---
title: "Built-in script library"
description: "The scripts that ship with Outpost, what each one does, the platform it runs on, its parameters, and the custom field each collector fills."
url: "https://support.outpostplatform.com/automation/script-library/"
product: "depot"
type: "reference"
status: "draft"
ai_summary: "The 31 built-in scripts in Depot 0.4.1: 24 Windows PowerShell scripts and 7 Linux sh scripts for maintenance, network repair, inventory reports, security checks, and collectors that fill endpoint custom fields such as bios_serial and pending_reboot. Built-in scripts arrive approved, are read-only, and are offered to every client."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows", "linux"]
  permission: "script:read"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/automation/script-library.md"
license: "CC BY 4.0"
---

# Built-in script library

This page lists the scripts that ship with Outpost in Depot 0.4.1. They appear
in **Scripts** > **Library** with the **Built-in** chip.

## Scope

- 31 scripts: 24 for Windows, written in PowerShell, and 7 for Linux, written
  in sh. There are no built-in scripts for macOS, FreeBSD, or OpenBSD.
- Built-in scripts arrive approved and signed, so they can run on many
  endpoints and on schedules straight away.
- They are read-only and offered to every client. To change one, select
  **Duplicate** and edit the copy, which is a new draft you approve yourself.
  See [Write and approve a script](/automation/write-and-approve-scripts/).
- Outpost updates them with new releases. A built-in script whose text was
  changed outside the product is not overwritten.
- Revoking a built-in script's approval lasts only until Depot next starts,
  which approves it again. To keep endpoints from running one, use the
  [script execution settings](/automation/policy-settings/#script-execution)
  on a profile.

**Runs as** is each script's default. You can change it for a run.

## Maintenance

| Script | Runs on | Runs as | Parameters | What it does |
| --- | --- | --- | --- | --- |
| Clean up the component store | Windows (PowerShell) | SYSTEM | None | Runs the DISM component store cleanup, which removes superseded copies of Windows components and usually returns several gigabytes on an endpoint that has been patched for years. Installed updates stay uninstallable, because the base is deliberately not reset. This one is slow. |
| Clear browser cache | Windows (PowerShell) | Signed-in user | `browser` (Choice: `all`, `edge`, `chrome`, `firefox`, default `all`) | Clears the cached page data for Microsoft Edge, Google Chrome, Mozilla Firefox, or all three, for the signed in user. A browser that is running is reported and left alone rather than having files pulled out from under it. Bookmarks, passwords, and saved sessions are not touched. |
| Clear temporary files | Windows (PowerShell) | SYSTEM | `minimum_age_days` (Number, default `1`) | Deletes files older than the given number of days from the user TEMP folder and from the Windows Temp folder. Folders are left in place and files still in use are skipped rather than forced, so this is safe to run on a working endpoint. |
| Flush DNS resolver cache | Windows (PowerShell) | SYSTEM | None | Clears the Windows DNS client cache so the endpoint resolves names again from its configured servers. Useful right after a DNS record change. Nothing else on the endpoint is touched. |
| Force a Group Policy refresh | Windows (PowerShell) | SYSTEM | None | Runs gpupdate /force so computer and user policy are reapplied immediately instead of on the next refresh interval. Reports the exit code gpupdate returned. Policy that needs a logon or a restart is named in the output. |
| Reset Windows Update components | Windows (PowerShell) | SYSTEM | None | The standard repair for an endpoint that will not download updates: stop the update services, set the SoftwareDistribution and catroot2 folders aside, then start the services again. The old folders are renamed rather than deleted, so nothing is lost if the fault was somewhere else. |
| Restart the print spooler | Windows (PowerShell) | SYSTEM | `service_name` (Text, default `Spooler`) | Restarts the print spooler service and brings its dependent services back up. Queued print jobs survive the restart because the spool folder is left alone. The service name is a parameter so the same script covers an endpoint where printing runs under a different service. |
| Restart a systemd service | Linux (sh) | SYSTEM | `service_name` (Text, required) | Restarts the systemd unit you name and reports whether it came back up, including the last few log lines when it did not. The unit name is required, because a script that restarts something chosen by default is a script that restarts the wrong thing. |

## Network

| Script | Runs on | Runs as | Parameters | What it does |
| --- | --- | --- | --- | --- |
| Connectivity report | Windows (PowerShell) | SYSTEM | `target_host` (Text, default `1.1.1.1`); `ping_count` (Number, default `4`) | Gathers what is worth knowing when an endpoint says the network is broken: its addresses, its gateway and DNS servers, whether the gateway answers, and whether the host you name answers and resolves. Read only, and it changes nothing. |
| Release and renew the DHCP lease | Windows (PowerShell) | SYSTEM | None | Drops the DHCP lease on every adapter that has one and asks for a new one, then flushes and reregisters DNS. Network connectivity stops for a few seconds while this runs, so the result of this run may only arrive once the endpoint reconnects to Outpost. |
| Reset the Winsock catalog | Windows (PowerShell) | SYSTEM | None | Resets the Winsock catalog to its defaults, which clears out layered service providers left behind by removed VPN and security software. This does not take effect until the endpoint restarts, and the script says so rather than pretending the fault is fixed. |

## Inventory reports

| Script | Runs on | Runs as | Parameters | What it does |
| --- | --- | --- | --- | --- |
| Installed software report | Windows (PowerShell) | SYSTEM | None | Lists the installed applications with their versions and publishers, read from the uninstall registry keys for both 32 bit and 64 bit software plus the current user's own. The registry is used rather than the Win32_Product class, because querying that class makes Windows revalidate every MSI and can trigger repairs. |
| Pending Windows updates report | Windows (PowerShell) | SYSTEM | None | Asks the Windows Update agent which updates apply to this endpoint and are not installed yet, and lists them with their severity. Read only: nothing is downloaded and nothing is installed. On an endpoint pointed at WSUS the answer comes from that server. |
| Service status report | Windows (PowerShell) | SYSTEM | `service_name` (Text) | With a service name, reports that service's state, start type, and account. With the name left empty, reports every service set to start automatically that is not running, which is the usual way an endpoint quietly loses a function after a restart. |
| Check for available package updates | Linux (sh) | SYSTEM | None | Detects the package manager in use and reports how many updates are waiting, listing the security ones separately where the distribution marks them. Nothing is installed and no configuration is changed; on apt endpoints only the package lists are refreshed. |
| Disk usage report | Linux (sh) | SYSTEM | None | Reports space and inode use for every local filesystem, and names the ones over 90 percent so a full disk is visible without reading the whole table. Read only. Network and pseudo filesystems are left out. |
| Failed systemd units report | Linux (sh) | SYSTEM | None | Lists the systemd units that are in a failed state, with the last log lines for each, which is the first thing worth reading on a Linux endpoint that is behaving strangely. Read only: nothing is restarted or reset. |
| Uptime and load report | Linux (sh) | SYSTEM | None | Reports how long the endpoint has been up, its load averages against the CPU count, and its memory and swap use. Read only, and it is the fastest way to tell a busy endpoint from a stuck one. |

## Security

| Script | Runs on | Runs as | Parameters | What it does |
| --- | --- | --- | --- | --- |
| BitLocker status report | Windows (PowerShell) | SYSTEM | None | Reports the protection state, encryption method, and percentage encrypted for every volume, plus which volumes have a recovery password protector. Read only: no volume is encrypted, decrypted, or unlocked, and no recovery key is printed. |
| Enable the firewall on all profiles | Windows (PowerShell) | SYSTEM | None | Turns the Windows firewall on for the domain, private, and public profiles, and reports which of them had been switched off. Existing rules are left exactly as they are, so nothing that was reachable before becomes unreachable except what was already meant to be blocked. |
| Run a Microsoft Defender quick scan | Windows (PowerShell) | SYSTEM | None | Updates the Defender signatures and runs a quick scan, then reports what the scan found. If Defender is not the active antivirus on the endpoint, the script says so and stops rather than scanning with a disabled engine. |

## Collectors {#collectors}

Each collector writes its result into the custom field with the key shown. Create a field with that key and kind before you run it. See [Endpoint custom fields](/automation/custom-fields/).

| Script | Runs on | Field key | Field kind | What it does |
| --- | --- | --- | --- | --- |
| Collect BIOS serial number | Windows (PowerShell) | `bios_serial` | Text | Reads the serial number the manufacturer wrote into the BIOS and stores it on the endpoint's BIOS serial field. This is the number on the asset sticker for most business hardware, so it is what a warranty lookup wants. |
| Collect Secure Boot state | Windows (PowerShell) | `secure_boot_enabled` | Yes or no | Stores whether Secure Boot is switched on. An endpoint that reports false is either running legacy BIOS or has it turned off in firmware, and either answer matters before a Windows 11 upgrade. |
| Collect Windows version | Windows (PowerShell) | `os_version` | Text | Stores the edition, feature update, and build of Windows on this endpoint as one line, for example Windows 11 Pro 24H2 (10.0.26100.1). The feature update comes from the registry, because the OS caption alone does not distinguish one release from the next. |
| Collect free space on C: as a percentage | Windows (PowerShell) | `disk_c_free_pct` | Number | Stores the percentage of the system drive that is still free, as a number, so the fleet list can be sorted and filtered by it. The value is formatted without a locale decimal comma so it parses the same on every endpoint. |
| Collect installed antivirus products | Windows (PowerShell) | `antivirus_products` | Text | Stores the antivirus products Windows Security Center knows about, with whether each one is enabled and up to date. Server editions have no Security Center, so there the answer comes from Microsoft Defender directly. |
| Collect last boot time | Windows (PowerShell) | `last_boot_time` | Text | Stores when the endpoint last started, as UTC in ISO 8601 form so it sorts correctly as text. An endpoint that has not restarted in months usually has updates waiting on one. |
| Collect local administrators | Windows (PowerShell) | `local_administrators` | Text | Stores the members of the local Administrators group as one comma separated list. The group is found by its well known SID rather than by name, so this is correct on endpoints running a localized Windows. |
| Collect pending reboot state | Windows (PowerShell) | `pending_reboot` | Yes or no | Stores whether the endpoint is waiting on a restart, checking the four places Windows records one: Component Based Servicing, Windows Update, pending file renames, and a computer rename that has not taken effect. Filtering the fleet on this is how a patch window gets a target list. |
| Collect free space on / as a percentage | Linux (sh) | `disk_root_free_pct` | Number | Stores the percentage of the root filesystem that is still free, as a number, so Linux endpoints can be sorted and filtered next to Windows ones. The value is produced under the C locale so the decimal separator is always a point. |
| Collect the operating system release | Linux (sh) | `os_release` | Text | Stores the distribution and version of a Linux endpoint as one line, read from /etc/os-release with a fall back to uname on systems that do not have one. |

## Related

- [Scripting](/automation/scripting/)
- [Run scripts on endpoints](/automation/run-scripts/)
- [Endpoint custom fields](/automation/custom-fields/)