A PowerShell script that queries device data from the ControlUp Edge API using paginated search_after calls experienced failures starting Sunday, returning a 400 Bad Request error. The error message indicated that sorting or aggregations on the _id metadata field were no longer supported, specifically stating that "Using the _id metadata field in aggregations, sorts, scripts, or top-level field loads... is not supported because it loads fielddata into the heap." This change caused calls sorting by the internal OpenSearch/Elasticsearch document _id to fail.
The root cause was an upstream change implemented over the weekend by ControlUp. The API now blocks the use of the _id metadata field in queries to prevent severe OpenSearch JVM issues such as Out of Memory (OOM) conditions, which were observed when sorting or aggregating on large indexes by _id. This protective measure was applied after discovering more widespread usage of _id sorting than previously expected. In response to the problem and customer impact, ControlUp temporarily disabled this restriction for affected tenants, including the user’s tenant, to restore functionality while addressing the underlying stability concerns.
The resolution for the user’s scripts was to update their pagination logic to sort and search_after using a real mapped field, such as device name, instead of the internal _id metadata field. This change immediately restored proper API operation without requiring further modifications. The user’s initial script had been generated with assistance from a language model but required this adjustment due to the updated API behavior.
The discussion also raised the topic of API change notifications. ControlUp has yet to provide advance announcements or subscription-based alerts for breaking API changes, which users expressed interest in receiving. ControlUp may consider this feedback to improve communication about future updates.
For users facing similar errors, it is essential to avoid using the internal _id metadata field for sorting or pagination in ControlUp API queries. Instead, rely on indexed, mapped fields to ensure compatibility with recent security and stability improvements to the ControlUp Edge API backend built on OpenSearch.
Relevant ControlUp resources include the official documentation on the Edge API and pagination techniques, available at https://docs.controlup.com, and the ControlUp Academy at https://cuacademy.controlup.com for learning best practices with API integration.
Read the entire article here...
PowerShell Related Training & Support Archives
PowerShell training and support-related archives from inside the ControlUp Community on Slack.
How to Update Records Without Duplication and Manage Retention in Custom ControlUp Edge Data Indexes
When writing records to a custom ControlUp Edge data index via the REST API (POST to edge/api/data/), users may encounter an issue where repeated writes of the same record result in duplicate entries rather than updates to existing records. Additionally, there is a desire to prevent these records from expiring after the default 28 days of inactivity. This discussion sheds light on both the mechanics of record updating and the association of records with the endpoint running the write operation.
The key to controlling whether a record is created anew or updated lies in the uniqueness of the "key" field or primary identifier used in the data index schema. When writing data via a PowerShell script—whether executed inside ControlUp or externally—the operation will create a new record if the key value is not recognized. To update an existing record, the key must remain consistent and the write must explicitly target that key. The official ControlUp scripting guide provides useful guidance for writing data to an index, outlining how to structure the payload and use keys: https://support.controlup.com/docs/scripting-guide#writing-to-a-data-index. Running the script inside ControlUp offers the advantage of on-demand execution with local file availability, but it is not strictly necessary; scripts can also run externally.
A practical complication arises from the fact that data written to the index often becomes associated with the endpoint where the script executes, as seen when the computer name appears linked to each record. This behavior stems from ControlUp’s design, where data sources are tied to machine endpoints to facilitate monitoring and troubleshooting. In scenarios where building information needs to be stored independently of endpoint context, some organizations have implemented custom solutions such as storing building data locally on endpoints (e.g., in registry or Active Directory properties), then running scripts on each endpoint to gather and send this data to ControlUp. While this approach inherently associates data with those endpoints, it maintains up-to-date building information across the environment.
Controlling record expiration beyond the default 28 days typically requires adjusting settings on the data index or implementing regular writes to keep the record active. Without ongoing updates, ControlUp’s retention policy will remove inactive records. Users are also encouraged to explore ControlUp Workflows for automating data collection and writing processes, which can streamline operations despite a learning curve. The ControlUp support team and community forums remain valuable resources for addressing specific scripting and data index challenges.
For additional details and sample scripts, the ControlUp scripting guide is recommended: https://support.controlup.com/docs/scripting-guide#writing-to-a-data-index.
Read the entire article here...
Read the entire article here...
Support for Boolean Fields in ControlUp Indexes via PowerShell Scripts
A community member inquired about the official support for Boolean columns in ControlUp when written to via a PowerShell script. They noted that their script was functioning as expected, showing a dropdown with options for "true" and "false" instead of a plain text box for the Boolean field. This behavior indicates that Boolean fields are recognized and handled appropriately within the ControlUp system's indexing and UI.
The confirmation came from multiple users, including a ControlUp expert, that Boolean fields are indeed supported. ControlUp's platform supports defining columns with Boolean data types, enabling users to interact with these fields through dropdown selectors for true/false values, which enhances data consistency and ease of use.
This means that scripts or automation workflows that write Boolean values into ControlUp indexes can rely on native support for true/false states. This feature is useful for scenarios where binary states need to be tracked and toggled directly from the ControlUp interface without requiring manual text input.
For more detailed information on supported data types and scripting integration with ControlUp indexes, users can refer to the official ControlUp documentation at https://docs.controlup.com, and consider the ControlUp Academy (https://cuacademy.controlup.com) for deeper learning resources on scripting and data management in ControlUp.
Read the entire article here...
Read the entire article here...
How to Deploy ControlUp Agent via GPO in VDI Environments with MSI Silent Install and PowerShell Automation
Deploying the ControlUp Agent for VDI environments via Group Policy Object (GPO) does not have a dedicated official knowledge-base article, as the installation approach aligns with generic MSI silent installs used in other deployment methods like SCCM or PDQ. The official ControlUp documentation regarding local machine connection and agent communication is the primary reference for deployment: https://support.controlup.com/docs/connect-to-your-machines-locally and https://support.controlup.com/docs/agent-outbound-communication.
For non-persistent VDI setups that use a gold master image, the recommended method is to install the ControlUp agent MSI directly on the master image with specific MSI properties: `MASTER_IMAGE=true`, along with the `AUTHKEY` and `RegistrationKey`. This avoids the need for repeated installations on cloned machines via GPO. For persistent, domain-joined virtual machines, using a GPO Computer Startup Script to run an msiexec command is preferred over GPO Software Installation because it allows passing required MSI properties. An example command line looks like this:
`msiexec /i \\share\ControlUpAgent-xxxx.msi /qn AUTHKEY="" RegistrationKey="" MASTER_IMAGE=true`
The authentication keys are retrieved from the Real-Time Console under Settings → Agent. The Registration Key is mandatory starting from version 9.0. Machines must be manually added to the organization tree unless the agent version is 9.0.5 or higher, which supports self-registration.
When GPO deployment is not optimal, if remote RPC or WMI connectivity is available, deploying the agent remotely via the ControlUp console or Monitor is simpler. For cloud-managed endpoints, Microsoft Intune is the officially documented deployment method.
A practical example was shared demonstrating a PowerShell script to deploy the ControlUp Agent MSI for VDI within a Nerdio scripted action context. The script copies the MSI from a UNC file share to a local temporary path, validates that the MSI file is correctly copied (including a check on the MSI magic bytes), and then executes the msiexec command with silent installation flags, the authentication keys, and logging enabled. It captures and reports installation exit codes and prompts when a reboot is required. The script also includes a post-installation check to list ControlUp-related services to confirm the agent installed and started as expected.
This approach encapsulates the best practice for deploying ControlUp agents in VDI environments using GPO, balancing MSI property requirements, version-specific authentication mechanisms, and practical scripting for automation. For detailed agent deployment contexts and command-line references, the ControlUp official documentation remains the authoritative source: https://support.controlup.com/docs/connect-to-your-machines-locally and https://support.controlup.com/docs/agent-outbound-communication.
Read the entire article here...
Read the entire article here...
Troubleshooting Access Denied Errors When Upgrading ControlUp Monitor Servers Using PowerShell
When upgrading a ControlUp monitor server from version 9.0.0.1680 to 9.2.0.733 using the PowerShell commandlet Invoke-CUMonitorUpdate, the process may fail with an "Access is denied" error. This failure occurs after the installation steps "Install Verify Service already installed" and "Install Copy Files" complete successfully, specifically at the step involving stopping the `cuMonitor` service. The error indicates that Windows denied access during the attempt to stop or control this service, despite running PowerShell as an administrator and having folder-level access to the monitor installation directory.
The root cause is typically related to security settings or interference by antivirus (AV) or endpoint detection and response (EDR) software, which can block the service from stopping. Alternatively, a restrictive service Access Control List (ACL) can prevent the upgrade from proceeding. When attempting to upgrade through the ControlUp Console, a similar failure occurs silently because the console relies on remote commands (via admin share or WMI) that suffer the same permissions restrictions.
To resolve this issue, manually stopping the `cuMonitor` service with elevated privileges is required. Running `sc.exe stop cuMonitor` on the monitor host as an administrator can successfully stop the service. If this command fails, it is necessary to configure AV/EDR exclusions for the ControlUp monitor executable and folder (`C:\Program Files\Smart-X\ControlUpMonitor\` and `cuMonitor.exe`) or adjust the service's ACL using `sc.exe sdshow cuMonitor` to inspect and modify permissions. Once the service is stopped, re-running the Invoke-CUMonitorUpdate commandlet completes the upgrade successfully.
When upgrading through the ControlUp Console, ensure the account used has local administrator rights on the monitor host; otherwise, upgrade via the PowerShell commandlet locally on the machine is recommended for reliability. This approach has been verified to resolve the access denied error and enable the upgrade to proceed without interruption.
For more details on managing ControlUp monitor services and upgrade procedures, refer to the official ControlUp documentation at https://docs.controlup.com or consult ControlUp support resources.
Read the entire article here...
Read the entire article here...
Troubleshooting PowerShell Script Execution Failures in User Context with Ivanti Application Control and ControlUp
A user encountered an issue when attempting to run PowerShell scripts on endpoint machines using ControlUp (CU) in the user context. While executing scripts in the system context was successful, running them as the user failed with an error code -1. The environment included Ivanti Application Control, a security solution similar to Windows Defender Application Control (WDAC) or AppLocker, which enforces application execution policies. The user had configured a process rule allowing SipAgent.exe to launch PowerShell.exe, which was confirmed to function correctly via Process Monitor and Process Explorer, as PowerShell.exe briefly appeared. However, the actual PowerShell script never executed, even a simple command like ‘Start-Sleep 1000’ failed to run.
Disabling the Ivanti Application Control service restored the ability to run scripts, indicating a conflict with the security controls. Interestingly, no block events were logged by Ivanti, suggesting the issue was not a straightforward deny event at the application control layer. The user inquired about which processes and system files ControlUp uses during script execution to better understand the interaction.
The root cause was identified as an Ivanti configuration rule that elevated PowerShell processes for the test user account. This elevation interfered with the ControlUp execution mechanism, preventing the script from running properly in user context. The resolution involved creating an exception within the Ivanti elevation rule: PowerShell processes launched with the ‘-file’ parameter were excluded from elevation. This adjustment allowed the scripts to run successfully while maintaining the intended elevation policy for other PowerShell instances.
This case highlights the importance of carefully managing application control and elevation policies in security products like Ivanti when deploying user-context scripts via ControlUp. Explicitly excluding ControlUp-launched PowerShell processes that run script files from elevation can prevent execution failures without compromising security. Users facing similar issues should review their application control and elevation configurations, particularly any rules that modify or elevate PowerShell, and test exclusions for script execution parameters. For more details on ControlUp’s script execution methods and related settings, users can consult the official ControlUp documentation at https://docs.controlup.com.
Read the entire article here...
Read the entire article here...
Automating VDI Registration in ControlUp Console
Automating the addition of Virtual Desktop Infrastructure (VDI) machines to the ControlUp console upon agent installation can streamline management and monitoring processes. While ControlUp for Desktops offers a command-line installation method that automatically registers machines, a similar approach for VDIs requires specific configuration.
To achieve automated registration of VDIs, you can utilize the Install-CUAgent PowerShell cmdlet, which is part of the ControlUp Automation module. This cmdlet allows for the download and installation of the ControlUp Agent on local machines, including VDIs. By providing the necessary authentication key during installation, the agent registers the machine with your ControlUp environment. For non-domain-joined machines, an API authentication token is required. ([support.controlup.com](https://support.controlup.com/docs/install-cuagent-install-an-agent?utm_source=openai))
For non-persistent VDIs, such as those created from a master image, it's essential to configure the agent to handle these scenarios appropriately. By setting the agent as a master image, it ensures that new VDIs created from this image will automatically register with the ControlUp console, preventing duplicate entries and maintaining an accurate device inventory. ([support.controlup.com](https://support.controlup.com/v1/docs/agent-outbound-communication?utm_source=openai))
Additionally, enabling folder synchronization with your VDI infrastructure can further streamline management. This feature ensures that VDIs are correctly registered and prevents stale machines from cluttering the interface. By integrating with your VDI environment, ControlUp can automatically detect and manage VDIs, enhancing the efficiency of your monitoring and management processes. ([support.controlup.com](https://support.controlup.com/docs/connecting-to-your-vdi-infrastructure?utm_source=openai))
By implementing these methods, you can automate the addition of VDIs to the ControlUp console, ensuring accurate device registration and efficient management of your virtual desktop environment.
Read the entire article here...
Read the entire article here...
Comprehensive User-Created Training and Operating Manual for ControlUp Real-Time DX Console
A ControlUp community member has created a comprehensive Training and Operating Manual for the ControlUp Real-Time Digital Experience (DX) Console, originally developed as internal training material but now shared publicly to benefit the wider user community. The manual spans roughly 22 pages and includes detailed explanations, diagrams, and knowledge base references, aiming to deepen understanding of ControlUp’s architecture, setup, operations, and troubleshooting.
The manual covers multiple critical areas for both new and experienced users. It begins with an overview of the console architecture and the data collector pattern, supported by detailed diagrams to visualize the system’s workings. Installation topics include the sequence of setup steps, pitfalls like the “shared-credentials trap,” mechanisms for Multi-Site Association, and agent auto-deployment processes. For everyday operations, the manual highlights powerful console features such as column grouping, Branch Mapping, and registry comparison. It also clarifies common confusions around event logs, particularly the differences between LogName and event ID.
Troubleshooting guidance is a key focus, addressing connectivity challenges including those posed by corporate proxy environments, with practical PowerShell snippets included to assist in resolution. Advanced topics such as script actions with argument extraction from column values are also presented. The manual further differentiates ControlUp’s on-premises variants, specifically IOP, COP, and SOP configurations, which is valuable for users managing hybrid or fully on-premises deployments.
This document is an independent user-created resource and is explicitly noted as unofficial; it does not carry warranty, support, or official endorsement from ControlUp. Users are encouraged to use it as a supplement to official resources and to consult ControlUp’s Knowledge Base and ControlUp Academy for formal guidance. The author invites feedback and corrections from the community to improve the manual’s accuracy and usefulness over time. This shared resource represents a valuable starting point and practical reference for ControlUp console users wishing to deepen their operational knowledge and troubleshooting skills.
For official documentation and further training, users can visit the ControlUp Knowledge Base at https://docs.controlup.com and the ControlUp Academy at https://cuacademy.controlup.com.
Read the entire article here...
Read the entire article here...
How to Diagnose Microsoft Teams SlimCore Optimization in Citrix and Other VDI Environments Using PowerShell Scripts
This discussion highlights two PowerShell scripts developed to aid tracking and diagnosing Microsoft Teams SlimCore Optimization specifically within Citrix environments, with potential applicability to Azure Virtual Desktop (AVD), Windows 365 (W365), and VMware Horizon sessions. SlimCore is an optimized media stack used in virtual desktop infrastructure (VDI) scenarios to enhance Teams call performance by offloading audio and video processing to the client side.
Read the entire article here...
Read the entire article here...
How to Use ControlUp Live View to Identify Processes Causing CPU Spikes in VDI Environments
When attempting to diagnose CPU spikes and identify the specific processes responsible using ControlUp, the most effective approach is to utilize the Live view, also known as the VDI page in the ControlUp Web UI. This view provides real-time, granular insights into process-level CPU consumption across virtual desktop infrastructure (VDI) environments. Unlike historical reports, which show aggregated past data such as CPU Utilization Max but lack immediacy, the Live view updates metrics approximately every three seconds, enabling administrators to track CPU spikes as they happen and correlate them with individual processes.
Accessing this Live view requires either appropriate licensing or configuration that may prompt for a user principal name (UPN) login depending on how ControlUp is set up in the organization. When correctly logged in, administrators can drill down into specific machines experiencing CPU spikes and see a detailed, sortable list of CPU-intensive processes. This functionality helps pinpoint the exact processes causing resource bottlenecks, which is critical since the total CPU utilization of a machine does not always equal the sum of all visible processes. This discrepancy arises because kernel interrupts and other system-level operations that consume CPU are not attributed to individual user processes.
Users noted that if access to the Live view is initially unavailable or the relevant VDI tab not visible, it may be due to missing licenses or particular configuration settings controlled by the ControlUp administrator in the environment. In such cases, reaching out to the administrator and providing the UPN for authentication often resolves access issues. Without this, troubleshooting CPU spikes becomes difficult, and users may resort to external scripting solutions like PowerShell, which can be less reliable and less integrated.
Once logged into the Live view, operators can monitor real-time CPU usage per user and process, identify the top five consumers, and respond quickly to performance incidents causing a slowdown in the VDI environment. While the Live view is potent for immediate troubleshooting, storing long-term granular process data in a live manner is impractical due to data volume and cost, so ControlUp uses historical reports for trend analysis. Overall, the Live view is regarded as an essential and powerful feature in ControlUp’s suite for understanding and resolving CPU utilization spikes in virtualized desktop environments.
For further information on configuring and accessing the Live view in ControlUp, administrators can consult the official ControlUp documentation at https://docs.controlup.com and the ControlUp Academy at https://cuacademy.controlup.com. These resources cover licensing requirements, configuration steps, and best practices for effectively using real-time monitoring to maintain optimal VDI performance.
Read the entire article here...
Read the entire article here...