Documentation › Using Steward IT Census
Assets
Every device Steward IT Census knows about is an asset: computers, servers, virtual machines, printers, switches, phones, cameras and so on.
The asset list#
Assets shows all active assets. In the left panel you can:
- filter by asset type, asset group or AD OU, or show archived assets
- create groups, export to CSV, and run bulk actions on selected rows (tick the checkboxes): Rescan, Archive, Delete, Deploy…, Run script…, Add to / remove from a group
Columns#
▥ Columns above the list chooses what the list shows, grouped as Identity, Hardware, Operating system, Network, Relationships, Asset management, Discovery & activity, Security and your custom fields. Examples: All MAC addresses and All IP addresses (every network card), Network link speed (the negotiated speed of each connected card, e.g. "1 Gbit/s, 2.5 Gbit/s"), Switch port (where the device is plugged in, from switch MAC tables, with the port's speed), Connected devices and Connected to (monitors, docks, printers and the computer they're attached to), Virtualization host and Hosted virtual machines, Asset groups (static and dynamic), Last restart, Open ports, Census agent version and last contact, Open vulnerabilities and Compliance score (for logins with those permissions). Order them on the right of the same window; Restore defaults goes back to the standard set.
Drag the right edge of a column heading to change its width. The Name column stays in view when you scroll sideways. Columns and widths are saved for your login, so every technician can keep their own view. Export CSV (above the list, or in the left panel) downloads the list with your columns. Columns the server can sort by have a clickable heading.
Link speed comes with the next inventory after updating to 0.53.0 (Census agents and WinRM/SSH scans; cameras report it over ONVIF).
The search box matches name, IP, MAC, serial, model, manufacturer, OS, last user, domain, tags, location, owner, assigned user, OU and custom fields. More filters adds OS, manufacturer, has software, used by user and OU. The search box in the top bar searches assets from any page.
The asset page#
Under the asset's name, a status line shows whether it is Online or Offline right now (its Census agent is connected, or the computer answers on the network). For Windows computers it also shows who is using it at this moment: in use by a user (with idle time), locked, or no one logged on, plus Remote Desktop sessions. This is checked when the page opens (through the agent within seconds, otherwise WinRM) and refreshed at most once a minute. If automatic screenshots are turned on (General settings), opening the page also takes a fresh screenshot (for users with the Screenshots permission, at most once a minute); it runs separately from the usage check, so the status appears first and the Screen panel refreshes when the screenshot arrives. If the status can't be read, the reason is shown next to it. Each computer keeps only its latest screenshot; a new one replaces it. Click the screenshot to enlarge it; click again to close.
The left panel shows a summary and actions (see Asset actions). The tabs stay on one row: when they don't fit, the less used ones (Registry & files, Performance, Console, Relations, Comments & documents, Raw data…) move into More ▾ at the end of the row, and a tab you open from there joins the row while you're on it. The tabs are:
| Tab | Contents |
|---|---|
| Summary | System, OS (build, release, last boot, uptime, Fast Startup), inventory source and dates, asset management fields, latest screenshot |
| Hardware | CPU, memory and memory modules (free slots), BIOS, TPM, Secure Boot, battery health, disks, graphics, monitors (make / model / serial), printers, devices with hardware IDs and drivers |
| Software | Installed software with authorization status and Uninstall buttons; startup programs; Windows updates |
| Services | Windows services or systemd units with state and start mode, plus Start / Stop / Restart |
| Users & groups | Everyone who has signed in, with first and last time, local groups and members, local accounts |
| Security | Antivirus, firewall, BitLocker, TPM, Secure Boot, administrators, shares |
| Antivirus: Windows 10/11 report every product registered with the Windows Security Center (Defender, Sophos, ESET, Bitdefender, CrowdStrike, SentinelOne…). Windows Server has no Security Center, so Census shows Microsoft Defender's own status (including passive mode, when another product protects the server) and recognizes common products by their service: CrowdStrike Falcon, SentinelOne, Sophos, ESET, Trend Micro, Bitdefender, Kaspersky, Trellix (McAfee), Symantec, Carbon Black, Cortex XDR, Cisco Secure Endpoint, Webroot, Malwarebytes, Cylance, Elastic Defend, WithSecure and VIPRE. On Linux: Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, Sophos, ESET, Trend Micro Deep Security, Carbon Black, Trellix, Kaspersky and ClamAV. For a product found by its service, "Enabled" means the service is running; its signature status isn't reported. | |
| Network | IP, MAC, FQDN, open ports (with Open buttons for web interfaces), network adapters |
| Console | Run commands on the asset from the browser (admins) |
| History | On computers two sub-tabs: Deployments and actions (shown first): everything deployed or run on the asset, with output; Changes: discovered, software installed/updated/removed, hardware/OS/IP changes, new users, actions taken. Other devices show only Changes |
| Scanning | How Census inventories the asset (Census agent, WinRM, SSH, SNMP, ONVIF, network discovery, a hypervisor or device management), the last inventory and last successful scan, the Census agent's state, the site and remote scanner, the management ports found open (WinRM, SSH, RDP…), the scan targets that include it, the credentials in the order scans try them (administrators), login problems, and the last 10 scans with method, result, scan target, credential, duration and details. A Worth checking box explains what stands in the way of a full inventory, for example an agent that stopped reporting, WinRM open but no credential tried, or no answer at the last scan. Scans are recorded from version 0.77; network scans of remote sites record only the computers that answered |
| Manage | Name, type, assigned user, location, owner, tags, purchase date, warranty, custom fields, notes. A name or type you change here is kept: later scans and type rules don't overwrite it. Click Use the name found by scans (or Let scans set the type), or clear the name, to hand it back. |
A computer's Summary tab lists the three people who signed in most recently (Last users) and every sign-in of the last 7 days (Logons in the last 7 days: who, when, at the computer or remote, and from which address; the 8 newest, the rest under Show more). Without recorded logons, Last users comes from the user profiles.
Where logons come from: on Windows, the Security event log (event 4624: sign-ins at the computer, cached domain sign-ins and Remote Desktop; Windows records them by default), on Linux and macOS the last login records (at the computer, and SSH with the address it came from). Each inventory by the Census agent or a WinRM / SSH scan adds the logons of the last 8 days; Census keeps them for 30 days. Logins by management tools (WinRM, file shares, services) aren't sign-ins and aren't listed. Agents and remote scanners need the current version.
Each asset shows only the tabs that apply to it. Computers (inventoried by the Census agent, WinRM or SSH, or typed Windows, Linux, macOS, Unix or Virtual Machine) get all of them. Printers, cameras, switches, access points, IP phones, firewalls, NAS boxes, TVs and other devices show Summary, Network, Tickets, History, Scanning, Manage and Raw data, plus Hardware, Ports (switch ports and neighbors, from SNMP), Certificates or Event log when Census has that data for them. Hypervisor hosts also get Hardware and Virtual machines. Connected devices appears only when the computer has reported monitors, printers, scanners or docks attached to it. Changing an asset's type on the Manage tab changes its tabs too. The same goes for the actions in the left panel: devices don't offer Deploy package, Run script, screenshots or computer commands, only Rescan, Ping, the web interface, Wake on LAN, Continuous ping, link actions, and SSH or Remote Desktop when that port is open.
Macs#
From the Census agent 0.37.0 (or an SSH scan as root), Macs also report: FileVault, System Integrity Protection, Gatekeeper, secure boot level and the XProtect version (Summary tab), MDM enrollment, battery health and charge cycles, displays (external monitors become connected devices) and graphics, third-party background services (Services tab, also used to recognize antivirus/EDR such as CrowdStrike, SentinelOne, Microsoft Defender, Sophos, Jamf Protect), logon history, and apps in subfolders of /Applications (e.g. Adobe Creative Cloud). Macs get their own compliance checks.
Windows details#
From the Census agent 0.41.0 (or a WinRM scan), Windows computers also report:
- Activation (Summary tab) and Licenses (Software tab › Licenses & updates): the state of the Windows license and of volume-licensed Office (activated, grace period, notification mode…), the license channel (Retail, OEM, volume KMS or MAK) and the last 5 characters of the product key, as Windows' licensing service reports them. Full product keys are never collected. Office from Microsoft 365 (Click-to-Run with a subscription) licenses through the user's account and isn't listed.
- Drivers (Hardware tab): drivers from hardware vendors with provider, version, date and signature; Windows' own inbox drivers are left out.
- Software tab sections: an asset's Software tab is split into sub-tabs: Software (installed programs and Store apps), Browser extensions, Startup programs and Licenses & updates (Windows activation and installed Windows updates). A sub-tab appears only when the computer has something to show there.
- Microsoft Store apps (Software tab, below the programs): Store/MSIX apps for all users, without Windows' system apps and frameworks. They're kept apart from the installed programs list.
- SQL Server (Summary tab): each instance with version, edition and service state, and its databases (state, recovery model, size) when the inventory account may read them. The Census agent runs as SYSTEM, which newer SQL Server versions don't let see every database; a WinRM scan with an account that is a SQL administrator lists them all.
- Failover cluster (Summary tab): the cluster's name and nodes, for cluster nodes.
Reports: Windows and Office licenses and activation, Windows not activated, Drivers from hardware vendors, Drivers older than 3 years, Unsigned drivers, Microsoft Store apps, SQL Server instances, SQL Server databases and Failover cluster nodes.
Devices#
The Hardware tab of a computer lists its hardware devices: on Windows everything Device Manager shows, on Linux the PCI and USB devices. Each device has its class, manufacturer, status, hardware IDs and driver (provider, version, date and INF on Windows; the kernel driver on Linux). Devices with a problem come first, with Device Manager's own message, such as The drivers for this device are not installed. Type in the search box to find a device by name, class or hardware ID.
Hardware IDs tell what an unknown device is: PCI\VEN_8086&DEV_A3BA is vendor 8086 (Intel), device A3BA. On Linux the IDs are the vendor and device numbers (8086:a3ba), with the subsystem, and the kernel's module alias. A Linux device counts as a problem when no driver is loaded for it; bridges and USB hubs work without a driver of their own and never count.
To find devices on every computer, use the reports Devices without a driver, Devices with problems and Disabled devices, or the report builder (Report on: Devices), for example Hardware IDs contains "VEN_8086&DEV_A3BA".
Devices need the Census agent 0.84.0 or later, or a WinRM or SSH scan by this server or a remote scanner of that version. Macs don't report devices yet.
Uptime and Fast Startup#
Windows' Fast Startup (the default on Windows 10/11) means Shut down doesn't really restart Windows, so Windows' own "last boot time" can be weeks or years old. Steward IT Census reads the real boot time from the event log and shows the boot type (cold, fast startup, resume).
Connected devices#
Devices attached to computers become assets of their own, linked to the computer that reports them:
| Device | Where it comes from | Uses a license |
|---|---|---|
| Monitors | The monitor's identification data (EDID): maker, model, serial, year. Windows, and Linux (/sys/class/drm). |
Yes, if the monitor reports EDID data. Monitors without it are listed as Monitor (no EDID data) and don't use a license slot. |
| Printers connected by USB or parallel port | Windows Plug and Play; on Linux/macOS the CUPS queues with a usb:// or parallel device |
Yes |
| Scanners (USB) | Windows Plug and Play (imaging devices, not cameras) | Yes |
| Docking stations | Windows Plug and Play (dock class) | Yes |
Not included: the laptop's own screen, virtual machine displays, keyboards, mice and other input devices, webcams, headsets and USB drives. Network printers are found by the network scan as their own assets (with SNMP details); a printer used over the network by a computer is not a connected device of that computer.
They appear after the next inventory by the Census agent, WinRM or SSH:
- the computer's Connected devices tab lists them, with model, serial and whether each uses a license;
- each device has its own page with Connected to (the computer and when it last reported it), change history and asset management fields (location, owner, warranty…);
- the report Connected devices (monitors, printers, scanners) lists them all.
Cameras (built-in and USB webcams, including Windows Hello infrared cameras) aren't assets, but every computer's cameras are listed in the report Cameras (webcams and network cameras), together with network cameras found by scans. Windows and Linux computers report their cameras with the next inventory after updating to 0.29.
A device with a serial number is recognized wherever it is plugged in: when another computer reports it, it moves to that computer and the change appears in its history (Moved from PC-A to PC-B). Unplugging (for example undocking a laptop) changes nothing; the device stays linked to the computer that last reported it. Devices without a serial number are tracked per computer. New devices follow the license limit like any other asset; archive retired monitors and printers to free their slots.
Asset groups#
- Static groups: you choose the members (select assets › Add in the left panel).
- Dynamic groups: saved filters. Filter the asset list, then click Save filter as dynamic group. Membership updates automatically.
Groups can be used as deployment targets and in reports.
Archiving and deleting#
Archive retired devices (on the asset's Manage tab, or for many at once from the asset list). Archived assets keep their history, are no longer updated by scans, and don't count toward your license. Restore brings them back (if license capacity allows). Delete removes an asset and its history completely; it's re-added if discovered again.
Asset types and vendor types#
Configuration › Asset types & rules
- Custom types: add your own types with an icon (e.g. Door Controller). They're available everywhere built-in types are.
- Vendor types set the type of every device from a vendor (for example all Ubiquiti devices are Access Point). The list shows the vendors on your network; search to find any vendor, including ones you don't have yet (from the IEEE MAC vendor list). Pick a type in the drop-down; existing devices are updated at once. Automatic uses the scan's own classification and the built-in rules (VoIP-only vendors such as Obihai, Polycom, Yealink, Grandstream, snom and Fanvil are IP Phone); a type you pick wins over them.
- Advanced rules (collapsed) assign types by host name, model, OS or web page title: if the host name contains X, the type is Y. Patterns match the start of a word, case-insensitively ("cam" matches "Front-Cam 2" but not "Webcam"); the first matching rule wins.
- Computers inventoried by the agent, WinRM or SSH keep their real OS type. You can always change a type by hand on the Manage tab; scans, vendor types and rules then leave it alone.
MAC vendors#
Configuration › MAC vendors
Manufacturer names for discovered devices come from the built-in IEEE registry (about 58,000 vendors). Add your own entries to name devices the registry doesn't know, or a specific device with a randomized MAC:
- a prefix (first 6–11 hex digits, e.g.
48:05:60), or a full MAC for one device - a vendor name, and optionally a device type that overrides classification
Custom entries take priority. Click Re-apply vendors to existing assets to update existing assets right away.
Warranty lookup#
Configuration › Warranty lookup gets the warranty of each Dell and Lenovo computer, monitor and docking station from the manufacturer: end date, service level (e.g. ProSupport Plus), start and ship date. It fills the asset's Warranty until and, if empty, its Purchase date, and shows a Warranty panel on the asset's Summary tab with Check now.
| Brand | What you need |
|---|---|
| Dell (and Alienware) | A free Dell TechDirect account. Under APIs, request the Warranty API. Dell reviews the request (usually a few days) and gives you a client ID and secret. |
| Lenovo | A Warranty API ClientID from your Lenovo sales or account representative. |
| HP and other brands | HP only grants its warranty API to customers its account managers approve, with keys that expire every 90 days, so it isn't supported. Import from CSV instead: one line per device (computer, monitor, printer…) with serial, warranty end[, purchase date[, service]], dates as YYYY-MM-DD. |
Enter the credentials, tick Look up warranties automatically and save. Test a serial number checks the credentials without storing anything. Computers are looked up within the hour, then every 120 days (configurable); failed lookups are retried after 2 days. Virtual machines and devices without a real serial number are skipped.
Monitors and docks (see Connected devices) are looked up by the serial number they report to the computer. Lenovo ThinkVision monitors usually report their label serial, so they are found. Many Dell monitors report an internal serial instead of their 7-character service tag; those are skipped (or come back unknown serial): enter the date by hand or import it. Other monitor brands (ASUS, LG, Samsung, Acer, MSI…) don't offer a warranty API; use the CSV import, or rely on the estimate below. The server needs internet access to the manufacturer's API.
Estimated warranty for monitors#
For monitors without a warranty record from the manufacturer, Census estimates the end date: the brand's usual warranty term, counted from the purchase date if one is entered, otherwise from the manufacture date the monitor reports (week and year, shown as Manufactured on its Summary tab; when only the year is known, 1 July is used). Estimates are marked estimated on the asset, in the Warranty expired or expiring report and in the report builder (Warranty estimated). They never replace a looked-up, imported or hand-entered date, and a real date entered later replaces the estimate.
The terms are under Configuration › Warranty lookup › Estimated warranty for monitors: 3 years for most business brands, 5 years for Eizo, 1 year for Apple; Other brands is 0 (no estimate) by default. Warranty terms differ by region and product line (some brands give consumer models only 1 or 2 years), so adjust them to the monitors you buy. Untick Estimate warranties of monitors to remove all estimates. Estimates are updated within the hour after an inventory, and immediately when you save the terms.
A Warranty until or Purchase date you enter by hand on the Manage tab is never overwritten by a lookup. Click Use the looked-up date (or clear the field) to hand it back. Imported dates aren't changed by lookups either.
Reports: Warranty expired or expiring in 90 days (with an Estimate column) and Computers without warranty data; the report builder can filter on Warranty until, Warranty estimated and Warranty service level.
Custom fields#
Configuration › Custom fields adds fields such as Asset tag, Cost center or PO number (text, number, date or a drop-down list). They appear on every asset's Manage tab, are searchable, and can be used in custom reports.