Endpoint actions

This page lists every action in the Actions menu on an endpoint’s detail page: what it does, the permission it needs, and which operating systems support it. It also covers retiring an endpoint and, on the MSP plan, transferring one or several endpoints to another client.

How the menu behaves

• Every action that affects the person at the computer asks first. Only Refresh inventory and Run script act when you select them. Every other item opens a confirmation that names the computer and says what will happen.
• An action you cannot use is disabled, never hidden. Point at it to see why. The reason is either a missing permission or something the endpoint reported it cannot do, in that order.
• An offline endpoint gets the action queued. The dialog says so after you confirm. A queued action expires after 15 minutes if the endpoint does not reconnect, and a queued patch request after 4 hours. A queued transfer to another client waits up to 30 days.
• Every action is recorded. After an action is accepted, select View in Commands to follow it on the endpoint’s Commands tab.

The menu is not shown on a retired endpoint.

Actions

The menu groups actions under Power, Session, Processes and services, Maintenance, Agent, and Lifecycle.

Action	Group	What it does	Permission
Wake	Power	Sends a Wake-on-LAN packet through another online agent on the same network. Shows as Wake anyway when Wake-on-LAN is not confirmed on the endpoint. See Wake-on-LAN.	endpoint:action
Restart	Power	Restarts the computer after a countdown.	endpoint:action
Shut down	Power	Shuts the computer down after a countdown.	endpoint:action
Lock screen	Session	Locks the signed-in session.	endpoint:action
Sign out user	Session	Signs the current user out. Unsaved work may be lost.	endpoint:action
Send message	Session	Shows a message to whoever is signed in.	endpoint:action
Kill process	Processes and services	Ends one running process by its process ID.	endpoint:action
Service control	Processes and services	Starts, stops, or restarts a service, or sets its start type.	endpoint:action
Scan for patches	Maintenance	Asks the endpoint to scan for missing patches. Nothing is installed.	patch:read
Install approved patches	Maintenance	Installs the patches already approved for the endpoint. It may need to restart.	patch:approve
Run script	Maintenance	Opens the endpoint’s Commands tab.	command:execute
Refresh inventory	Maintenance	Asks the endpoint for a fresh inventory, the same as Collect now in the page header. Unavailable while the endpoint is offline.	endpoint:read
Check for agent update	Agent	Asks the agent whether a newer version is available.	endpoint:action
Update agent now	Agent	Asks the agent to download and install its update. The agent restarts and reconnects.	endpoint:action
Transfer to another client	Lifecycle	Moves the endpoint to another client, or to or from your MSP’s own workspace. An offline endpoint’s transfer is queued until it next connects. Disabled while a transfer is already in progress. MSP plan only. See Transfer an endpoint to another client.	endpoint:write and enroll:manage
Retire endpoint	Lifecycle	Takes the endpoint out of management. See Retire an endpoint.	endpoint:write

Among the built-in roles, the Owner, Support Manager, and Field Technician hold endpoint:action.

What each confirmation asks for

Action	Fields
Restart, Shut down	Warn the person for: 30 seconds, 60 seconds (the default), or 5 minutes. Close applications without waiting for them, which loses unsaved work. Reason, required.
Lock screen	Reason, optional.
Sign out user	Reason, required.
Send message	Title, Message, and Close the message after (seconds). Leave the last one empty to let the person close the message. Reason, optional.
Kill process	Process id, the number from the Processes list on the Live tab. Reason, required.
Service control	What to do: Start, Stop, Restart (the default), or Set start type. Service name, the service’s name rather than its display name. Start it: Automatic, Manual, or Disabled, for Set start type. Reason, required except for Start.

The Reason is shown to the person using the computer and kept in the audit log.

Setting a service to Disabled, or moving a monitored service off automatic, raises the same alert it would raise if anyone else did it. The audit log records who did it and why. See Device activity.

The Services sub-tab of the Software tab opens the same confirmation with the service already chosen.

Support by operating system

Action	Windows	Linux	macOS (Preview)	FreeBSD and OpenBSD
Wake (as the endpoint being woken)	Yes	Yes	Yes	No
Restart, Shut down	Yes	Yes, needs shutdown	Yes	No
Lock screen, Sign out user	Yes	Yes, needs systemd-logind	Yes	No
Send message	Yes	Yes, needs systemd-logind and wall	Yes	No
Kill process	Yes	Yes	Yes	No
Service control	Yes	Yes, needs systemd	Yes. There is no Manual start type on macOS.	No
Scan for patches, Install approved patches	Needs the Windows Update service	Needs apt or dnf	Needs softwareupdate	No
Check for agent update, Update agent now	Yes	Yes	Yes	Yes

When an endpoint lacks what an action needs, the item is disabled and its reason names what is missing. See Supported platforms.

Retire an endpoint

Retire an endpoint when the computer leaves your fleet: it was replaced, wiped, or given away.

Caution

Retiring cannot be undone from the console. The endpoint’s certificate is revoked, so the agent on it can no longer report or be reached. To manage the computer again, install the agent and enroll it again.

1. Open the endpoint, and select Actions > Retire endpoint.
2. Optional: in Reason, say why. The reason is kept in the audit log.
3. Select Retire endpoint.

The endpoint stops being billed and leaves the default In service view. Its record, inventory, and history stay in the console under the Retired view.

Transfer an endpoint to another client

Plans

MSP

Permission

endpoint:write

An MSP can move an endpoint from one client to another without reinstalling the agent. The endpoint enrolls in the target client and is retired in the source client, where its history stays. Your MSP’s own workspace counts as a client here, so you can move an endpoint into it or out of it.

The item appears only when you are working inside a client from your MSP console. The console of a client never shows it, because a client must not learn that other clients exist.

Before you begin

• You need both endpoint:write and enroll:manage.
• Only active clients are offered as targets, including your MSP’s own workspace when it is active. A client that is being set up, suspended, or offboarded is not offered.
• The endpoint can be online or offline. An offline endpoint’s transfer is queued and runs the next time it connects. See Transfer an offline endpoint.
• An endpoint takes one transfer at a time. While one is in progress, Transfer to another client is disabled with the reason A transfer is already in progress.

Steps

1. Open the endpoint, and select Actions > Transfer to another client.
2. In Move to client, choose the target client.
3. Optional: in Site, choose a site in the target client. You can also move the endpoint to a site later.
4. Read the confirmation, which names both clients, and select Transfer. For an offline endpoint it adds This endpoint is offline. It moves to the target client the next time it connects, within 30 days.

For a connected endpoint, the dialog follows the transfer through Waiting for the endpoint to pick up the transfer., Sent to the endpoint. Waiting for it to start., and The endpoint is enrolling in the new client. When it finishes, it shows Transferred. and a link to the endpoint in the target client. The endpoint reconnects to the target client within a minute.

Transfer an offline endpoint

When the endpoint is offline, the dialog shows Queued. and says the endpoint moves to the target client the next time it connects, within 30 days. Nothing changes on either client until then.

While the transfer waits, the endpoint’s page shows a banner that reads Moving to the target client when it next connects. When the endpoint connects, Outpost checks that the target client and site are still available and starts the transfer. The banner then reads Moving to the target client, and the transfer finishes as it does for a connected endpoint.

To stop a queued transfer, select Cancel transfer, either in the dialog before you close it or on the endpoint’s banner. The dialog confirms with Transfer canceled. and says the endpoint stays in the source client. Once the transfer is under way it can no longer be canceled, and a late attempt shows The transfer was not canceled.

A queued transfer also stops on its own, and the banner goes away, when:

• the endpoint does not connect within 30 days
• the target client stops being active, or the chosen site is deleted, before the endpoint connects

The endpoint stays in the source client. To see why a transfer stopped, open the endpoint’s Commands > History tab. The transfer is listed as Transfer to another client in the failed state. Select it, and Outcome gives the reason:

Why it stopped	Outcome
No connection within 30 days	The endpoint did not connect within 30 days, so the transfer was stopped.
The target is gone	The target client or site is no longer available, so the transfer was stopped.

Start a new transfer if the endpoint still needs to move.

Transfer several endpoints at once

You can move up to 500 endpoints into one client and site in one step, from the endpoint list.

1. Inside the client’s workspace, go to Endpoints > All endpoints, and select the endpoints to move. See Select several endpoints.
2. On the selection bar, select Transfer to another client. It is disabled, with the reason, if you lack endpoint:write or enroll:manage.
3. In Move to client, choose the target client. Optional: in Site, choose a site in it.
4. Read the confirmation and the summary under it, such as 12 endpoints: 9 now, 3 when they next connect. Connected endpoints move now. Offline endpoints are queued, as in Transfer an offline endpoint.
5. Select Transfer.

The result counts the endpoints under Started, Queued until they next connect, and Failed, and lists each failed endpoint by name with the reason, such as A retired endpoint cannot be transferred. One endpoint failing does not stop the others. The dialog does not follow each transfer to the end. Open an endpoint to see its progress, or to cancel its queued transfer from the banner.

If the transfer does not finish

Message	Meaning
The transfer expired before the endpoint could start it. Try again.	The endpoint did not pick up the transfer in time.
The endpoint could not enroll in the target client. Nothing changed.	Enrollment in the target client failed. The endpoint stays in the source client.
The endpoint did not finish leaving this client. Nothing changed.	The endpoint did not complete the move. The endpoint stays in the source client.
This endpoint reported no hardware identity, so it cannot be transferred.	The endpoint has no identity Outpost can carry across.
The endpoint is still finishing an earlier transfer.	Wait for the earlier transfer to finish.
The target client or site is no longer available, so the transfer was stopped.	The target client is no longer active, or the chosen site was deleted. The endpoint stays in the source client. Choose another target.
The endpoint did not connect within 30 days, so the transfer was stopped.	A queued transfer expired. The endpoint stays in the source client.

The dialog shows these messages only while it is open and following the transfer. A queued transfer that stops after you close the dialog shows its reason on the Commands tab, as described in Transfer an offline endpoint.

If the dialog cannot read the transfer’s progress, the transfer appears on the endpoint’s Commands tab.

Related

• Endpoint details
• Live metrics and the remote console
• Roles and permissions
• MSP