Configuration

Everything under Configuration (the ⚙ icon at the top right). Most pages are for administrators only.

Page	Purpose
General settings	Company name, agent reporting interval, server URL, automatic screenshots, SSH host keys. Below. Opens first.
License	Usage, installed keys, activation, pricing. See Licensing.
Alerts & scheduled reports	Alert rules and the alert log. See Alerts.
Email	Microsoft 365, Gmail / Google Workspace (both without a mailbox password), your mail server (SMTP) or Resend, for alerts, scheduled reports and help desk mail. See Alerts.
HTTPS certificate	Free trusted certificate from Let's Encrypt, so browsers don't warn. See HTTPS certificate.
Custom fields	Extra asset fields (asset tag, cost center…). See Assets.
Asset actions	Built-in and custom actions. See Asset actions.
Asset types & rules	Custom types, the type per vendor, and advanced rules. See Assets.
Authorized admins	Allowed administrators. See Users & administrators.
MAC vendors	Custom vendor names for MAC prefixes or devices. See Assets.
Logins & roles	Who can sign in (below).
Help desk	User portal, ticket categories, ticket emails, automatic closing. See Help desk.
Cleanup & retention	Automatic asset cleanup and history retention. Below.
Vulnerabilities & compliance	Vulnerability feed downloads and which compliance checks run. Below.

Logins and roles#

Role	Can
Administrator	Everything
Viewer	Browse assets, software, users, reports, changes and the dashboard. Cannot see screenshots or credentials, change configuration, deploy, run actions or use the console.
Custom roles	Viewer, plus exactly the abilities you tick

Custom roles#

Give technicians more than Viewer but less than Administrator. Under Logins & roles, click New role, name it (e.g. Technician or Help desk) and tick what it may do:

Permission	Allows
Edit assets	Edit asset details and custom fields, bulk changes, archive/delete, manage groups
Scanning	Run scans, rescan assets, manage scan targets
Run actions	Remote commands, diagnostics, Wake-on-LAN, service start/stop
Screenshots	See and take screenshots of users' screens
Console and scripts	Run commands and scripts on assets
Deployment	Packages and deployments
Uninstall software	Remove software from assets
Software management	Mark software authorized/unauthorized, software licenses
Custom reports	Create and edit custom SQL reports
Census agents	See agents, the enrollment key and installers; uninstall agents
Vulnerabilities	See vulnerabilities and missing updates, accept risks (see Vulnerabilities)
Compliance	See configuration compliance results, accept risks (see Compliance)
Patch management	See missing Windows updates, approve or decline them, and install them on computers (see Patch management). Changing the patch policy stays with administrators
Knowledge base editor	Write, edit and delete knowledge base articles (everyone can read them)
Help desk technician	See and work on help desk tickets (see Help desk)
Move assets on maps	Place, move and remove assets on floor and site maps and change their Location text, for technicians who move equipment. Edit assets includes it; adding and changing the maps themselves needs Edit assets

Credentials, logins and roles, license, alerts, Active Directory, General settings and the other Configuration pages always stay with administrators. Assign a role when adding a login, or change it later in the login list. A role can't be deleted while people still have it, and there must always be at least one administrator.

Click Email in the login list to give a login an email address; the help desk sends ticket notifications to it.

Roles limited to some assets#

For a team that looks after one office, or a service provider with several customers on one Census server, a custom role can be limited to some assets. Tick Limit to some assets in the role and choose:

Sites: This server's network and any of your remote scanner sites. Assets found at those sites belong to the role.
Groups: any asset groups, static or dynamic. Their members belong to the role.

An asset belongs to the role when it is in one of the ticked sites or groups. Monitors, docks and other devices connected to those computers come with them. Logins with the role then see only those assets everywhere: the asset list and its filters, the dashboard, software, vulnerabilities, compliance, certificates, event logs, changes, users who signed in to those computers, agents, scan history of their sites, deployments and help desk tickets.

What they can do with their assets follows the role's permissions as usual. A few things are shared by every site, so a limited role can use them but not change them:

Packages can be deployed but not created, edited or imported. Scheduled deployments are for unlimited roles.
Scan targets of their sites can be run but not added or edited. Ad-hoc scans of an address range aren't available.
Asset groups, floor and site maps, custom reports, software authorization and software licenses can't be changed. Assets can't be imported or added by hand, because a new asset would belong to no site of the role.
Reports show only the rows of the role's assets. Reports that count across all assets (for example Operating system summary or Manufacturers) aren't listed.
Deployments and tickets are shown when every target belongs to the role. A ticket also shows when it's assigned to the login, linked to one of the role's assets, or raised by someone who uses one of its computers.
Risk exceptions for vulnerabilities and compliance can be added for one asset at a time.
The network map and the AD group and AD computer pages aren't available.

Computers with the Census agent: an agent that reports straight to this server puts its computer in This server's network, wherever the computer is. To give a site's role those computers, use a group, for example a dynamic group by domain or organizational unit, or have the agents connect through the site's agent relay.

A group or site that a role is limited to can't be deleted until the role is changed. Administrators and Viewers are never limited.

Technicians can sign in with their Windows (Active Directory) account instead of a separate Census password, with their role coming from their AD groups. Under Logins & roles › Active Directory sign-in:

Tick Allow sign-in with Active Directory accounts.
List AD groups and the role their members get, for example Domain Admins → Administrator, Helpdesk → a custom role with Help desk technician. Set Type to User to give one person a role directly (CORP\jdoe, jdoe, their UPN or email address), whatever groups they are in. Add group or user adds a row (up to 50), ✕ removes one, and ↑ ↓ change the order: the first matching row wins, so put individual exceptions and the most powerful groups first. For example, a User row CORP\intern → Viewer above Domain Admins → Administrator makes that one admin account a viewer in Census.
Save. Users then sign in on the normal login page with jdoe, CORP\jdoe or jdoe@corp.example and their Windows password.

How it works:

Census checks the password with the domain controller of the user's domain (an LDAP bind as the user) and reads their group memberships there at every sign-in, including nested groups (someone in IT Admins, which is a member of Domain Admins, counts as a Domain Admin). If the groups can't be read, sign-in is refused.
Removing someone from the groups (or their User row) takes effect at their next sign-in, which also ends their open sessions. Disabling the account in AD ends its sessions at the next AD sync. Otherwise a session lasts as the sign-in policy says (12 hours by default).
Each AD account appears in the login list after its first sign-in, named name@domain and marked AD, with its role shown as from AD groups (change the group, not the login) and its email address taken from AD for help desk notifications. It has no Census password. Deleting it ends its sessions; it comes back at its next sign-in if it still matches a row.
Local logins take precedence: if a local login has the name that was typed, only its password is checked.
Keep at least one local administrator: it is your way in when the domain controller can't be reached, so Census doesn't let you delete or demote the last one. (census-server reset-password also creates one.)
Requirements: the domain is set up and synced under Scanning › Active Directory & Entra ID and uses StartTLS or LDAPS (plain LDAP is refused, because passwords would cross the network unencrypted). Microsoft Entra ID accounts can't sign in this way. A user's primary group (usually Domain Users) isn't reported by AD as a membership; use other groups.

With Windows sign-in (Kerberos), people already signed in to Windows with a domain account click Sign in with Windows on the sign-in page and are in, without typing a password. Their role comes from the Active Directory sign-in rules, so turn that on first. Set it up under Logins & roles › Windows sign-in:

The server's identity in Active Directory.
- Census server on Windows, joined to the domain: nothing to do; it uses its computer account. If people open Census by an alias rather than the computer's own name, register it: setspn -S HTTP/census.corp.local SERVERNAME.
- Census server on Linux (or a Windows server that should use a service account): create a user such as svc-census (password never expires), then on a domain controller run setspn -S HTTP/census.corp.local svc-census and ktpass /princ HTTP/census.corp.local@CORP.LOCAL /mapuser CORP\svc-census /pass * /crypto AES256-SHA1 /ptype KRB5_NT_PRINCIPAL /out census.keytab, with the name people open Census by and your domain. Upload census.keytab on the panel (it's stored encrypted).
Browsers. They only offer Windows sign-in to sites they trust: add the Census address to the Local intranet zone (Group Policy Site to Zone Assignment List, value 1) for Edge and Chrome on Windows, or set network.negotiate-auth.trusted-uris in Firefox.
Tick Offer Sign in with Windows. Optionally tick Windows sign-in counts as two-step sign-in; otherwise logins that need two-step sign-in still enter their code.

Census accepts Kerberos only. Open it by its DNS name (https://census.corp.local:8443), not its IP address: by IP, or by a name without an SPN, Windows falls back to NTLM, which Census refuses with an explanation. Sign-ins and refusals appear in the audit log.

Technicians can sign in with their organization's account at an OpenID Connect provider: Microsoft Entra ID (Microsoft 365), Google Workspace, Okta, or any other (Keycloak, Authentik, JumpCloud, Ping, Auth0…). They click Sign in with … on the sign-in page, sign in at the provider with its password and two-step check, and come back signed in to Census. No Active Directory or domain controller is needed, and it works from anywhere the Census server can be reached.

Set it up under Logins & roles › Sign in with Microsoft, Google, Okta:

Copy the redirect address shown on the panel (https://<the address you open Census by>/api/login/oidc/callback) and register an application at the provider with it:
- Microsoft Entra ID: App registrations › New registration, platform Web, that redirect address. Note the Application (client) ID and the Directory (tenant) ID, and create a client secret under Certificates & secrets. The issuer is https://login.microsoftonline.com/<tenant ID>/v2.0.
- Google: Google Cloud console › APIs & Services › Credentials › Create credentials › OAuth client ID, type Web application, that redirect address as an authorized redirect URI. Set the OAuth consent screen to Internal to keep it to your organization. The issuer is https://accounts.google.com.
- Okta: Applications › Create App Integration › OIDC › Web Application, that redirect address as sign-in redirect URI. The issuer is your Okta address (or your authorization server, such as https://example.okta.com/oauth2/default).
Click the provider's button under the list, enter the issuer, client ID and client secret (stored encrypted), and Test the issuer: Census reads the provider's configuration and signing keys.
Add rules for who gets in with which role, matched in order; the first matching rule wins, and someone no rule matches is refused:
- Group or app role: a value of the token's groups or roles claim. In Entra ID add the groups claim (Token configuration › Add groups claim, security groups) and use the group's Object ID, or define app roles and use their value. In Okta add a groups claim to the ID token and enter groups as an extra scope; rules use the group names. Google sends no groups.
- Email address or Email domain (for example example.com). Addresses a provider marks as unverified never match.
Optionally tick The provider checks two-step sign-in: Census then doesn't ask its own authenticator code. Otherwise logins that need two-step sign-in still enter it.

Each person gets a login named after their email address the first time they sign in, marked SSO in the list, with no Census password; its role follows the rules at every sign-in. Removing someone at the provider or from the rules takes effect at their next sign-in, and an open session ends at the latest after the maximum session length; deleting the login or turning the provider off signs them out at once. Census checks the signature of every sign-in token against the provider's published keys, its issuer, audience and expiry, and binds each sign-in to the browser that started it. Sign-ins and refusals appear in the audit log. Keep at least one local administrator for when the provider can't be reached.

My account#

Point at your name (or 👤) at the top right: the menu has My account and Log out. My account shows your login and role and lets you:

Change your password (Census logins): enter the current password and the new one twice. Your other open sessions (other browsers or PCs) are signed out. Wrong current passwords count like failed sign-ins. A login that signs in with Active Directory has no Census password: change it in Windows (Ctrl+Alt+Del › Change a password).
Set up or turn off two-step sign-in.
Choose your own Language and formats: the language of the console (empty = the organization's), the region (how dates, times and numbers look), dates as year-month-day, a 12- or 24-hour clock, and how many rows long lists show per page. Empty = the organization's choice (below), or your browser's language.
Turn Animations off or on for this browser (smooth page changes, charts and gauges drawing in, numbers counting up, rows sliding into place, dialogs and notices sliding in). They are always off when your operating system is set to reduce motion.

Two-step sign-in (MFA) protects a login with a second step after the password: a 6-digit code from an authenticator app on the technician's phone (Microsoft Authenticator, Google Authenticator, Authy, 1Password, Bitwarden or any other app that supports time-based codes). A stolen or guessed password alone is then no longer enough. It works for Census logins and Active Directory logins alike.

Turn it on for yourself: under My account, choose Set up, scan the QR code with the app and enter the code it shows.
Require it: under Logins & roles › Two-step sign-in, choose Administrators or All logins. A login that must use it but hasn't set it up is shown the setup at its next sign-in, before it gets in. Sessions that are already open stay open until they end (see the sign-in policy).
Recovery codes: when you turn it on, Census shows ten recovery codes. Each one signs you in once instead of the app's code. Save them somewhere safe (password manager, or printed); they aren't shown again. My account › New recovery codes replaces them.
Lost phone: an administrator clicks Reset two-step next to the login on Logins & roles. That login is signed out and sets the app up again at its next sign-in (if it's required). If the last administrator is locked out, run census-server reset-mfa -user NAME on the server.
Remember this computer: under Logins & roles › Two-step sign-in › Remember computers, choose how long (1, 7, 14, 30, 60 or 90 days; Never by default). Logins then see Remember this computer for N days below the code box. Ticked, that browser on that computer isn't asked for a code again for that long; the password is always asked. Each login sees its remembered computers (browser, address, last sign-in, until when) under My account and can Forget one or all. Remembered computers are forgotten when two-step sign-in is reset or turned off and when the password changes (an Active Directory password change can't be seen by Census: use Forget all, or an administrator's Reset two-step). A shorter time applies to computers already remembered, and Never stops them all. Sign-ins on a remembered computer are marked as such in the audit log. Don't tick it on shared or public computers.
Turning it off or getting new recovery codes needs a current code, so a session left open on someone's PC can't do it. While it's required for your login, you can't turn it off.
Each code works once. After 5 wrong codes, the login is paused for 15 minutes. The app's secret is stored encrypted, like scan credentials, and recovery codes are stored only as hashes.

Passkeys#

A passkey signs a Census login in with the fingerprint, face or PIN of a device, instead of the password and the authenticator code: Windows Hello or Touch ID on the computer, a phone, or a security key (YubiKey and similar). The device keeps the private key; Census stores only the public key, so there's nothing on the server to steal or phish.

Add one: under My account › Passkeys, give it a name and click Add a passkey, then confirm on the device. For safety this works only within 15 minutes of signing in; if Census asks, sign out and in again first. Up to 10 passkeys per login.
Sign in: click Sign in with a passkey on the sign-in page (shown once any login has a passkey) and confirm on the device. A passkey counts as two-step sign-in: no authenticator code is asked, even where two-step sign-in is required.
Needs a DNS name and a trusted certificate: browsers offer passkeys only on a site opened by its name with a valid certificate, such as https://census.example.com:8443 with a Let's Encrypt certificate, not by an IP address. A passkey belongs to the name it was added at.
Census logins only: Active Directory and provider (Microsoft, Google, Okta) logins sign in through their directory, which checks their groups at every sign-in.
Lost device: remove its passkey under My account, or an administrator clicks Remove passkeys next to the login on Logins & roles. Passkey sign-ins and refusals appear in the audit log; a passkey whose signature counter goes backwards (a copied key) is refused.

Under Logins & roles › Sign-in policy, administrators decide how long console sessions last and how sign-ins are protected. It applies to Census logins and Active Directory logins (not to the help desk portal or API tokens):

Setting	Default	Description
Sign out after inactivity	0 (never)	5 to 1440 minutes. A login that hasn't used the console for this long is signed out and sees You were signed out after N minutes of inactivity on the sign-in page. Automatic page refreshes don't count as activity, so a console left open on a dashboard still signs out.
Maximum session length	12 hours	1 to 720 hours after sign-in, the session ends even while it's being used.
Minimum password length	8	8 to 64 characters, for new Census passwords (Active Directory passwords follow your domain's rules).
Lock a login after this many wrong passwords	10	3 to 100 (0 = never). Counted per login name, whatever address the attempts come from (`jdoe`, `CORP\jdoe` and `jdoe@corp.example` count as one name).
Lockout length	15 minutes	1 to 1440 minutes.

A locked login can't sign in, even with the right password, until the time is up. The answer is the same whether or not a login with that name exists, so the lockout doesn't reveal account names. Administrators see Locked next to the login in the list and can click Unlock. The lockout appears in the audit log once (Login locked), and every refused attempt as a failed sign-in. Changes to the idle timeout and the maximum length apply to sessions that are already open. Independently of the policy, sign-ins from one address are paused for 5 minutes after 10 wrong passwords. A restart of the Census service clears lockouts.

Forgot the admin password? On the server, run census-server reset-password -user admin (as administrator/root) and enter a new password. Lost the phone for two-step sign-in? census-server reset-mfa -user admin.

General settings#

The page shows its settings in two columns, starting with Updates.

Setting	Description
Updates	On by default: once a day Census downloads a small version file from steward-it.com and tells administrators when a newer release is out (a bar under the top menu on every page; ✕ hides it until you sign in again). Nothing about your server is sent: no version, no license, no identifiers. Check now checks at once. Update now backs up, downloads the signed release and installs it (Update from the console). Untick it to turn the check off. See Upgrading
Company name	Shown in the interface
Census agent reporting interval	Minutes between full agent inventories (default 240, minimum 15)
Server URL	The address computers use to download deployment packages and that agent installers point to, e.g. `https://census.corp.local:8443`. Leave blank to use the address in your browser. Set it if you browse via `localhost` or a name your clients can't resolve.
Take a screenshot with every inventory	Off by default. When on, each Census agent or WinRM inventory of a Windows computer also captures the screen (at most every 10 minutes per computer), keeping the Screen thumbnail current. Inform your users first.
Monitoring	Publish Prometheus metrics (off by default) and the address of the health check for monitoring tools. See Monitoring
SSH host keys	Clear the stored host key of a rebuilt Linux server
Language and formats	The language of the console for everyone (English, German, French, Spanish, Dutch, Italian or Portuguese; the first-run setup page and the installer set it first), and how dates, times and numbers are shown: language and region (e.g. German shows 31.3.2026 and 1.234,5), dates as year-month-day, 12- or 24-hour clock, the currency of money values such as software license costs, and Rows per page (20, 50, 100 or 200; default 50): long lists and reports show that many rows at a time, with Prev / Next above and below the list. Each login can choose its own under My account, and the Rows per page box above a list changes it for that page in this browser. Click a column heading to sort a list by that column (again for the other way, a third time for the list's own order). Reports always show dates as 2026-03-31.
Dashboard news	RSS or Atom feeds logins can show in a News widget on their dashboard (see Dashboard › News). ＋ Add feed adds a row, ✕ removes one

Cleanup and retention#

Configuration › Cleanup & retention keeps the inventory current and the database small. The rules run automatically once a day. Everything is off until you set it; Use recommended settings fills in sensible values for you to review. Deleting can't be undone (restore a backup instead), so click Preview saved rules to see exactly which assets would be affected before saving or running.

Assets

Rule	What it does
Archive assets not seen for N days	Archived assets stop counting toward your license and drop out of most reports, but keep their history.
Delete assets not seen for N days	Permanently deletes the asset and its history. Must be longer than the archive period.
Delete never-inventoried devices not seen for N days	Devices only found by network discovery (phones, guests, IoT) that never had a full inventory.
Make archived assets active again when inventoried	An archived computer that reports through the agent, WinRM, SSH or SNMP comes back automatically (if a license is free). A ping alone doesn't. Assets archived by a status such as Stolen stay archived.

The "not seen for N days" rules leave alone assets added by import or by hand and assets with a status (in stock, in repair…): nothing is expected to see them on the network.

Active Directory

Rule	Options
Computer no longer in Active Directory	Do nothing, archive or delete
Computer disabled in Active Directory	Do nothing, archive or delete
Don't keep disabled AD user accounts	Removed at the next AD sync

These apply only to computers in a domain synced under Scanning › Active Directory & Entra ID. A domain whose last sync failed, returned no computers or is more than 7 days old is skipped, so an outage can never make every computer look missing. Users who were deleted from AD and groups that no longer exist are removed automatically at every sync.

History retention. How long to keep change history, user logon history, scan history, finished deployments (with their output and one-off packages), the alert log and screenshots, how long to keep vulnerability and compliance risk exceptions after they expire, and how long to keep closed help desk tickets (with their notes and attachments) after closing. 0 keeps them forever. After a cleanup that frees a lot of space, the database file is compacted automatically.

Last run shows when the rules last ran and what they did, with a list of every archived or deleted asset.

Storage#

Configuration › Storage (administrators) shows how much space Census uses, to help you choose the retention settings above:

Database: its size and what fills it, grouped into things you recognize (assets and their inventory, change history, event logs, performance history, scan history, deployments, audit log, help desk tickets, vulnerability feed data and so on), each with how long it is kept and a link to the setting that controls it. Click a group to see its tables.
Data folder: the size of each folder in it (backups, deployment packages, screenshots, agent downloads, ticket attachments…).
Disk: the free space on the disk with the data folder. Below 10 % or 2 GB free the page and the dashboard warn you; below 5 % or 1 GB the warning turns red.

The same summary is in the dashboard's left panel for administrators. Sizes are measured at most every 10 minutes (on a large database measuring takes a moment); Measure now measures again. On PostgreSQL the database size is the database on the PostgreSQL server.

To make the database smaller, shorten the history settings above (change history and event logs usually grow the most), turn off vulnerability feeds you don't need under Vulnerabilities & compliance, and keep fewer backups.

Audit log#

Configuration › Audit log (administrators) records:

every sign-in to the console, with the address it came from and how (Census password, Active Directory password, authenticator code, recovery code, Windows sign-in);
every failed sign-in: wrong password, unknown account, an AD account in no Census group, a wrong two-step code, or an address locked out after too many failures;
sign-outs;
every change made in the console: settings, credentials, logins and roles, scan targets, packages and deployments, scripts and actions run, assets edited, archived or deleted, remote scanners, licenses, and so on. Each entry names the record (also after it was deleted), keeps the request, and for settings lists every value that changed as before → after. Changes the login wasn't allowed to make are kept too, marked refused.

Passwords, keys, community strings and other secrets are never recorded: they show as (hidden), so the log itself can be shared with an auditor. Click an entry for its details. Filter by user, kind (sign-ins, failed or refused, changes), period and text, and Export CSV for the filtered entries. Entries are kept 365 days by default (30–3650, set at the bottom of the page) and removed by the daily cleanup. Census agents, remote scanners and the help desk portal aren't console users and aren't in this log (remote scanners have their own log on Scanning › Remote scanners).

Encryption key#

Stored passwords (scan credentials, email and DNS provider passwords, the backup password, two-step sign-in secrets) are encrypted with a key kept in the data folder (secret.key), outside the database. A stolen database alone is useless, but anyone with a copy of the whole data folder can decrypt them: a copied disk, a backup without a password, a VM snapshot.

Configuration › Encryption key can bind the key to this computer's TPM 2.0 (optional, off by default). The key then only opens on this computer. On Windows Census creates a TPM key with the Microsoft Platform Crypto Provider; on Linux it uses systemd-creds with the TPM only (systemd 250 or newer; Census must run as root, as the installed service does). Neither binds to PCR measurements, so updates don't lock it.

What would lock the key:

the TPM is cleared or reset (Windows "Clear TPM", a TPM reset in the BIOS/UEFI);
the motherboard or TPM is replaced, or the disk is moved into another computer;
the server is restored or moved to other hardware (a VM moved to a host without its virtual TPM, a snapshot or backup restored elsewhere);
Windows is reinstalled on the server.

Windows/Linux updates, BIOS and firmware updates, Secure Boot changes, Census updates and restarts don't.

What happens then: Census still starts, but the stored passwords are locked: scans and deployments that need a credential, email, password-protected backups (they stop rather than run unencrypted) and sign-ins with two-step codes don't work, and a red banner says so. Nothing is lost: enter the recovery key on the sign-in page (Enter the recovery key) or on this page, or run census-server recover-key -key XXXX-XXXX-…, and everything works again (the key is then a plain file again; bind it anew on the new hardware). Without the recovery key the stored passwords are gone for good: re-enter every credential and password, and turn two-step sign-in off with census-server reset-mfa.

The recovery key is shown once, when you bind. Store it outside the server (password manager, printed in a safe). Recovery attempts are recorded in the audit log. Stop using the TPM turns the key back into a plain file.

Backups: with a backup password, backups also hold a copy of the key and restore on any computer with that password. Without one they hold only the bound key, and restoring them on other hardware needs the recovery key.

Vulnerabilities and compliance#

Configuration › Vulnerabilities & compliance controls the vulnerability data downloads and the compliance checks.

Vulnerability data downloads

Option	What it does
Download vulnerability data automatically	On by default. Turn it off for servers without internet access and upload the feed files under Security › Feeds instead.
Check for new data	Every 6 or 12 hours, once a day (default), every 2 days or once a week. Feeds that are up to date only cost a small request. A feed that a newly inventoried computer needs is still downloaded within about ten minutes.
Feeds	Turn off any feed (for example Microsoft, third-party applications or a Linux distribution). A turned-off feed is never downloaded, its data is removed right away, uploads for it are refused, and what it covers shows no vulnerabilities.
Microsoft security updates to check	How many months of updates to load (12 is usually enough, since updates are cumulative).
NVD API key	Optional free key that makes the first download of third-party application data about ten times faster. Stored on the server and never shown again; tick Remove the stored key to delete it.

Compliance checks

Tick or untick Check Windows computers and Check Linux computers, and open Choose … checks to turn individual checks on or off (All on / All off for a quick start). Turned-off checks show as Not applicable and don't count in scores; results update within a minute of saving. A single check can also be turned off or on from its page under Compliance.