Available Steps

This page lists the OS image workflow steps you can add directly in the editor. For the higher-level OS image guide, see OS Images.

OS image workflows come in two flavors:

• install workflows, which run in WinPE
• upgrade workflows, which run on an already installed Windows system

The install workflow is intentionally small. The upgrade workflow exposes the broader Windows automation set.

Install workflow

Control flow

End job

Ends the current endpoint target after any remaining Always steps finish. Use it when the install should stop cleanly after a validation failure, a hard stop condition, or because no further work is required. Choose whether the target should finish as aborted or succeeded.

If branch

Evaluates a condition and runs either the then or else branch. Use it when later install steps should depend on earlier results, job variables, endpoint context, or job run fields.

Build the condition in the grouped All / Any editor or switch to raw expression mode if you prefer to write the expression directly.

Common sources are:

• steps["step-id"]... for normalized results from earlier steps
• vars.name for persistent inherited variables
• variable override state for direct endpoint overrides or effective inherited endpoint overrides
• endpoint.* for built-in endpoint context
• job.vars.* for runtime values written by earlier Set job variable steps
• job.run.* for metadata about the current job run

String conditions support equals, does not equal, contains, does not contain, is empty, and is not empty. For raw expression syntax and variable override modes, see Variables.

This keeps install workflows explicit. A common pattern is to inspect a result, store a simplified flag in job.vars, and branch later on that value instead of repeating the same expression.

For each

Iterates over an expression result and runs the body once per item. Set the items expression, item variable, optional index variable, and maximum iteration count, then add body steps.

While loop

Re-evaluates a condition and repeats the body until it becomes false or the maximum iterations is reached. Set the condition, optional maximum iteration count, and the body steps. The condition editor supports the same string operators and variable override checks as If branch.

Runtime values

Set job variable

Stores a runtime value under job.vars for later steps and branches. Set the variable name and the expression that should populate job.vars.

Messaging

Log message

Renders a message from the current install workflow context and stores it with the step in the job history. Use standard endpoint, job, earlier-step, and loop template paths to record installation context without running a command in WinPE.

The message is rendered separately for every endpoint and loop iteration. Unknown template paths are rendered as null without failing the step. Empty rendered messages are stored as [empty], output larger than 64 KiB ends with [truncated], and exact known secret values are stored as [REDACTED].

The rendered text is available in the administrative job history. The endpoint self-service portal shows the step status but not the rendered message.

Execution

Run OS image command

Runs a command in the WinPE install environment. Use it for setup checks, preparation work, or the command that launches Windows Setup. Set the command, interpreter, timeout, and any paths the command needs.

If the command uses secret variables, the resolved value is available to the command while it runs. Endpoint-agent redaction applies to exact known secret values in stdout, stderr, and agent command-output logs.

OS image install workflow commands can write logs and diagnostics to {{ os_image.artifact_directory }}. {{ os_image.log_file }} points at the default install workflow log file.

Returned command output uses the endpoint agent's bounded process capture. See Agent Runtime Limits.

Run script

Runs a saved script during the install workflow. Select the script and provide the inputs it expects.

Secret script parameters are resolved at runtime and passed using the script's normal parameter delivery mode. Exact secret parameter values are redacted from endpoint-agent stdout, stderr, and command-output logs.

Run inline script

Runs inline script content during the install workflow. Set the interpreter, script content, output mode, optional output schema, output bindings, and reboot-success exit codes.

Inline scripts follow the same endpoint-side redaction behavior: exact known secret values are redacted from agent logs and task output, but the running process can still access the plaintext value.

Inline script stdout, stderr, and cancellation follow the agent process limits.

Artifacts

Collect artifact

Collects files or logs as workflow artifacts. Set the artifact paths to collect.

Use {{ os_image.artifact_directory }} to collect files written by earlier install workflow steps, for example {{ os_image.artifact_directory }}\*.log.

Artifact paths also support platform environment variables exposed in the runtime. In WinPE, use CMD-style variables such as %TEMP%\setupact.log. Variables are expanded before glob matching.

In WinPE, variables are resolved from the WinPE provisioning runtime environment. For files produced by Ordyn workflow steps, prefer {{ os_image.artifact_directory }} and {{ os_image.log_file }} so the collect step is not coupled to machine-specific temp paths.

Upgrade workflow

Control flow

End job

Ends the current endpoint target after any remaining Always steps finish. Use it when the upgrade should stop cleanly after a validation failure, a hard stop condition, or because no further work is required. Choose whether the target should finish as aborted or succeeded.

If branch

Evaluates a condition and runs either the then or else branch. Use it when later upgrade steps should depend on earlier results, job variables, endpoint context, or job run fields.

Build the condition in the grouped All / Any editor or switch to raw expression mode if you prefer to write the expression directly.

Common sources are:

• steps["step-id"]... for normalized results from earlier steps
• vars.name for persistent inherited variables
• variable override state for direct endpoint overrides or effective inherited endpoint overrides
• endpoint.* for built-in endpoint context
• job.vars.* for runtime values written by earlier Set job variable steps
• job.run.* for metadata about the current job run

String conditions support equals, does not equal, contains, does not contain, is empty, and is not empty. For raw expression syntax and variable override modes, see Variables.

This keeps upgrade workflows explicit. A common pattern is to inspect a result, store a simplified flag in job.vars, and branch later on that value instead of repeating the same expression.

For each

Iterates over an expression result and runs the body once per item. Set the items expression, item variable, optional index variable, and maximum iteration count, then add body steps.

While loop

Re-evaluates a condition and repeats the body until it becomes false or the maximum iterations is reached. Set the condition, optional maximum iteration count, and the body steps. The condition editor supports the same string operators and variable override checks as If branch.

Runtime values

Set job variable

Stores a runtime value under job.vars for later steps and branches. Set the variable name and the expression that should populate job.vars.

Messaging

Log message

Renders a message from the current upgrade workflow context and stores it with the step in the job history. Use standard endpoint, job, earlier-step, and loop template paths to record upgrade context without running a command on the endpoint.

The message is rendered separately for every endpoint and loop iteration. Unknown template paths are rendered as null without failing the step. Empty rendered messages are stored as [empty], output larger than 64 KiB ends with [truncated], and exact known secret values are stored as [REDACTED].

The rendered text is available in the administrative job history. The endpoint self-service portal shows the step status but not the rendered message.

Execution

Run OS image command

Runs an OS image command in the Windows upgrade context.

Returned command output uses the endpoint agent's bounded process capture. See Agent Runtime Limits. Use it for the upgrade command itself and any supporting command-line work around the in-place upgrade flow. Set the command, interpreter, timeout, and any paths the command needs.

If the command uses secret variables, the resolved value is available to the command while it runs. Endpoint-agent redaction applies to exact known secret values in stdout, stderr, and agent command-output logs.

Run script

Runs a saved script during the upgrade workflow. Select the script and provide the inputs it expects.

Secret script parameters are resolved at runtime and passed using the script's normal parameter delivery mode. Exact secret parameter values are redacted from endpoint-agent stdout, stderr, and command-output logs.

Run inline script

Runs inline script content during the upgrade workflow. Set the interpreter, script content, output mode, optional output schema, output bindings, and reboot-success exit codes.

Inline scripts follow the same endpoint-side redaction behavior: exact known secret values are redacted from agent logs and task output, but the running process can still access the plaintext value.

Inline script stdout, stderr, and cancellation follow the agent process limits.

Processes

Inspect process

Checks whether matching processes are running by name or PID and reports the matches. Choose whether to search by name or PID, then set the match mode when you use the name search.

Terminate process

Terminates one or more matching processes before or after upgrade execution. Set the process name, match mode, force behavior, and whether child processes should be included. Use the scope setting to target the whole device, all sessions for a Windows account, or a specific Windows session ID. In self-service workflows, {{ trigger.self_service.source_session_id }} targets the session that launched the portal request.

User messages

Notification

Shows a non-blocking message on the endpoint during an OS image workflow. Notifications can auto-close after the configured duration.

Choose the display target:

• All active sessions: show the notification to every active signed-in Windows session.
• Specific Windows session ID: show the notification only in the selected Windows session.

In self-service workflows, use {{ trigger.self_service.source_session_id }} to show the notification in the session that launched the portal request.

Services

Inspect service

Checks whether the selected service exists and reports its current state. Select the service name.

Start service

Starts the selected service. Select the service name.

Stop service

Stops the selected service. Select the service name.

Restart service

Restarts the selected service. Select the service name.

Configuration

Read key/value file value

Reads a key from a dotenv or INI file. Set the file path, file format, and key to read.

Write key/value file value

Sets, updates, clears, or deletes a key in a dotenv or INI file. Set the file path, file format, key, write operation, and value when you choose Set or Update existing. Update existing succeeds without writing when the file, section, or key is missing, and never creates them.

Filesystem

Inspect file

Checks whether a file exists and reports its metadata. Set the file path.

Read file

Reads a text file from the endpoint filesystem. Set the file path, and choose the encoding and read limit if needed.

Write file

Writes inline content to a file on the endpoint filesystem. Set the file path, content, encoding, overwrite behavior, and whether Ordyn should create the parent folder. Use Place file on endpoint when the source is a stored Ordyn file.

Place file on endpoint

Places a stored Ordyn file onto the endpoint filesystem. Set the target path, uploaded file, optional file name, overwrite behavior, and parent-folder handling.

Delete file

Deletes a file from the endpoint filesystem. Set the file path.

Retrieve file

Retrieves one or more files from the endpoint into Ordyn storage. Set one or more source paths and an optional archive name.

Inspect directory

Checks whether a directory exists and reports its metadata. Set the directory path.

List directory

Lists files and folders from the endpoint filesystem. Set the directory path and, if needed, recursive listing, maximum depth, and entry limits.

Create directory

Creates a directory on the endpoint filesystem. Set the directory path and whether recursive handling is allowed.

Delete directory

Deletes a directory from the endpoint filesystem. Set the directory path and whether recursive handling is allowed.

Retrieve directory

Retrieves a directory as a ZIP from the endpoint into Ordyn storage. Set the directory path and an optional archive name.

Registry

Inspect registry key

Checks whether a Windows registry key exists and reports its metadata. Set the registry hive and path.

List registry key

Lists subkeys and values under a Windows registry key. Set the registry hive and path.

Create registry key

Creates a Windows registry key if it does not exist. Set the registry hive and path.

Delete registry key

Deletes a Windows registry key, optionally recursively. Set the registry hive and path, and choose whether recursive deletion is allowed.

Inspect registry value

Checks whether a Windows registry value exists and reports its metadata. Set the registry hive, key path, and value name.

Read registry value

Reads a Windows registry value from the endpoint. Set the registry hive, key path, and value name.

Write registry value

Creates or updates a Windows registry value on the endpoint. Set the registry hive, key path, value name, value type, and value data.

Delete registry value

Deletes a Windows registry value from the endpoint. Set the registry hive, key path, and value name.

Retrieve registry key

Exports a Windows registry key into Ordyn as a .reg file. Set the registry hive, key path, and an optional file name for the export.

Artifacts

Collect artifact

Collects files or logs as workflow artifacts. Set the artifact paths to collect.