Learn how to connect AI to live enterprise data using the ControlUp MCP Server. In this session, Chris Twiest explains the fundamentals of Model Context Protocol (MCP), including LLMs, prompts, system prompts, tool calling, and retrieval, before demonstrating how to connect Claude Desktop to ControlUp. Watch a live walkthrough of configuring the MCP Server, querying real-time endpoint data, visualizing application crashes, comparing results against historical baselines, and using system prompts to dramatically improve AI accuracy. The session also explores practical use cases, including upgrade planning, combining multiple MCP servers, building custom AI interfaces, and the future of autonomous endpoint management.
Read the entire article here...
Reporting Related Training & Support Archives
Reporting training and support-related archives from inside the ControlUp Community on Slack.
Investigating Historical Network Usage Spikes and Setting Alerts with ControlUp for Desktops
A user reported a network performance issue at one of their offices where a single computer had downloaded and uploaded several gigabytes of data within approximately the last four hours. They sought a way to determine exactly what data was downloaded and where it was uploaded to after the fact.
ControlUp experts clarified that while ControlUp for Desktops can provide detailed network usage volume information retrospectively, it does not store historical data about the specific destination addresses or detailed process-level network activity. The device’s Performance tab includes historical charts such as Network Usage (MB/s) and Hourly Network Usage (MB), which show the volume of data sent and received over time. This helps confirm the timing and magnitude of a network spike but only at the overall device level, not by specific process or destination.
For live, real-time network connection details—including which process is communicating with which remote IP address—the Network tab and TCP Connections Map can be used. This tab shows detailed, process-to-destination connections but does not retain historical data, so it only helps monitor ongoing network activity. Consequently, if the large data transfer activity occurred several hours ago and is no longer ongoing, ControlUp itself cannot provide retrospective insights into the process or endpoints involved.
To investigate historical transfers of this nature, network security and monitoring should be supplemented with firewall logs, proxy logs, or netflow data, which retain detailed connection records over time. This approach is recommended for network administrators with access to those tools.
For prevention and proactive detection, users can configure static threshold alerts in ControlUp to notify them immediately if network usage exceeds a predefined value in the future. This allows administrators to catch high-volume transfers as they happen and investigate using real-time detail from ControlUp. The documentation for setting static threshold alerts can be found here: https://support.controlup.com/docs/devices-static-threshold-alerts.
Additional guidance on real-time network analysis is available at https://support.controlup.com/docs/live-network-analysis.
Read the entire article here...
Read the entire article here...
How to Implement Native macOS and Windows Self-Service Disk Cleanup via ControlUp Edge DX Without External Tools
A ControlUp community member developed a native self-service disk cleanup solution for macOS and Windows users, designed to be triggered via ControlUp Edge DX without requiring IT intervention or external tools. The goal was to allow users to safely free disk space through a simple, native dialog that displays current disk usage and offers a checklist of safe-to-clean areas such as Trash, application caches, container caches, logs, Xcode build cache, and old temporary files. Each item is described in plain language and sorted by the space it occupies, allowing users to select and confirm the cleanup themselves.
On macOS, the dialog is implemented using only built-in osascript capabilities—no additional tools like swiftDialog or extra installations are necessary. For both macOS and Windows, the solution emphasizes safety by running a dry-run by default, excluding critical system folders and personal directories such as Documents, Downloads, Keychains, and SSH keys from cleanup. The cleanup operates within the context of the logged-in user, not root, ensuring user-specific data protection. After cleanup, the system verifies the amount of space reclaimed against the actual free volume.
Triggering this cleanup from an Edge DX alert, either automatically due to disk usage thresholds or on-demand, enables a small dashboard that reports on reclaimable and freed disk space, all without requiring elevated permissions, Intune writes, or admin consent. One of the more challenging technical aspects was delivering the cleanup dialog from a root-level agent into the user’s session, given the restrictions of macOS and Windows environments.
The community member shared that while the script could likely be optimized or shortened by more experienced developers, this version works reliably and safely. Detailed setup documentation is available by request. Additionally, to complement the cleanup tool, the developer created an analytics dashboard to track the cumulative space saved by the script. This solution offers a practical way for organizations using ControlUp Edge DX to empower their end users with safe, controlled disk cleanup capabilities, minimizing helpdesk workload without compromising disk security or user privacy.
For more on creating and managing custom alerts and actions within ControlUp Edge DX, consult the official documentation at https://docs.controlup.com/edge and explore ControlUp Academy at https://cuacademy.controlup.com for training on extending ControlUp functionality.
Read the entire article here...
Read the entire article here...
Analyzing Windows Client Boot Time Delays: Using External Scripts to Generate Boot Performance Reports in ControlUp Environments
A community discussion sought an effective method to analyze Windows client boot times with detailed insights into the causes of any delays. The original inquiry focused on whether there was an existing script or dashboard capable of breaking down boot delays, as the environment faced issues with slow client startups. Such diagnostics would provide valuable information to address client performance problems.
In response, a community member shared a beta script designed as a boot analyzer, which generates an HTML report summarizing boot performance. This script creates an output that visually breaks down boot times, helping identify the components or processes causing delays. However, the script does not currently save boot information within the ControlUp platform because the ControlUp agent is not active during the Windows boot phase, preventing direct integration of boot data into ControlUp's indexes.
While the script is substantial and complex, it offers a practical starting point for environments needing detailed boot-time diagnostics. The contributor noted the lack of time to fully test writing the boot data to the ControlUp index but confirmed the HTML report format is functional and aesthetically clear. The shared approach highlights the current workaround for boot analysis within ControlUp environments: external data collection and report generation rather than native ControlUp indexing, due to agent limitations during system startup.
For users seeking to monitor boot performance in Windows clients using ControlUp, this solution involves running external scripts to analyze boot metrics and then reviewing detailed offline reports. Until ControlUp supports native boot-time data collection via its agent during the startup phase, such scripts provide the most direct method to diagnose and troubleshoot boot delays.
Read the entire article here...
Read the entire article here...
How to Alert on Added Storage Devices by Drive Letter in ControlUp Using os_disk_configuration Filters
A community member sought assistance with creating a ControlUp trigger or alert to detect when storage devices are added to a physical endpoint and assigned a drive letter or mounted. The data relevant to this event is visible in the ControlUp 4D (CU4D) Performance tab under the Operating System location and stored in the *_devices* index. Specifically, the data is found in the os_disk_configuration field, which contains a JSON array showing details about mounted drives, including drive letters. The user’s challenge was to configure an alert that could detect any newly mounted drive except the system drive C:\ without having to set multiple alerts for every potential drive letter (e.g., D:\, E:\, etc.). They noted the lack of regex support in the filter queries limited their options.
The issue arises because the os_disk_configuration field holds a JSON array with multiple drive entries, and filtering out drive_letter "C:\" naively removes all entries due to the structure of the array. Attempts to use a “does not contain” filter eliminated all Windows devices, only showing macOS devices, complicating detection on Windows endpoints. The user also tried to narrow the focus to removable media but learned that their security team's use case requires alerting on any disk, mounted by drive letter, which remains the best indicator available.
Advice provided during the discussion included adding filters for platform or OS to ensure the alert targets only Windows devices (e.g., platform set to 1 or OS equals Windows). This helped reduce irrelevant results but did not completely solve the filtering problem. Suggestions included playing with additional filters such as combining conditions to exclude drive_letter "C:\" while explicitly including removable devices, though this required trial and error. A recommendation was to test filter configurations in the CU4D index view, including setting the platform to 1 to target Windows devices specifically.
Ultimately, the thread highlights the challenge in using ControlUp’s current filtering capabilities on complex JSON arrays like os_disk_configuration for dynamic drive letters without regex support. The workaround involves narrowing the scope by platform/OS filters and experimenting with composite negation filters, although a straightforward out-of-the-box solution for this specific alert scenario is limited. Users needing comprehensive coverage for any drive letter other than C:\ must create a series of alerts or await enhanced filter features. For now, leveraging the detailed disk configuration data in the *_devices* index with strategic filter layering is the best approach.
For further reading on creating and troubleshooting alerts and filters in ControlUp, users can consult official documentation at https://docs.controlup.com and explore ControlUp Academy resources at https://cuacademy.controlup.com.
Read the entire article here...
Read the entire article here...
How to Diagnose Microsoft Teams SlimCore Optimization in Citrix and Other VDI Environments Using PowerShell Scripts
This discussion highlights two PowerShell scripts developed to aid tracking and diagnosing Microsoft Teams SlimCore Optimization specifically within Citrix environments, with potential applicability to Azure Virtual Desktop (AVD), Windows 365 (W365), and VMware Horizon sessions. SlimCore is an optimized media stack used in virtual desktop infrastructure (VDI) scenarios to enhance Teams call performance by offloading audio and video processing to the client side.
Read the entire article here...
Read the entire article here...
Resolving UI and Remote Control Discrepancies When Accessing Devices via Global Search in ControlUp 4 Desktop
When using ControlUp 4 Desktop (CU4D), users have observed a discrepancy in the user interface and remote control experience depending on how they access device details. Specifically, accessing a device via the global search feature directs users to a different-looking interface than when navigating through the Devices > Details path. The interface reached through global search appears to be the older Angular-based UI, characterized by a red-themed layout and missing certain functional tabs such as RMM (Remote Monitoring and Management), Internet Explorer management, network, and storage tabs that are present in the modern white-themed interface accessed via the sidebar device menu.
This difference is not just cosmetic; the remote desktop experience also varies between these two paths. The remote control window initiated from the global search interface does not match the one available through the Devices > Details route, indicating that two different backend platforms or UI frameworks are in use. The sidebar route leverages the integrated DEX (Digital Employee Experience) platform embedded in the main ControlUp site, while the global search currently directs users to the legacy environment.
This issue has been acknowledged by the ControlUp team as a known problem. A fix is planned to unify the experience so that both access methods will lead to the modern UI and consistent functionality, including the proper remote control interface and management tabs. The resolution was expected to be rolled out within a few weeks from the time the issue was reported.
Until this fix is deployed, users should expect the global search function to open the older interface with limited features, while the Devices > Details navigation provides the full, up-to-date DEX platform experience. For the latest updates on this issue and other CU4D features, users can refer to the official ControlUp documentation and community resources.
Read the entire article here...
Read the entire article here...
How to Initiate Remote Assist for VDI Sessions in ControlUp and Upcoming Improvements to Global Search and Enrich Plugin
In ControlUp, currently the primary method to start a remote assist session for a VDI user involves navigating through the interface by selecting VDI > Details > drilling down to the specific pool, or by using the search grid to find a user, then right-clicking their session, choosing Session Management, and finally selecting Remote control. This workflow contrasts with some other remote support tools, such as ScreenConnect, which offer a global search feature enabling quick retrieval of any active session—physical or virtual—directly by searching the user's name.
The new global search functionality in ControlUp primarily directs users to the session activity reports rather than live session data. This design choice was intentional to focus on long-term historical data rather than real-time session information. However, multiple community members highlighted the benefit of extending the global search to include live VDI sessions, which would allow quicker identification and management of active sessions and streamline remote assist workflows, particularly for VDI.
The need for this improvement is tied to efforts by some organizations to consolidate tools, replacing separate remote assist products with ControlUp. The current process for VDI sessions is seen as less efficient compared to physical endpoints, where the user’s device appears directly in the global search, facilitating straightforward remote control initiation. Adding real-time VDI session data to the global search would align ControlUp’s user experience with that of other remote support tools and simplify support staff workflows.
Additionally, the community suggested expanding ControlUp’s Enrich plugin—already valued for integrating with ticketing systems and enhancing remote support capabilities—to cover VDI environments. This expansion is confirmed to be on ControlUp’s roadmap and is expected to be developed later in the year, promising to further enhance VDI support operations.
For more detailed guidance on starting remote control sessions and using ControlUp’s search features, users can consult the official ControlUp documentation at https://docs.controlup.com and explore the ControlUp Academy resources at https://cuacademy.controlup.com.
Read the entire article here...
Read the entire article here...
How to Use ControlUp Live View to Identify Processes Causing CPU Spikes in VDI Environments
When attempting to diagnose CPU spikes and identify the specific processes responsible using ControlUp, the most effective approach is to utilize the Live view, also known as the VDI page in the ControlUp Web UI. This view provides real-time, granular insights into process-level CPU consumption across virtual desktop infrastructure (VDI) environments. Unlike historical reports, which show aggregated past data such as CPU Utilization Max but lack immediacy, the Live view updates metrics approximately every three seconds, enabling administrators to track CPU spikes as they happen and correlate them with individual processes.
Accessing this Live view requires either appropriate licensing or configuration that may prompt for a user principal name (UPN) login depending on how ControlUp is set up in the organization. When correctly logged in, administrators can drill down into specific machines experiencing CPU spikes and see a detailed, sortable list of CPU-intensive processes. This functionality helps pinpoint the exact processes causing resource bottlenecks, which is critical since the total CPU utilization of a machine does not always equal the sum of all visible processes. This discrepancy arises because kernel interrupts and other system-level operations that consume CPU are not attributed to individual user processes.
Users noted that if access to the Live view is initially unavailable or the relevant VDI tab not visible, it may be due to missing licenses or particular configuration settings controlled by the ControlUp administrator in the environment. In such cases, reaching out to the administrator and providing the UPN for authentication often resolves access issues. Without this, troubleshooting CPU spikes becomes difficult, and users may resort to external scripting solutions like PowerShell, which can be less reliable and less integrated.
Once logged into the Live view, operators can monitor real-time CPU usage per user and process, identify the top five consumers, and respond quickly to performance incidents causing a slowdown in the VDI environment. While the Live view is potent for immediate troubleshooting, storing long-term granular process data in a live manner is impractical due to data volume and cost, so ControlUp uses historical reports for trend analysis. Overall, the Live view is regarded as an essential and powerful feature in ControlUp’s suite for understanding and resolving CPU utilization spikes in virtualized desktop environments.
For further information on configuring and accessing the Live view in ControlUp, administrators can consult the official ControlUp documentation at https://docs.controlup.com and the ControlUp Academy at https://cuacademy.controlup.com. These resources cover licensing requirements, configuration steps, and best practices for effectively using real-time monitoring to maintain optimal VDI performance.
Read the entire article here...
Read the entire article here...
Monitoring CPU Thermal, Power, and Frequency Throttling with Custom ControlUp Scripts and Dashboards
A common challenge in monitoring CPU performance is that traditional CPU utilization metrics often fail to reveal the underlying causes of slowdowns, especially in cases related to thermal or power throttling that reduce CPU frequency without triggering high CPU%. To address this, a detailed custom PowerShell script and accompanying dashboard have been developed to report CPU temperature, frequency, and distinct throttling signals in a granular and actionable way. This solution creates a dedicated data index named `custom_cpu_throttle` to track multiple independent throttling signals, enabling more precise diagnostics of CPU performance issues.
The core innovation of this approach lies in splitting CPU throttling indicators into three separate categories: thermal throttling (hardware/BIOS-related issues such as overheating or dust), power throttling (policy-related causes like power plans, Intune profiles, or BIOS max-state configurations), and frequency throttling (cases where the CPU clock speed drops below 85% of the rated max under load, capturing otherwise silent throttling scenarios common on AMD processors or CPUs with boost frequencies). By differentiating these factors, the method captures scenarios where traditional Event ID 37 logs or CPU utilization metrics miss critical performance degradations.
The script captures a range of per-device metrics during each run, including temperature and its source, throttle status types, current and maximum CPU frequency with a ratio percentage, and comprehensive throttling evidence logs that correlate performance drops with frequency and utilization data. This data feeds into a customizable ControlUp dashboard that aggregates key performance indicators, categorizes throttle types, tracks frequency trends, and identifies devices exhibiting the hottest or most throttled behavior. The dashboard also correlates these metrics with user experience signals like application crashes and digital employee experience (DEX) scores, enabling targeted troubleshooting from a single pane of glass.
Technical details specify that the solution runs on Microsoft Windows devices using PowerShell scripts triggered every two minutes (120 seconds) with a 60-second timeout and sends data to the `custom_cpu_throttle` index only when devices are online. The solution supports filtering by device, throttle type, and status for focused analysis. While the script covers many AMD-specific throttling scenarios, some complexities remain given AMD's diverse behaviors, though unrealistic values are filtered out to maintain accuracy. This tool is well-suited for IT administrators and helpdesk teams looking to resolve performance tickets where CPU utilization appears normal but throttling impacts response times, such as in Outlook or other user-facing applications.
For detailed setup or a walkthrough, the script (`SP-CPU-Throttle-v2.ps1`) and ControlUp dashboard configuration (`SP-CPU-Throttle-Dashboard.json`) are available on request. This solution is an example of extending ControlUp’s monitoring capabilities via custom scripts and dashboards to deliver deeper insights into CPU performance issues that go beyond default instrumentation.
Read the entire article here...
Read the entire article here...