Manage a device day to day

Before you start

• This is an IT task. It assumes you look after your company’s computers and may lock, restart or retire one. If that is not you, do this together with the person who does.
• At least one device is enrolled and approved. See Enroll a device.
• You can manage devices in Zonitix. With view-only rights you can look, but the “Manage” button and the bulk actions are hidden.
• Uninstalling the agent and deleting a device record need an extra right for destructive device actions. Zonitix also asks you to confirm it is you, and to type a reason.

Find the device

1. 1

   Step 1: Start from the overview

   Go to DevicesOverview. The “Needs attention” panel lists what is wrong across all your machines, worst first, for example “Disk encryption off” or “Not seen in 7+ days”. Click a line to open Inventory already filtered to those machines. The same page has “Security posture”, “Last check-in” and “Platforms” panels.

2. 2

   Step 2: Filter the inventory

   Go to DevicesInventory. Type a host name, user, serial number, asset tag or IP address in the search box, or narrow the list with the drop-downs: “Platform”, “Lifecycle”, “Check-in”, “Compliance”, “Updates”, “Security” and “Assignment”. “Sort” orders the list by last check-in, host name or free disk space. “RESET” clears every filter.

   Retired machines are hidden until you switch on “Show retired”. The “Export CSV” icon downloads the list as a spreadsheet file, with the filters you have applied.

3. 3

   Step 3: Open the device

   Click the “View details” icon on a row. The device opens with a list of tabs down the side. “Overview” comes first, then “Compliance”, which shows each check and whether the device passes it. “Security” and the tabs after it show what the machine reports about itself. The last five are yours to work with:

   “Assignment & asset” holds the owner, asset tag, department and location. “Groups & scope” lists the groups the device is in. “Profiles & policy” shows which profiles apply and the settings that result. “Commands” is the queue and history of commands. “Activity” is the audit trail for this one device.

Send a command

1. 4

   Step 4: Open Manage

   In Inventory, click “Manage” on the device’s row. A panel opens with groups of buttons. The “Agent” group has the commands the Zonitix Agent can run: “Lock screen”, “Restart”, “Install OS updates”, “Rename computer” and “Uninstall agent”.

2. 5

   Step 5: Pick the command and confirm

   Click the command and confirm. “Rename computer” asks for the “New computer name”: letters, digits and hyphens, up to 63 characters, or 15 on Windows, where the new name takes effect after a restart. “Uninstall agent” asks “Why?” and needs a reason of at least 3 characters.

   To send the same command to several machines, tick them in Inventory and use the buttons in the bar that appears. The bar also has “Assign owner…”, “Add to group…” and “Retire…”.

3. 6

   Step 6: Wait for the next check-in

   A command is not instant. The machine picks it up the next time it checks in, which is every 15 minutes by default, so an offline laptop runs it when it is next online. Until then the command is listed as “queued” on the device’s “Commands” tab, where “Cancel” withdraws it before it is delivered. A waiting lock or uninstall also shows on the Inventory row as “Lock queued” or “Uninstall queued”; click the x on that label to cancel it.

   A command that has still not been delivered after 7 days expires. Queue it again if you still want it.

Retire, return or delete

1. 7

   Step 7: Retire a machine that has left service

   In “Manage”, under “Device”, click “Retire”, type why (for example lost, end of life or returned) and confirm. The machine leaves the normal list and the counts, and Zonitix refuses its check-ins from then on. Nothing on the machine is erased, and anything still queued for it is cancelled.

   Retiring does not remove the agent. To take the software off as well, send “Uninstall agent” first and wait for it to run, then retire.

2. 8

   Step 8: Bring it back, or delete the record

   Switch on “Show retired”, open “Manage” on the machine and click “Return to service”. It can report again from its next check-in.

   “Delete permanently” appears only on a retired device. It removes the record for good; its history stays only in the audit log. You type a reason and the word DELETE to confirm. Prefer “Retire” unless the record is a duplicate or was created by mistake.

Roll the agent back on one machine

1. 9

   Step 9: Freeze it at an older version

   If a new agent version misbehaves on one machine, open “Manage” and click “Roll back version”. Under “Roll back to”, pick an older version, then click “Freeze & get reinstall command”. Zonitix stops updating the agent on that machine, so it will not move forward again by itself.

2. 10

   Step 10: Run the reinstall command on the machine

   The dialog shows a command with a copy button. Run it on the machine itself, in an administrator PowerShell on Windows. That installs the older version. When you want the machine to update again, open “Manage” and click “Resume updates”.

Choose which alerts you get by email

1. 11

   Step 11: Open the alert settings

   Go to DevicesSettings, pick any platform and open “Alerts & trends”. The “Device alerts” card applies to every platform. Switch each alert on or off: “New pending enrollment”, “Device went silent” (with the number of days), “Became non-compliant”, “Disk encryption off”, “MDM push certificate” and “Enrollment token expiring”. Click “Save alerts”.

   Alerts go by email to everyone who can manage devices; you cannot pick other recipients. “Recent alerts” on the same card lists what fired and what cleared, whether or not email is set up. The chart below it shows how the fleet has changed day by day.

What you should see

If something goes wrong

A command stays queued

The machine has not checked in. Check the "Last seen" column: if it is offline, the command waits for it. If the machine has been silent for days, the agent may have stopped or been removed. A command not delivered within 7 days expires and must be queued again.

The other command buttons are greyed out

An uninstall is queued for that device, and nothing else can be queued until it runs or you cancel it. Buttons are also disabled on a retired device.

You do not see "Uninstall agent" or "Delete permanently" working for you

Both need the separate right for destructive device actions, a fresh confirmation that it is you, and a written reason. Ask an administrator for that right. "Delete permanently" also only appears once the device is retired.

A retired machine shows up again

The agent is still installed and still trying to check in; Zonitix refuses it. Either return the device to service, or remove the agent from the machine (see Enroll a device, “If something goes wrong”).

"No older hosted build available" in the roll back dialog

Your instance holds no agent version older than the one on that machine, so there is nothing to roll back to. Use "Freeze updates" in Manage to hold the machine at its current version instead.

A locked Mac asks for a PIN

That is the Apple MDM lock, not the agent’s "Lock screen". Open Manage and click "Show unlock PIN", then type the PIN on the Mac.

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

• Enroll a device
• Group devices
• Push a compliance profile
• Get the recovery key for a locked disk
• Offboard someone
• See what software is installed