliver deeper insights into CPU performance issues that go beyond default instrumentation.
Read the entire article here...
Read the entire article here...
Managing Local Admin Privileges in ControlUp
A user asked for help with removing users from the local Administrators group when they are not allowed those privileges. Other members suggested using a script through the Action > System Scripts or utilizing the Compliance module. The conversation also touched on using specific triggers and including tags or device groups in the criteria for running the script. Ultimately, the user was able to find a solution through the use of device tags in the Scripts capabilities. The conversation can be found in the #channel channel.
Read the entire article here...
Read the entire article here...
ControlUp Community Meetup #14: Inside ControlUp DaaS IQ — A Deep Dive with PM Gilad Broun
AVD management doesn’t have to be hard and expensive.
If you run Azure Virtual Desktop, you know the pain: unpredictable costs, fragile PowerShell scripts, fragmented visibility, and tab-hopping between the Azure Portal, Intune, and a dozen custom tools just to keep the lights on.
ControlUp’s answer is DaaS IQ — a purpose-built control plane for AVD that replaces the chaos with smart, reusable policies, centralized lifecycle management, and real-time cost intelligence.…
Read the entire article here...
Read the entire article here...
New Feature Request: Automatic Response to Offline Device Notifications
A user discusses a potential new feature for ControlUp - an automatic response to offline device notifications. They suggest a form that would automatically populate with device information to make it easier for the user to provide the appropriate response/action. Other users confirm and suggest a specific format for the link that would fill out certain fields for the user. The discussion can be seen as a potential feature request for ControlUp.
Read the entire article here...
Read the entire article here...