1
Enrol a device
Generate the workspace enrolment key in agent settings and copy it when shown. The page inserts a newly generated key into the platform commands; it cannot reveal the full key again later. Registration exchanges it for a separate per-device credential.
- Windows installs the native 64-bit MSI, then runs the elevated enrolment command.
- Linux uses its platform-specific script and workspace-aware command.
- Treat enrolment keys as secrets and rotate them if exposed. Existing enrolled devices continue using their own credentials.
2
Confirm fleet health
The fleet view shows platform, reported version, last check-in and update state. Review stale devices before treating version status as current.
- Windows and Linux compare against separate release baselines.
- macOS update status remains unavailable until a signed native channel exists.
- Investigate service/timer health when an endpoint stops checking in.
3
Update safely
Update commands are signed for the enrolled device and reference an HTTPS release plus its SHA-256 digest. The client verifies the command and payload before installation.
- Windows uses a managed MSI handoff and restarts its service and tray companion.
- Linux checks digest and shell syntax, replaces atomically and rolls back after a failed runtime check.
- Ordantra reports queue, dispatch, install, failure, rollback and success state.
4
Use the Windows tray companion
The tray shows connection and version state, supports check-now and approved update actions, and displays pending ownership confirmation prompts.
- Users cannot supply arbitrary installers through the tray.
- Ownership correction is sent through the local trusted agent channel.
- A disappearing or unknown tray state should prompt a service-health check.