Documentation › Using Steward IT Census
Asset actions & launcher
Actions are the buttons in the left panel of an asset page. Most of them work in any browser on any operating system with no plugin. Only launcher actions, which open a program on your own PC, need the optional Census Action Launcher.
Built-in actions (no plugin needed)#
| Action | What it does |
|---|---|
| Rescan now | Fresh inventory: through the Census agent if online, otherwise a network scan |
| Ping / check ports | Checks from the server whether the device responds and which ports are open (listed under Custom actions) |
| Remote Desktop | Downloads a ready-made .rdp file for Windows computers; open it with Remote Desktop (Windows), Microsoft Remote Desktop / Windows App (macOS), or Remmina (Linux). Listed under Custom actions |
| Open web interface | Opens the device's web page; more web ports are listed on the Network tab |
| SSH | Opens an ssh:// link in your SSH client (replaced by the SSH terminal launcher action when that is enabled) |
| Take screenshot | Windows: captures the logged-on user's screen, who is logged on, idle time and whether the screen is locked. Useful to check whether a computer is in use before you work on it. |
| Deploy package… / Run script… | See Deployment |
| Services tab | Start / Stop / Restart any Windows service or systemd unit |
| Console tab | Run commands from the browser |
Screenshots#
The latest screenshot appears as a small Screen thumbnail at the top left of a Windows asset's Summary, with who is logged on, idle time and when it was captured. Click it to enlarge; click the enlarged image to open it full size in a new tab. Refresh (or Take screenshot) captures a new one. If nobody is logged on, the last image stays, with a note about the failed attempt.
By default screenshots are only taken when an administrator asks for one, and each is recorded in the asset's history. To keep thumbnails current automatically, turn on Take a screenshot with every inventory in General settings. Make sure your users are informed, as your privacy policy or local law may require.
Screenshots use a one-time scheduled task in the logged-on user's session, hidden, with no window flash. They need the Census agent or WinRM.
Custom actions#
Configuration › Asset actions lists all actions, built-in and your own. Each action has a type:
| Type | Runs | Example |
|---|---|---|
| Link | In your browser | https://{ip}:8443/, vnc://{host}, https://helpdesk.example.com/search?q={name} |
| Remote command | On the asset (agent / WinRM / SSH); output shown in a window | gpupdate /force, sc stop Spooler & sc start Spooler, sudo -n systemctl restart cups |
| Run package / script | A saved package or script, on the asset | your Clear temp folders script |
| Launcher | A program on your PC (needs the launcher) | Computer Management, C$ share, SSH terminal, SFTP |
| Wake-on-LAN | A magic packet from the server, relayed by Census agents on the computer's network (details) |
Placeholders: {ip}, {name}, {fqdn}, {host} (FQDN, or the IP if unknown), {mac}, {serial}, {domain}, {user} (last logged-on user). Values are sanitized before they're inserted into commands.
Set Show for to all assets, Windows only or Linux/macOS only, choose an icon and order, and whether to ask for confirmation.
Running an action as a different user#
Remote commands and package actions normally run through the Census agent (as SYSTEM on Windows, root on Linux and macOS) or log in with the asset's stored WinRM or SSH credentials. Under Run as in the action's settings you can choose another account instead:
- a stored credential (a WinRM credential for Windows actions, an SSH credential for Linux/macOS actions): the action logs in with that account only, for example a domain account that may change group memberships, or a Linux user with its own sudo rights;
- Ask for an account each time: whoever starts the action types a user name and password. Census keeps them in memory only until the action is over; they are never written to the database or a log. The SSH port and WinRM HTTPS settings are taken from the asset's usual credential.
An action that runs as a different user always logs in over WinRM or SSH, never through the Census agent, so the computer must be reachable for that from the Census server (not at a remote site). The asset's History tab records who started the action and as whom.
Wake-on-LAN#
A magic packet is a broadcast, and routers don't pass broadcasts to other networks (VLANs). So Census sends it every way that can reach the computer:
- From the server, on all of the server's own networks. When the computer is on one of them, that's all it takes.
- Through Census agents on the computer's network (Wake-on-LAN relay): when the computer is on another network, up to three online Census agents on that network send the packet for the server, and the message tells you which ones did. Agents report the networks they're on (shown under the remote IP on Scanning › Census agents); this needs agent 0.38.0 or later.
- At a remote site, the site's scanner sends it on the site's network (plus agents at that site).
If no agent on the computer's network is online, the packet only arrives if the server is on that network or your router forwards directed broadcasts. One always-on computer with the Census agent per network (VLAN) is enough to wake all the others.
The computer must have Wake-on-LAN turned on in its firmware (BIOS/UEFI) and network adapter settings, and must have a wired connection: Wi-Fi adapters rarely wake from sleep or shutdown.
Included remote commands#
- Windows: Restart computer, Update Group Policy, Flush DNS cache, Start Windows Update scan, Recent system errors (System and Application logs, last 3 days), Logged-on users, Top processes, Network configuration, Pending reboot?
- Linux: Reboot, Recent errors (journal), Logged-on users, Top processes, Network configuration, Install updates.
Install updates (Linux)#
Install updates runs the built-in package Install Linux updates on the asset. It picks the package manager from the distribution (/etc/os-release), and falls back to whichever one is installed:
| Distribution | Command |
|---|---|
| Debian, Ubuntu, Linux Mint, Raspberry Pi OS… | apt-get update + apt-get upgrade --with-new-pkgs (non-interactive, keeps your changed config files, waits up to 5 minutes for another apt to finish) |
| Fedora, RHEL, Rocky, AlmaLinux, Oracle, Amazon Linux | dnf upgrade --refresh (yum update where there is no dnf) |
| openSUSE, SLES | zypper refresh + zypper update |
| Arch, Manjaro, EndeavourOS, CachyOS… | pacman -Syu |
| Alpine | apk update + apk upgrade |
It needs root: the Census agent runs it as root; over SSH the account needs passwordless sudo. The output says whether a restart is needed, and an installed Census agent sends a fresh inventory afterwards so the Vulnerabilities tab updates. It can take a while (up to 2 hours before it's stopped). To update many computers at once, deploy the Install Linux updates package to a group: Deployment › Packages & scripts › Deploy.
Results open in a window that stays until you close it. Disk space is on the asset's Hardware tab.
Edit, disable or delete any of them.
Census Action Launcher (optional)#
Browsers aren't allowed to start programs on your computer, so actions that open local tools need a small helper, the Census Action Launcher. Install it once on your own admin PC, not on the managed computers. Download it from Scanning › Census agents (section Census Action Launcher, which also has the install commands).
- Windows: double-click
census-launcher-windows-amd64.exe. No admin rights needed. - Linux:
chmod +x census-launcher-linux-amd64 && ./census-launcher-linux-amd64 install. It registers with your desktop (GNOME, KDE, Xfce…) for the current user. - On several admin PCs at once: choose Install Census Action Launcher under New deployment (also linked from the Census agents page). It installs the launcher for every user of each computer: on Windows into Program Files with an entry in Programs and Features, on Linux into
/usr/local/binwith a system-wide desktop handler (root or passwordlesssudo). By hand, the same iscensus-launcher install -machineas administrator/root. A user's own install (above) still wins for that user.
The first time you use a launcher action, your browser asks whether to open the Census Action Launcher; allow it.
SSH terminal and SFTP file transfer (Linux assets) log in as the user of the SSH credential that last worked on that asset, when there is one.
- SSH terminal: Windows: the built-in OpenSSH client (
ssh) in a console window. Linux: your terminal. - SFTP file transfer: Windows: WinSCP or FileZilla, whichever is installed (Windows has no SFTP browser of its own;
winget install WinSCP.WinSCP). Linux: your file manager (Files, Dolphin, Nemo, Thunar…) atsftp://host/, or FileZilla.
Launchers installed before version 0.15 don't know SFTP yet: download the new census-launcher and run it once.
| Launcher action | Windows | Linux |
|---|---|---|
| Remote Desktop (via launcher) | mstsc | Remmina, FreeRDP or KRDC |
| Open C$ in Explorer | Explorer \\host\c$ |
Your file manager (Files/Nautilus, Nemo, Caja, Dolphin, Thunar, PCManFM) at smb://host/c$. It asks for a Windows user name and password; GNOME needs the gvfs-backends package. |
| PowerShell remote session | PowerShell Enter-PSSession |
pwsh (PowerShell 7) if installed |
| Remote command prompt (WinRS) | WinRS | not available, use the Console tab |
| Computer Management / Services / Event Viewer | MMC consoles (Windows may ask for administrator approval first). | Hidden in Linux and Mac browsers. Services (remote) opens the asset's Services tab instead; use Recent system errors instead of Event Viewer. |
| Continuous ping, SSH | Console window | Terminal |
Windows firewall rules the remote tools need#
The launcher opens Windows' own tools, signed in as you (your Windows account must be an administrator on the target, e.g. a domain admin). If a tool opens but says it can't connect to the computer, the target computer's firewall blocks it. Enable these rule groups on the managed computers, best with Group Policy (Computer Configuration › Policies › Windows Settings › Security Settings › Windows Defender Firewall with Advanced Security › Inbound Rules › New Rule › Predefined):
| Tool | Rule group on the target |
|---|---|
| Event Viewer (also inside Computer Management) | Remote Event Log Management |
| Disk Management (inside Computer Management) | Remote Volume Management – on the target and on your PC |
| Services, Shared Folders, Local Users and Groups, Open C$ in Explorer | File and Printer Sharing |
| WinRS, PowerShell remote session | Windows Remote Management (WinRM, also used by Census scans) |
| Continuous ping | File and Printer Sharing (Echo Request – ICMPv4-In) |
Device Manager can't connect to other computers since Windows 8: that's a Windows limitation, not a firewall rule.
Security: any web page could try to open a census-action: link, so the launcher only runs this fixed list of tools and only accepts a valid host name or IP address. It never runs arbitrary commands.
To remove it: census-launcher uninstall (a for-every-user install: Programs and Features on Windows, or census-launcher uninstall -machine as administrator/root).