Documentation › Using Steward IT Census
Software
Software lists every program and package found across your computers, with the number of installations and versions.
Platform groups#
On Linux the list comes from the package manager (dpkg, rpm, pacman, apk), plus Census's own programs (server, agent, remote scanner, Action Launcher), which aren't packages: those installed in /usr/local/bin or a user's ~/.local/bin, and any that are running, wherever they were started from (Census agent 0.66.0 or later). The installed agent, remote scanner and Action Launcher can be uninstalled from the asset's Software tab (agent 0.67.3 or later); removing the agent there is the same as Uninstall on the Agents page. Linux machines often have thousands of packages, so the list is split into Windows (the default), Linux / Unix, macOS and All platforms. Counts and the authorization filters follow the selected platform.
Click a title to see its versions and every computer it's installed on.
Programs and exact names#
Computers often report one program under several names: the architecture ((x64), (x86)), the language (- en-us) or the version is part of the name, as in 7-Zip 23.01 (x64) and 7-Zip 24.08 (x64). By default (Show: Programs) the list counts such names as one program, with each computer counted once, and the publisher shown without legal suffixes (Microsoft Corporation is Microsoft). A program made of several names says so next to its name (2 names); its page lists the names, versions and computers, and its authorization buttons set the status of all its names at once.
Only noise is removed: years and editions stay part of the name, so Microsoft Office Professional Plus 2016 and … 2019 remain separate programs. Show: Exact names lists every name as the computers report it, as in earlier versions. Authorization statuses and license matching always work on the exact names.
On Windows, the list matches Control Panel › Programs and Features: programs installed for the whole computer and programs installed for individual users (common for Teams, Zoom, Slack or user installs of Chrome). Per-user programs of users who are not logged on are remembered from the last time they were seen, so they don't disappear and reappear between scans.
Installed for (Software page buttons, and the filter on an asset's Software tab) shows All installs (default), Computer (machine-wide) or User (per-user) programs. On an asset, the Installed for column names the users who have a per-user program.
Authorization#
Mark each title as one of:
| Status | Meaning |
|---|---|
| Authorized | Approved for use |
| Unauthorized | Not allowed; flagged in reports, on the dashboard and in alerts |
| Tolerated | Allowed but not endorsed (e.g. freeware you put up with) |
| not reviewed | No decision yet |
Set the status on a title's page, from the status column on an asset's Software tab, or in bulk: tick titles in the list and use Mark selected in the left panel. The left panel filters by status, including Not reviewed, so you can work through new software.
Related:
- Report: Assets with unauthorized software, every installation of an unauthorized title.
- Report: Software not yet reviewed, most-installed first.
- Alert: Unauthorized software installed (see Alerts).
- Dashboard: the Software authorization widget and the Needs attention count.
License compliance#
Software › License compliance tracks paid software. Add a license with the software name to match (* is a wildcard, e.g. Microsoft 365 Apps*), the number of seats purchased, vendor, cost, purchase and expiry dates. Installations are counted automatically from inventory (active assets only), and over-deployed licenses are highlighted.
Uninstalling software#
Steward IT Census can remove software remotely:
- One computer: Uninstall next to the program on the asset's Software tab.
- Everywhere: Uninstall from all assets on the title's page.
How it works:
- Windows MSI programs are removed silently with
msiexec /x {ProductCode} /qn. - Windows EXE programs use their registered quiet uninstaller, or the known silent switches for Inno Setup (
/VERYSILENT) and NSIS (/S). Programs that only have an interactive uninstaller aren't run silently, because they would hang on a dialog nobody can see. Open them on the user's screen instead (below), or build a deployment with the vendor's silent switch. - Linux packages are removed with the package manager (apt, dnf/yum, pacman, apk) as root or with passwordless sudo.
When a silent uninstall isn't possible (Windows)#
Uninstall on one computer runs silently whenever it can. Only if that's not possible, or the silent attempt fails, you get these options:
- Open uninstaller on the user's screen starts the program's own uninstaller, with its normal windows, for the user logged on at the console. Walk them through it on the phone, or ask them (for example by email) to finish it when they see it. If the user is a local administrator, the uninstaller runs elevated; a standard user sees the usual Windows UAC prompt. If the screen is locked, they see it after signing in.
- Remove for users who are not logged on (per-user programs only) removes the program for users who aren't signed in, with nobody at the computer. It deletes the program's folder in that user's AppData and its entry, plus every shortcut to that folder or a file in it on the user's desktop (also a desktop redirected to OneDrive), in their Start menu, on the public desktop and in the all-users Start menu, and Start-menu folders left empty. The result says how many shortcuts were removed. Then the program disappears from the list.
About per-user programs:
- Their uninstall command comes from the user's own settings, which the user could change, so Steward IT Census never runs it with administrator rights. On the user's screen it runs as that user; for logged-off users nothing from their profile is run at all. That's why the program's own uninstaller is skipped, and leftovers such as its settings may remain.
- For safety, the folder is only deleted if it's inside that user's
AppData\LocalorAppData\Roaming(not directly inPrograms,Microsoft,PackagesorTemp), and never through a junction or link. Programs installed elsewhere, and per-user Windows Installer (MSI) packages, are left alone with an explanation. - Users who are logged on are skipped by Remove for users who are not logged on. Use the on-screen uninstaller for them.
- Uninstall from all assets skips programs that need one of these options; handle those per computer.
Uninstalls run through the Census agent, WinRM or SSH and appear under Deployment with their output. The program disappears from the list after the next inventory (use Rescan now to update immediately).
Browser extensions#
Software › Browser extensions lists the extensions and add-ons in your users' browsers: Chrome, Edge, Brave and Chromium extensions, and Firefox add-ons, for every user profile on every computer. They're read with each inventory by the Census agent (version 0.78.0 or later; it sees every user on the computer) and by WinRM and SSH scans with an administrator or root/sudo login. Remote scanners read them from version 0.78.0.
- The list shows each extension once, with the browsers, versions, number of computers and profiles. All websites marks extensions that can read and change data on every site (or have similar far-reaching permissions such as controlling the browser's network traffic): they see everything a user does in the browser, so review those first.
- Mark extensions Authorized, Unauthorized or Tolerated like software titles (Software management permission). Chrome, Edge, Brave and Chromium share the Chrome Web Store's IDs, so one mark covers the extension in all of them; Firefox add-ons are marked separately.
- Click an extension for every computer, user and profile that has it and the permissions it asks for. A computer's Software tab lists its extensions too, and its History shows Browser extension added and removed.
- Reports (Software): Browser extensions, Unauthorized browser extensions, Browser extensions that can read all websites.
Extensions that the browsers install by themselves (such as Google Docs Offline, or Edge's built-in helpers) and Firefox's built-in add-ons are left out. Themes are hidden unless you tick Include themes.
Software bill of materials (SBOM)#
Census exports what is installed on a computer as a software bill of materials in the CycloneDX 1.6 JSON format, which security tools, vulnerability scanners and auditors read (for example OWASP Dependency-Track):
- one computer: ⤓ SBOM on its Software tab;
- several: select them in the asset list and choose Export SBOM (selected) in the left panel;
- every computer with software: Software bills of materials (SBOM) in the left panel of the Software page.
Several computers download as a zip file with one BOM per computer. Each BOM describes the computer (name, manufacturer, model, serial number), its operating system and every program or package with its version and publisher. Linux packages carry their package URL (pkg:deb/debian/openssl@…?distro=debian-12, likewise for rpm, apk and pacman), which tools use to match them against vulnerability databases; Windows and macOS programs have no package URL. Programs installed for one user only are marked with the property census:scope = user.
For logins with the Vulnerabilities permission the BOM also lists the vulnerabilities Census found on the computer, with severity, CVSS score, the fixed version or update to install, and the known-exploited flag; accepted risks are marked as will not fix. Through the REST API: GET /api/assets/{id}/sbom and GET /api/sbom?ids=… (add vulns=0 to leave vulnerabilities out).