1E 9.x (on-premises)

Endpoint Troubleshooting lets you directly question connected devices to retrieve responses, run actions, and get real-time information from them. The Endpoint Troubleshooting front-end capabilities ensure fast querying, investigation, and remediation.

The questions, responses and actions feature includes:

Results visible in Endpoint Troubleshooting can be exported to files containing comma-separated values (CSV) or, in the case of the Export all option on the instruction response page, tab-separated values (TSV), and results can be marked for export at the point of asking a question to automate the process. Endpoint Troubleshooting lets you export the data on a number of pages to CSV files:

Questions and responses can be tailored to focus on specific ranges of devices through the use of coverage and filters:

The responses to initial questions can be further refined by asking follow-on questions or actions, allowing questioners and actioners to focus in on the results they want to see.

To enhance the safety of running actions in the 1E system, there is an approval workflow that ensures that every 1E action requires the approval of designated approvers before it can be run. To make it even safer, someone with approval permissions cannot approve their own action.

When an attempt is made to run an action, the 1E approval workflow sends an email and a notification to all the approvers associated with the action. Any of the approvers may approve or reject the request to run the action.

Users must provide their user credentials when attempting to run an action, this prevents unauthorized access by a third party attempting to make use of an unattended computer.

Actions can also be configured to require two-factor authentication. This is where the user attempting to run an action is challenged to enter a unique, one-time authorization code that has been sent to them by an alternative method such as email or a registered mobile.

1E provides a way of accessing the questions and actions that is organized around the way that network administrators typically interact with their network. This interface also lets you run the Instruction using a schedule.

The Endpoint Troubleshooting→Instructions→Tasks page in Endpoint Troubleshooting provides a structured view of the instructions defined in the DEXPack. It also lets you schedule the tasks so they can be run in the future or according to a particular schedule.

The benefit of using Tasks lies in the task group structure that is defined in the DEXPack. It is this structure that enables you to focus in on specific task areas to find the particular instruction that you want.

For example you may be interested in instructions related to particular software vendor's products. Depending on the Instructions that you have uploaded to your 1E system you may see the following structure:

The Devices page in the Endpoint Troubleshooting shows you all the devices that have connected with 1E and their current connection status. There are two views provided that let you research the devices: the devices table and the devices dashboard, please refer to The Devices Table and The Devices Dashboard for more details.

The Endpoint Automation state of a device is enforced by the 1E client at the device. One or more policies are deployed to devices according to the management groups the devices belong to. Each policy consists of one or more rules that are either check rules or fix rules.

For an explanation of management groups, please refer to the Management Groups page. Management groups allow devices to be flexibly grouped, based on management group rules. This means you can easily administer devices based on, for instance, their Active Directory Organizational Unit, or their operating system version, or any other criteria supported by the management group rules.

The Overview page lets you view the current state of your enterprise in terms of the devices and policies that have been defined and applied. It consists of a number of charts that let you monitor the state in real-time.

The Endpoint Automation application provides three reports that let you view the details for the currently defined Policies, Rules and Devices. The information in these reports is consolidated into the Guaranteed State Overview page charts.

Endpoint Automation provides a Devices page where you can view the currently connected devices. On this page you can also select one or more of the devices and click an Explore button that launches the Explorer application. You can then run an instruction using the selected devices as the coverage for the instruction.

Device criticality is an attribute of a device that defines its importance within an organization. The default definition in 1E has these settings:

At present, criticality settings do not affect the primary operation of Endpoint Automation. However, it is possible to use 1E to set device criticality and to view it within Endpoint Automation.

1E also supports the use of the criticality setting when defining coverage for an instruction. For example, you can target an instruction to be sent only to devices whose criticality is not Critical.

1E lets you investigate your network using questions and actions, which are collectively known as Instructions.

You can load Instructions into 1E, either individually or using a DEXPack, which is essentially a zip file containing one or more Instructions. 1E comes with a range of pre-framed questions and actions in the form of DEXPacks, providing extensive out-of-the-box capabilities that can be extended as new and updated DEXPacks are made available.

1E permissions for the Instructions are handled using Instruction sets. You create Instruction sets, then define roles which specify particular permissions on those sets and then assign the roles to users. Each Instruction is only allowed to reside in one Instruction Set, which associates it with a role and thereby the users that have that role and can run the Instruction. The roles have associated Management groups that determine the devices that users with the role have access to.

When Instructions are loaded into 1E they are placed in the default Unassigned Instruction Set, so you must move them into previously created Instruction sets before they can be run.

Connectors are used to connect to other 1E and third party systems and populate repositories. When more than one connector to different data sources are used, the information from those different data sources is de-duplicated and normalized into a single cohesive view that is then stored in a repository. In this way you can use the data from different sources to augment each other and build a better picture of "what's out there?".

For example, you can sync inventory data from Configuration Manager into an inventory repository, which will fetch information about your Windows devices. You could then augment that with inventory data synced from 1E platform which could include information about non-Windows devices where the 1E client has been installed.

Repositories are used by applications to process and store information. For example the Patch Success application uses both an inventory and a BI repository to process the information needed to report on how successful patching is in your enterprise. Normally a connector is used to connect a data source to an appropriate repository.

Device Tags are generally associated with Endpoint Troubleshooting and can be used when setting coverage to target Instructions to particular devices, but they can also be used to define Management Groups optionally used by all applications.

Device Tags must be defined by a Full Administrator before they can be used to tag devices or used to set the coverage of Instructions.

This is done from the Settings→Configuration→Custom properties→ Device Tags page, which can be viewed by users with the Full Administrator role.

Using Software Tags allows you to create custom labels and associate them with the software titles you have deployed in your estate.

You can do this from the Settings→Configuration→Custom properties→Software Tags page, which can be viewed by users with the Full Administrator role.

Using Software Tags allows you to create custom labels and associate them with the software titles you have deployed in your estate. An administrator with either the Full Administrator or Group Administrator role can set Software Tags in their environment, they can also create Management Groups based on the tag name and value. For details about configuring 1E users, Roles, and Management Groups refer to the Permissions Menu pages.

In short, you can work with Software tags by:

If an administrator adds or modifies Software Tags or associations, they will have to run the Management Group evaluation report again to see the updated devices reflected in Inventory.

Schedules can be created to execute specific operations on repositories in 1E so that they are kept up to date with their data sources and processing. These operations include:

Repository schedules are different to Instruction schedules that can be set in Endpoint Troubleshooting.

There are pages in the Settings application for each of these. They are described in the following table:

Information on your 1E license is available, as well as the ability to re-activate it following an update.

You can view information on the 1E system information for the Consumer, Coordinator, Background channel, Core and Switch.

The monitoring pages let you view how 1E is performing its tasks. Four key log pages are provided:

1E users or groups can be added from your IdP. They can be assigned roles that determine what aspects of 1E they can access. Custom roles can be created that let you associate particular permissions on particular Instruction sets for particular management groups.

Management groups use inventory-based rules to define groups of particular devices, they are implemented in SLA and then made available to 1E applications and other consumers. After a management group is defined, each time the inventory is updated the device membership of the groups is re-evaluated by applying the management group's rules to the new inventory.

Custom roles can be created that tie particular Instruction sets to particular management groups. This means you can not only set the permissions for users to access the Instructions in specific Instructions sets, you can also determine which devices they can target using those Instructions.

Once defined, management groups can then be used to set the coverage for Instructions in Endpoint Troubleshooting and also which devices can be targeted by particular users. Management groups are also used by other applications to determine which devices are being targeted.

You determine the capabilities of Endpoint Troubleshooting by uploading Instructions from DEXPacks into 1E. DEXPacks are either provided with the release or downloaded from the 1E Exchange. Once the Instructions have been uploaded into 1E you then need to put them into Instruction sets. The Instruction sets can then be associated with custom roles to determine the permissions applied to the Instructions. The custom roles are then applied to users to determine which Instructions each user has access to.

All 1E Client features are supported on the following Windows OS:

Windows

The zip for 1E Client for Windows is available for download from the 1E Support Portal, https://1e.my.site.com.

Professional and Enterprise editions are supported for Windows 10 and Windows 11.

All versions are provided with 32-bit & 64-installers, and can be installed on physical and virtual computers.

The Tachyon client features of 1E Client are supported on the following non-Windows OS:

macOS

Linux

Solaris

Other versions of these non-Windows OS should work but have not been tested by 1E.

1E Client packages for other Linux distributions can be requested, including Raspbian for Raspberry Pi.

The 1E Client for Linux supports the following architectures:

1E Client packages for Linux are included in the non-Windows zip available for download from the 1E Support Portal, https://1e.my.site.com.

1E Client supports only 1E features on non-Windows devices.

1E Client is not available for Solaris, please use 1E Client 5.2 instead.

The 1E Client 5.2 for Solaris supports for the following architectures:

1E Client 5.2 package for Solaris is included in the non-Windows zip available for download from the 1E Support Portal, https://1e.my.site.com.

1E Client supports only 1E features on non-Windows devices.

1E clients capture certain types of event data in a local database (Persistent Storage) so that instructions can query later. Data is compressed and encrypted in a way that ensures a very low impact on device performance and security.

1E Activity Record is similar to Windows Task Manager and Perfmon. On Windows client devices 1E continuously captures events, which enables all significant events to be captured as they happen. Other OS use polling, which requires the polling frequency to be regular enough to ensure brief events are captured.

1E provides a dedicated page where the 3rd party consumers can be enabled and managed by 1E Consumer Administrators, as described on the Consumers page.

Configuration Manager users can use all the features of 1E from within the Configuration Manager console.

1E can leverage the features of the industry-respected Content Distribution to enable content to be downloaded to the 1E client device. Using Content Distribution provides the following benefits:

The feature is a set-and-forget option on the 1E Client . By default, it is enabled and means that 1E will automatically use Content Distribution to download content if it is installed on the 1E Client device (Content Distribution is currently supported on Windows devices only). The prerequisites for using Content Distribution are given on Supported Platforms. The options for configuring Content Distribution integration are NomadContentDownloadEnabled and NomadContentDownloadTimeoutSecs in the 1E Client configuration file.

1E implements a complete API for controlling the questions, answers, responses and workflows that implement the Tachyon features for third-party applications including ServiceNow.

The 1E API feature includes:

1E can be used as the means to gather data for 3rd party applications. Using its fast response time to gather the data, it then be configured to pass the data on without storing it locally. The offloading is configured for each consumer on the Consumers page. To use this feature, the consumer must be configured to use the offloaded responses data.