Deployment & scripts

Deployment installs software, runs scripts and executes commands on your computers, and shows the result of each one.

How targets are reached#

For each target computer, Steward IT Census picks the best route automatically:

Census agent if it's online: starts within seconds and works for laptops off-site. Runs as SYSTEM (Windows) or root (Linux/macOS).
Otherwise WinRM (Windows) or SSH (Linux/macOS) with your stored credentials, running as that account.

You can force agent only (queued until an offline laptop comes back online, up to 7 days) or WinRM/SSH only per deployment.

Stop after (minutes) on New deployment and Run script (optional) sets a time limit for the whole deployment: computers that haven't started the package by then are skipped (Not started within the deployment's time limit); ones already running finish, within the package's own Timeout, which is how long it may run on one computer. Without a limit, a computer whose agent is offline waits up to 7 days.

A task handed to an agent that then stops answering (service stopped, agent busy or crashed) runs over WinRM/SSH, or through the site's scanner, once it has waited about 3 minutes (with a time limit: a quarter of the limit, at least 30 seconds, and never after the limit), provided the computer answers on the network and a credential fits. A computer that is switched off keeps its task until its agent comes back. Deployments set to agent only always wait for the agent.

Files are downloaded by the target from your server with a one-time link and verified by SHA-256 before anything runs.

Packages#

Deployment › Packages & scripts (the page the Deployment menu opens) lists your reusable packages. New package (also in the Deployment menu) creates one of three kinds:

Installer / file#

Upload an MSI, EXE, script or archive and give the command to run. {file} is the downloaded file's full path, {dir} its folder.

Installer	Command	Success codes
MSI	`msiexec /i "{file}" /qn /norestart`	0,3010
Inno Setup EXE	`"{file}" /VERYSILENT /NORESTART`	0
NSIS EXE	`"{file}" /S`	0
PowerShell script	`powershell -ExecutionPolicy Bypass -File "{file}"`	0
Debian package	`sudo -n apt-get install -y "{file}"`	0

Script#

Write a script directly in the browser in PowerShell, PowerShell 7, Batch / cmd, bash, sh or Python, with optional arguments. The script's output and exit code are shown per computer.

Scripts that need a credential

A PowerShell script can be given an account when it's deployed, for example a domain account to repair a computer's domain trust, or an account that can read a network share (scripts run as the computer's SYSTEM account through the Census agent, which reaches shares only as the computer itself, and WinRM sessions can't pass your sign-in on to a share at all). Tick Needs a credential in the script package; the script then gets it as $CensusCredential (a normal PowerShell credential):

New-PSDrive -Name S -PSProvider FileSystem -Root \\fileserver\software -Credential $CensusCredential
Start-Process -Wait msiexec -ArgumentList '/i','S:\app.msi','/qn'

When you deploy it, choose the credential:

a stored credential (Scanning › Credentials, Windows (WinRM) or LDAP): administrators only, because a script could send it anywhere;
Enter one now: typed in for this deployment and kept only in the server's memory until the deployment ends (a server restart before then means deploying again).

Either way the password is handed to the computer only while the script runs: it's never saved with the package or the deployment, and if the script prints it, it's replaced by ******** in the output. The deployment page shows which account was used. Run script offers the same for one-off scripts. Needs the Census agent 0.46.1 or later (older agents: the deployment uses WinRM instead). Not yet possible: scheduled deployments, and computers at a remote scanner's site.

Command#

A single command line, no file. For example msiexec /x {ProductCode} /qn or ipconfig /flushdns.

Each package has success exit codes (anything else is reported as failed) and a timeout. Windows commands run as a batch file, so msiexec and other installers complete before the result is reported.

Moving packages to another Census server#

To copy packages to another Census server (a test server, a second installation, or another customer's server), use Export on a package or Export all on Deployment › Packages & scripts. You get a zip file with the packages and their installer files. On the other server, click Import and choose that file.

Every package is added as a new one. If a package with the same name already exists, the copy gets a number, for example 7-Zip (2).
Installer files are checked against the checksum in the export, so a damaged download is refused.
Packages that install the Census agent are left out: they contain this server's agent key. Create them again on the other server from Census agents. The built-in packages (Install Linux updates, Repair domain trust) are left out of Export all because every server already has them.
Commands and scripts are copied as written. Check that they don't contain passwords before you send an export to someone else.
Importing needs the Deployment permission in a role that isn't limited to some assets.

Starting a deployment#

Deployment › Packages & scripts: click Deploy next to a package, then pick the targets: individual assets (search by name, IP, serial or user and add as many as you like; ✕ removes one), an asset group, and/or the assets listed by a report. They can be combined; each computer gets the package once. (Deployment history › New deployment opens the same page with no package chosen.)
Assets list: tick assets › Deploy… or Run script… in the left panel. The ticked assets are added as targets for that visit; add or remove more on the deployment page.
Asset page: Deploy package… or Run script… in the left panel.

Under When, choose Now or a schedule (see Scheduled deployments).

Deployment › Deployment history shows progress live. Each target shows its status, route (agent / WinRM / SSH), exit code and full output. Retry failed re-runs the failed targets; Cancel stops targets that haven't started.

Deploying to the assets in a report#

Any report that lists assets can be the target list: choose it under …and/or the assets in a report, or click Deploy to these assets on the report's page. The form shows how many assets the report lists right now.

Typical use: keep software up to date.

Reports › New report, report on Installed software, filters Software is "Google Chrome" and Version older than 130.0.6723.70 (versions are compared number by number, see Reports). Save it.
Create a package that installs the current version.
Open the report, click Deploy to these assets, pick the package and a schedule (for example every night at 22:00).

Each run evaluates the report again, so computers that were updated drop out and new ones with the old version are picked up. Reports that only count (a summary without an asset column) can't be used as a target list.

Scheduled deployments#

Under When on the deployment page, choose:

Run	Settings
Once	Date and time
Every day	Time, optionally a first day
Every week	Time and one or more weekdays
Every month	Time and day of the month (29–31 run on the last day in shorter months)

Times are the server's time zone (shown on the Scheduled deployments page). Each run starts an ordinary deployment, listed in the Deployment history with a scheduled label. Asset groups and reports are evaluated at every run; individually selected assets stay fixed.

Stop after (minutes): targets that haven't started this many minutes after each run's start are cancelled (Not started within the deployment's time limit) and wait for the next run, so an offline laptop doesn't install the package in the middle of the next working day. Tasks already running are left to finish. Empty = no limit: targets wait as with a normal deployment.

If the server is off at the scheduled time, the run starts when the server is back only if that is within the time limit (or within an hour without one); otherwise it is skipped and the schedule shows Missed.

Deployment › Scheduled deployments lists every schedule with its next and last run. Turn off pauses a schedule, Run now starts its deployment immediately without changing the schedule, Edit changes it. A one-time schedule turns itself off after it ran. Installing the Census agent can't be scheduled.

Repairing a computer's domain trust#

When a computer's trust with the domain is broken ("The trust relationship between this workstation and the primary domain failed"), domain users can't sign in there, but Census still reaches it through its agent or a local administrator / LAPS login. Census checks the trust at every Windows inventory (a fraction of a second; skipped on domain controllers, and a laptop that can't reach a domain controller isn't reported as broken):

the asset's Summary shows Domain trust: Broken with Windows' error,
the report Computers with a broken domain trust (Active Directory) lists them.

To fix it, deploy the built-in package Repair domain trust to those computers with a domain account that may reset their computer accounts (a domain admin, or an account delegated Reset password on the computers' OU). It repairs the trust in place (Test-ComputerSecureChannel -Repair): no leaving the domain, no restart. It checks first and changes nothing on a computer whose trust works, and its output shows the state before and after. The computer is inventoried again right after, so it drops off the report. The knowledge base article on this error explains the background.

Run script (one-off)#

Deployment › Run script runs a script without creating a package: choose the language, paste the script, pick targets and run. Tick Also save as a reusable script package to keep it.

Console#

Each asset has a Console tab (administrators only): type a command (PowerShell or cmd on Windows, bash or sh on Linux) and see the output in the browser, with command history (↑ / ↓). Each command runs as a separate process (there's no shared working directory) and is logged under Deployment. Avoid interactive commands.

Pushing the Census agent#

Choose Install Census agent as the package under New deployment (Deployment history › New deployment), or use Install agent… for selected assets, Install Census agent on an asset page or Push to computers on the Census agents page. It installs the agent with your server's settings over WinRM (Windows) or SSH (Linux/macOS: root or passwordless sudo), using the credentials mapped to each computer.

The right build is chosen for each computer (Windows / Linux / macOS, Intel or ARM) from the agent files in the server's agents folder, so one deployment can cover a mixed group. Computers that already have a connected agent, devices that aren't computers (printers, switches…) and 32-bit systems are skipped; the list of skipped assets and the reason is shown when you start it.

Installing the Census Action Launcher#

Choose Install Census Action Launcher under New deployment to put the launcher on your admin workstations. Each computer gets its build (Windows, or 64-bit Linux), installed for every user. It goes through the Census agent when it's connected, otherwise WinRM/SSH. Like the agent and scanner installs, it can't be scheduled.

Security notes#

Only administrators can create packages, deploy, run scripts or use the console.
After a successful installation or uninstall, the computer's inventory is refreshed automatically (agent: within seconds; otherwise a rescan; at most every two minutes per computer), so its software list and vulnerabilities show the change.
Every deployment, script and console command records who started it and appears on the asset's History tab (Deployments and actions). Actions such as screenshots, Wake-on-LAN and service control are also written to the asset's change history.
Values from device data inserted into command actions (such as {name}) are sanitized first.