Ordyn

Appearance

Endpoints ​

Endpoints are devices managed by Ordyn.

Endpoints are devices that run the Ordyn agent or are enrolled into Ordyn through another service client.

Staged ​

A prepared endpoint can be created in advance before the machine has enrolled.

This is mainly used for PXE and OS install workflows.

Pending approval ​

After a successful enrollment request, an endpoint normally enters pending approval.

At that point:

  • the machine already has a certificate and can identify itself
  • Ordyn requires an operator to approve the enrollment
  • the device is visible in the pending-endpoints workflow

See Pending Endpoints for the operator review workflow.

Approved ​

Once approved, the endpoint becomes a normal active managed device and can participate fully in jobs, inventory, grouping, and automation.

When an approved agent connects to an edge node, Ordyn verifies that the endpoint is approved and that the certificate is active for that endpoint.

Endpoint certificate renewal ​

Approved agent endpoints can receive a renewed endpoint certificate from the endpoint detail page. Use Renew certificate when the endpoint needs fresh certificate material, when moving the agent to a certificate authority and edge host pair, or when replacing a certificate after a trust event.

Connected approved agents automatically request certificate renewal when their current certificate expires within 240 days.

The selected edge host must be active, connected, and compatible with the selected certificate authority. Ordyn sends a renewal instruction to the agent. The agent creates fresh certificate material, receives the renewed certificate, and reconnects through the selected edge host.

If the agent cannot authenticate or connect through the selected edge host, it keeps its current certificate and immediately reconnects through its current edge host. The endpoint page reports the failed renewal.

Suspended ​

Suspension is a reversible quarantine state for an endpoint.

When an endpoint is suspended:

  • Ordyn stops treating it as an approved job or instruction target
  • Ordyn rejects connection attempts for the agent certificate
  • an already connected agent is disconnected
  • the endpoint certificate is not revoked
  • the agent keeps retrying, so reverting the suspension lets it reconnect without local action on the device

Use suspension when you want to temporarily block a device from Ordyn without destroying its identity.

Revoked ​

Revocation is permanent trust removal for the current endpoint identity.

When an endpoint is revoked:

  • the endpoint status changes to revoked
  • active endpoint certificates are marked revoked
  • Ordyn rejects connection attempts for the revoked certificate
  • an already connected agent is disconnected
  • the revoked certificate cannot become usable again

Use revocation when the endpoint identity, certificate, or device trust is unacceptable.

Reverting suspension ​

Reverting a suspension moves the endpoint back to approved and allows the same certificate identity to connect again.

This is only possible for suspended endpoints. Revoked endpoints cannot be resumed because their certificates have been invalidated.

Revoke vs delete ​

Revoking and deleting are different operations.

Use Revoke endpoint when:

  • you want to keep the endpoint record, audit history, inventory, job history, and attachments
  • you want the current certificate identity to stop working permanently
  • you may later prepare the endpoint for reinstall or enroll it again with a fresh identity

Use Delete endpoint when:

  • you want to remove the endpoint record from Ordyn
  • you do not need the endpoint history or dependent data kept as an active record

The endpoint detail page includes a History tab for the endpoint's operational timeline, including job and step activity. See Audit And History.

Switch endpoints ​

Switch endpoints are SNMP-managed network switches.

They are created manually with kind switch, a hostname or management IP, an assigned SNMP service client, and an assigned SNMP credential profile. The hostname is the SNMP management address.

Switches do not enroll, do not have endpoint certificates, and do not establish edge connections. Their connected state comes from the assigned SNMP service client, and their active state comes from recent successful switch system status collection.

See SNMP for service-client setup, credential profiles, switch port inventory, endpoint-to-port mapping, and SNMP trap triggers.

Printer endpoints ​

Printer endpoints are SNMP-managed printers.

They are created manually with kind printer, a hostname or management IP, an assigned SNMP service client, and an assigned SNMP credential profile. The hostname is the SNMP management address.

Printers do not enroll, do not have endpoint certificates, and do not establish edge connections. Their connected state comes from the assigned SNMP service client, and their active state comes from recent successful printer system status collection.

See Printer Endpoints for setup, collected facts, automatic refresh behavior, job support, and current limitations.

Net node routing and network interfaces ​

Endpoints can have a net node, which is responsible for direct network interaction with the endpoint, such as PXE boot, Wake-on-LAN, or ICMP requests.

The effective net node is resolved in this order:

  • direct endpoint assignment
  • inherited folder assignment
  • inherited tenant assignment

Use Net node routing from an endpoint's action menu to set or clear a direct endpoint override. Folder and tenant assignments are managed from the corresponding folder or tenant views.

The endpoint overview shows the effective net node with its assignment source.

Endpoint network interfaces are the shared source for Wake-on-LAN, PXE matching, IPAM observations, switch-port matching, and net-node reachability probes.

Agent endpoint interfaces may be MAC-only, IP-only, or contain both values. MAC-only interfaces are useful for Wake-on-LAN and PXE matching. Net-node probes require an IP address.

When interface data changes, Ordyn refreshes IPAM observations, switch-port matching, PXE configuration, and the assigned net node configuration as needed.

Editing endpoints ​

Use Edit endpoint from an endpoint's action menu to change endpoint metadata.

For agent endpoints, this includes:

  • display name
  • whether the endpoint hosts Ordyn server infrastructure
  • whether the endpoint hosts an Ordyn edge service
  • the edge service hosted by that endpoint, when the edge-host role is enabled

For switch and printer endpoints, editing is limited to SNMP-managed endpoint metadata such as hostname and SNMP-related settings.

Infrastructure roles only apply to agent endpoints. Network interfaces are managed from the endpoint overview.

Display name ​

The display name is an operator-facing label.

If it is set, Ordyn can show it instead of relying only on the reported hostname. Clearing it falls back to the endpoint hostname.

Infrastructure roles ​

Infrastructure roles tell Ordyn that rebooting this endpoint can temporarily interrupt Ordyn itself or one of its ingress paths.

They are intended for hosts that run Ordyn components.

The roles are independent and can be combined on the same endpoint.

Ordyn server host ​

Enable Ordyn server host when this endpoint hosts the Ordyn server.

When a job on this endpoint triggers an automatic reboot, Ordyn gives the generated reboot recovery flow a longer infrastructure recovery window. This prevents expected server downtime during the reboot from immediately causing the endpoint job to time out.

Ordyn edge host ​

Enable Ordyn edge host when this endpoint hosts an Ordyn edge service.

When this role is enabled, select the hosted edge service.

Edge-host reboot recovery is required because rebooting the edge host can temporarily disconnect many agents and service clients at once. Ordyn treats that as expected infrastructure downtime for the rebooting endpoint.

Collectors ​

Collectors are targeted through jobs, then shown on the endpoint page with their latest values. They may be used to collect arbitrary values from endpoints and show them in Ordyn or use them in dynamic groups.

See Collectors for the endpoint collector view.

Security system status ​

The Windows system-status inventory reports Microsoft Defender, VBS, Credential Guard, Memory Integrity, LSA protection, UAC, cached logons, NTLM, Remote Desktop, and Windows Firewall posture. Microsoft Defender is inventory-only and is not managed by a configuration profile.

SMB posture is part of the same security inventory. The endpoint view shows client and server protocol availability, signing, encryption, guest logons, NTLM blocking, dialect limits, audit settings, service state, and the server invalid-authentication delay. Unsupported or unavailable values remain unknown instead of being treated as disabled.

Configuration Profiles ​

Configuration profiles keep an endpoint in a desired state. They can be assigned from tenant, folder, group, or endpoint scope pages. Each assignment selects audit or remediation behavior and can run when it becomes effective, on one or more recurring schedules, after system boot, or after Windows user logon and logoff. The endpoint view shows the effective assignment and compliance result.

See Configuration Profiles for the endpoint configuration profile view.

Windows Firewall Rules ​

Windows endpoints have a Firewall tab for maintaining their local Windows Firewall rules as a versioned policy. Rule capture is available as a job task, while checking and enforcement use a separate Windows Firewall Rules configuration profile.

See Windows Firewall Rules for policy creation, revisions, enforcement, and operational limitations.

Docker ​

The Docker tab shows Docker runtime, container, image, volume, network, and Compose-project inventory for Linux endpoints that report Docker inventory.

See Docker Inventory for Docker collection, direct container actions, and Docker Compose job steps.

Microsoft Hyper-V VMs ​

Endpoints marked as Hyper-V hosts can show a VMs tab with inventoried Microsoft Hyper-V virtual machines, guest endpoint matching, and VM power-management actions.

See Microsoft Hyper-V VMs for inventory behavior, guest endpoint identification, and power actions.