Windows & Hyper-V

A server can be healthy and unpatched, or connected with half its collectors refused. One green dot hides both. So every Windows server answers four questions separately, and the Overview opens on the ones that need a person.

• OS health is the machine: volumes, memory, event-log alerts, the Citrix and RD Gateway services. A server that has stopped reporting reads Unknown, because its last reading is not now.
• Maintenance is a reboot pending and the updates pending. When the update scan failed it says Patch status unknown — never “Up to date”.
• Coverage is what could be read: every collector as read, refused, cannot see, stale or not yet asked, with its words. Partial means something was refused; a collector that simply has not run yet is not a gap.
• Needs attention groups by rule, not by sentence: “Update scans failed: Access is denied” with the servers under it — and a line saying the same error text is not proof of one cause.
• Each server starts with itself: what it does (StoreFront, Citrix VDA, Hyper-V host, IIS), where it runs (a Hyper-V guest or XenServer VM, with how that was matched), and how fresh each kind of data is.
• Tick several and Edit: categories, collectors and intervals for many servers at once. Only what differs is written, and the result names every server with what changed or why not.

A different question from “is something installed”, and the one most estates cannot answer on a Monday morning. Every server’s agent reports what its endpoint protection says about itself — Defender’s own status, the products running by service name, the firewall profiles, the threats found and not cleaned — and the page groups what comes back by rule, so a wall of fifteen servers becomes three issues with the servers under them.

• A server that could not be asked is never drawn as protected. The refusal is quoted in Windows’ own words and counted apart: the verdict line reads “read on 11 of 12 — 1 not read, which is not a pass”.
• No percentage score, deliberately. A figure like “92 % secure” over an estate with a server unread counts a machine nobody asked as a pass, and the weights that would make it mean anything are not grounded in any real estate yet. The verdict is a word: Critical, Needs attention, Meets the baseline, Not enough read.
• Windows stands its own services down on purpose. Defender idle beside a running CrowdStrike sensor is not a fault, and the page says which is doing the job — the alternative is fifteen red rows for a healthy estate.
• Only a threat found and not cleaned is critical. That is an observation, not a setting. A firewall profile off is a warning that says a deliberate reason is possible.
• And who is attacking the sign-ins is in the same table — what protects the server and what is being thrown at it, one row each.

Wherever IIS runs, the same agent reads three things and keeps them apart, because an exposure is not an attack and an attempt is not a compromise:

• Evidence of compromise — found on the server itself: a script in a web root with a web shell’s shape (a request evaluated, a process started with what a request sends), and the web worker starting a command shell. Evidence for a person to confirm, never a verdict.
• Suspicious activity — requests in the IIS logs shaped like an attack: path traversal, encoding tricks, SQL, command and script injection, web-shell and known exploit paths, hunts for backups and keys, WebDAV methods, scanners by their own name. Counted per address, and a 2xx answer is marked as the place to look first.
• Configuration exposure — directory browsing, detailed errors, debug and remote tracing, ViewState MAC off, a machine key in the file, Windows sign-in without Extended Protection, Basic over plain HTTP, old TLS switched on, 8.3 names, backups and keys left in a web root.
• What could not be read comes first. The IIS configuration is administrators-only on most servers; when the agent is refused, the page says so in Windows’ words and says which rules were not applied, rather than showing a clean result.

Device lockdown keeps Windows machines on a policy IT sets, so a user cannot install software nobody approved. Machines enrol over the internet with a site key — an installer for Group Policy or your RMM tool — and a separate SYSTEM component applies a signed policy and keeps it when the machine is offline. The monitoring agent on your servers is not changed by it.

• Off, report or enforce per protection: local administrators, Windows Installer, programs on USB drives, Defender hardening, and application control through WDAC with an audit review to approve from.
• A way through for legitimate installs: a request from the user’s own desktop, approved on the Devices page, or an authorization code read over the phone when the machine is offline.
• Licensed separately, per installation. More about Device lockdown