---
title: "Endpoint actions"
description: "Every action in an endpoint's Actions menu, the permission it needs, which operating systems support it, and how to retire or transfer an endpoint."
url: "https://support.outpostplatform.com/endpoints/endpoint-actions/"
product: "depot"
type: "reference"
status: "draft"
ai_summary: "The Actions menu on an endpoint: Wake, Restart, Shut down, Lock screen, Sign out user, Send message, Kill process, Service control, patches, Run script, Refresh inventory, agent update, Transfer to another client (MSP), Retire endpoint. Permissions, per-OS support, offline queuing, retiring, and transfers: to or from the MSP's own workspace, queued 30 days when offline, bulk up to 500."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "endpoint:action"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/endpoints/endpoint-actions.mdx"
license: "CC BY 4.0"
---

# Endpoint actions

This page lists every action in the **Actions** menu on an endpoint's detail
page: what it does, the permission it needs, and which operating systems
support it. It also covers retiring an endpoint and, on the MSP plan,
transferring one or several endpoints to another client.

## How the menu behaves

- **Every action that affects the person at the computer asks first.** Only
  **Refresh inventory** and **Run script** act when you select them. Every
  other item opens a confirmation that names the computer and says what will
  happen.
- **An action you cannot use is disabled, never hidden.** Point at it to see
  why. The reason is either a missing permission or something the endpoint
  reported it cannot do, in that order.
- **An offline endpoint gets the action queued.** The dialog says so after you
  confirm. A
  queued action expires after 15 minutes if the endpoint does not reconnect,
  and a queued patch request after 4 hours. A queued transfer to another
  client waits up to 30 days.
- **Every action is recorded.** After an action is accepted, select **View in
  Commands** to follow it on the endpoint's **Commands** tab.

The menu is not shown on a retired endpoint.

## Actions

The menu groups actions under **Power**, **Session**, **Processes and
services**, **Maintenance**, **Agent**, and **Lifecycle**.

| Action | Group | What it does | Permission |
| --- | --- | --- | --- |
| **Wake** | Power | Sends a Wake-on-LAN packet through another online agent on the same network. Shows as **Wake anyway** when Wake-on-LAN is not confirmed on the endpoint. See [Wake-on-LAN](/endpoints/wake-on-lan/). | `endpoint:action` |
| **Restart** | Power | Restarts the computer after a countdown. | `endpoint:action` |
| **Shut down** | Power | Shuts the computer down after a countdown. | `endpoint:action` |
| **Lock screen** | Session | Locks the signed-in session. | `endpoint:action` |
| **Sign out user** | Session | Signs the current user out. Unsaved work may be lost. | `endpoint:action` |
| **Send message** | Session | Shows a message to whoever is signed in. | `endpoint:action` |
| **Kill process** | Processes and services | Ends one running process by its process ID. | `endpoint:action` |
| **Service control** | Processes and services | Starts, stops, or restarts a service, or sets its start type. | `endpoint:action` |
| **Scan for patches** | Maintenance | Asks the endpoint to scan for missing patches. Nothing is installed. | `patch:read` |
| **Install approved patches** | Maintenance | Installs the patches already approved for the endpoint. It may need to restart. | `patch:approve` |
| **Run script** | Maintenance | Opens the endpoint's **Commands** tab. | `command:execute` |
| **Refresh inventory** | Maintenance | Asks the endpoint for a fresh inventory, the same as **Collect now** in the page header. Unavailable while the endpoint is offline. | `endpoint:read` |
| **Check for agent update** | Agent | Asks the agent whether a newer version is available. | `endpoint:action` |
| **Update agent now** | Agent | Asks the agent to download and install its update. The agent restarts and reconnects. | `endpoint:action` |
| **Transfer to another client** | Lifecycle | Moves the endpoint to another client, or to or from your MSP's own workspace. An offline endpoint's transfer is queued until it next connects. Disabled while a transfer is already in progress. MSP plan only. See [Transfer an endpoint to another client](#transfer-an-endpoint-to-another-client). | `endpoint:write` and `enroll:manage` |
| **Retire endpoint** | Lifecycle | Takes the endpoint out of management. See [Retire an endpoint](#retire-an-endpoint). | `endpoint:write` |

Among the built-in roles, the Owner, Support Manager, and Field Technician hold
`endpoint:action`.

## What each confirmation asks for

| Action | Fields |
| --- | --- |
| **Restart**, **Shut down** | **Warn the person for**: **30 seconds**, **60 seconds** (the default), or **5 minutes**. **Close applications without waiting for them**, which loses unsaved work. **Reason**, required. |
| **Lock screen** | **Reason**, optional. |
| **Sign out user** | **Reason**, required. |
| **Send message** | **Title**, **Message**, and **Close the message after (seconds)**. Leave the last one empty to let the person close the message. **Reason**, optional. |
| **Kill process** | **Process id**, the number from the **Processes** list on the **Live** tab. **Reason**, required. |
| **Service control** | **What to do**: **Start**, **Stop**, **Restart** (the default), or **Set start type**. **Service name**, the service's name rather than its display name. **Start it**: **Automatic**, **Manual**, or **Disabled**, for **Set start type**. **Reason**, required except for **Start**. |

The **Reason** is shown to the person using the computer and kept in the audit
log.

Setting a service to **Disabled**, or moving a monitored service off automatic,
raises the same alert it would raise if anyone else did it. The audit log
records who did it and why. See [Device activity](/endpoints/device-activity/).

The **Services** sub-tab of the **Software** tab opens the same confirmation
with the service already chosen.

## Support by operating system

| Action | Windows | Linux | macOS (Preview) | FreeBSD and OpenBSD |
| --- | --- | --- | --- | --- |
| **Wake** (as the endpoint being woken) | Yes | Yes | Yes | No |
| **Restart**, **Shut down** | Yes | Yes, needs `shutdown` | Yes | No |
| **Lock screen**, **Sign out user** | Yes | Yes, needs systemd-logind | Yes | No |
| **Send message** | Yes | Yes, needs systemd-logind and `wall` | Yes | No |
| **Kill process** | Yes | Yes | Yes | No |
| **Service control** | Yes | Yes, needs systemd | Yes. There is no **Manual** start type on macOS. | No |
| **Scan for patches**, **Install approved patches** | Needs the Windows Update service | Needs apt or dnf | Needs `softwareupdate` | No |
| **Check for agent update**, **Update agent now** | Yes | Yes | Yes | Yes |

When an endpoint lacks what an action needs, the item is disabled and its
reason names what is missing. See
[Supported platforms](/get-started/platform-support/).

## Retire an endpoint

Retire an endpoint when the computer leaves your fleet: it was replaced,
wiped, or given away.

:::caution
Retiring cannot be undone from the console. The endpoint's certificate is
revoked, so the agent on it can no longer report or be reached. To manage the
computer again, install the agent and enroll it again.
:::

1. Open the endpoint, and select **Actions** > **Retire endpoint**.
2. Optional: in **Reason**, say why. The reason is kept in the audit log.
3. Select **Retire endpoint**.

The endpoint stops being billed and leaves the default **In service** view.
Its record, inventory, and history stay in the console under the **Retired**
view.

## Transfer an endpoint to another client

An MSP can move an endpoint from one client to another without reinstalling
the agent. The endpoint enrolls in the target client and is retired in the
source client, where its history stays. Your MSP's own workspace counts as a
client here, so you can move an endpoint into it or out of it.

The item appears only when you are working inside a client from your MSP
console. The console of a client never shows it, because a client must not
learn that other clients exist.

### Before you begin

- You need both `endpoint:write` and `enroll:manage`.
- Only active clients are offered as targets, including your MSP's own
  workspace when it is active. A client that is being set up, suspended, or
  offboarded is not offered.
- The endpoint can be online or offline. An offline endpoint's transfer is
  queued and runs the next time it connects. See
  [Transfer an offline endpoint](#transfer-an-offline-endpoint).
- An endpoint takes one transfer at a time. While one is in progress,
  **Transfer to another client** is disabled with the reason **A transfer is
  already in progress.**

### Steps

1. Open the endpoint, and select **Actions** > **Transfer to another client**.
2. In **Move to client**, choose the target client.
3. Optional: in **Site**, choose a site in the target client. You can also
   move the endpoint to a site later.
4. Read the confirmation, which names both clients, and select **Transfer**.
   For an offline endpoint it adds **This endpoint is offline. It moves to**
   the target client **the next time it connects, within 30 days.**

For a connected endpoint, the dialog follows the transfer through **Waiting
for the endpoint to pick up the transfer.**, **Sent to the endpoint. Waiting
for it to start.**, and **The endpoint is enrolling in the new client.** When
it finishes, it shows **Transferred.** and a link to the endpoint in the
target client. The endpoint reconnects to the target client within a minute.

### Transfer an offline endpoint

When the endpoint is offline, the dialog shows **Queued.** and says the
endpoint moves to the target client the next time it connects, within 30
days. Nothing changes on either client until then.

While the transfer waits, the endpoint's page shows a banner that reads
**Moving to** the target client **when it next connects.** When the endpoint
connects, Outpost checks that the target client and site are still available
and starts the transfer. The banner then reads **Moving to** the target
client, and the transfer finishes as it does for a connected endpoint.

To stop a queued transfer, select **Cancel transfer**, either in the dialog
before you close it or on the endpoint's banner. The dialog confirms with
**Transfer canceled.** and says the endpoint stays in the source client. Once
the transfer is under way it can no longer be canceled, and a late attempt
shows **The transfer was not canceled**.

A queued transfer also stops on its own, and the banner goes away, when:

- the endpoint does not connect within 30 days
- the target client stops being active, or the chosen site is deleted, before
  the endpoint connects

The endpoint stays in the source client. To see why a transfer stopped, open
the endpoint's **Commands** > **History** tab. The transfer is listed as
**Transfer to another client** in the `failed` state. Select it, and
**Outcome** gives the reason:

| Why it stopped | **Outcome** |
| --- | --- |
| No connection within 30 days | The endpoint did not connect within 30 days, so the transfer was stopped. |
| The target is gone | The target client or site is no longer available, so the transfer was stopped. |

Start a new transfer if the endpoint still needs to move.

### Transfer several endpoints at once

You can move up to 500 endpoints into one client and site in one step, from
the endpoint list.

1. Inside the client's workspace, go to **Endpoints** > **All endpoints**, and
   select the endpoints to move. See
   [Select several endpoints](/endpoints/endpoint-list/#select-several-endpoints).
2. On the selection bar, select **Transfer to another client**. It is
   disabled, with the reason, if you lack `endpoint:write` or
   `enroll:manage`.
3. In **Move to client**, choose the target client. Optional: in **Site**,
   choose a site in it.
4. Read the confirmation and the summary under it, such as **12 endpoints: 9
   now, 3 when they next connect.** Connected endpoints move now. Offline
   endpoints are queued, as in
   [Transfer an offline endpoint](#transfer-an-offline-endpoint).
5. Select **Transfer**.

The result counts the endpoints under **Started**, **Queued until they next
connect**, and **Failed**, and lists each failed endpoint by name with the
reason, such as **A retired endpoint cannot be transferred.** One endpoint
failing does not stop the others. The dialog does not follow each transfer to
the end. Open an endpoint to see its progress, or to cancel its queued
transfer from the banner.

### If the transfer does not finish

| Message | Meaning |
| --- | --- |
| **The transfer expired before the endpoint could start it. Try again.** | The endpoint did not pick up the transfer in time. |
| **The endpoint could not enroll in the target client. Nothing changed.** | Enrollment in the target client failed. The endpoint stays in the source client. |
| **The endpoint did not finish leaving this client. Nothing changed.** | The endpoint did not complete the move. The endpoint stays in the source client. |
| **This endpoint reported no hardware identity, so it cannot be transferred.** | The endpoint has no identity Outpost can carry across. |
| **The endpoint is still finishing an earlier transfer.** | Wait for the earlier transfer to finish. |
| **The target client or site is no longer available, so the transfer was stopped.** | The target client is no longer active, or the chosen site was deleted. The endpoint stays in the source client. Choose another target. |
| **The endpoint did not connect within 30 days, so the transfer was stopped.** | A queued transfer expired. The endpoint stays in the source client. |

The dialog shows these messages only while it is open and following the
transfer. A queued transfer that stops after you close the dialog shows its
reason on the **Commands** tab, as described in
[Transfer an offline endpoint](#transfer-an-offline-endpoint).

If the dialog cannot read the transfer's progress, the transfer appears on the
endpoint's **Commands** tab.

## Related

- [Endpoint details](/endpoints/endpoint-details/)
- [Live metrics and the remote console](/endpoints/live-and-console/)
- [Roles and permissions](/depot/roles-and-permissions/)
- [MSP](/msp/)