Available Steps

This page lists the package workflow steps you can add directly in the editor. For the higher-level package guide, see Packages.

Execution

Run package command

Runs a package command or installer invocation. Configure the command, interpreter, whether the step needs the staged package file, and reboot-success exit codes.

Command stdout and stderr use the endpoint agent's bounded process capture. See Agent Runtime Limits.

Package command templates can reference secret variables. The endpoint agent redacts exact known secret values from stdout, stderr, operational command-output logs, and audit command invocation logs before reporting the step result. The resolved plaintext is still available to the command while it runs.

Package commands can write logs or other diagnostics to {{ package.artifact_directory }}. {{ package.log_file }} points at the default log file inside that artifact directory.

Run script

Runs a saved endpoint script. Select a saved script and provide any parameters or output bindings it expects.

Secret script parameters are resolved at runtime. The endpoint agent redacts exact secret parameter values from stdout, stderr, operational command-output logs, and audit command invocation logs, but the plaintext is still passed to the script using the script's normal parameter delivery mode.

Run inline script

Runs inline script content inside the workflow. Set the interpreter, script content, output mode, optional output schema, output bindings, and reboot-success exit codes.

Inline package scripts follow the same endpoint-side redaction behavior as package commands: exact known secret values are redacted from agent logs and task output, but the running process can still access the plaintext value.

Inline script stdout, stderr, and cancellation follow the agent process limits.

Inline scripts can use {{ package.artifact_directory }} and {{ package.log_file }} for files that a later collect-artifact step should upload.

Control flow

End job

Ends the current endpoint target after any remaining Always workflow steps finish. Choose whether the target should finish as aborted or succeeded, and optionally add a message.

If branch

Evaluates a condition and executes either the then or else branch. Use it when later package steps should depend on earlier step results, job variables, endpoint context, or job run fields.

Build the condition in the guided grouped All / Any editor or switch to the raw expression editor if you want to write the expression directly.

Common sources are:

• steps["step-id"]... for normalized results from earlier steps
• vars.name for persistent inherited variables
• variable override state for direct endpoint overrides or effective inherited endpoint overrides
• endpoint.* for built-in endpoint context
• job.vars.* for runtime values written by earlier Set job variable steps
• job.run.* for metadata about the current job run

String conditions support equals, does not equal, contains, does not contain, is empty, and is not empty. For raw expression syntax and variable override modes, see Variables.

This keeps package workflows explicit. A typical pattern is to inspect a result, store a simplified flag in job.vars, and branch later on that value instead of repeating the same expression in multiple places.

Loops

For each

Evaluates an items expression and runs the body once per item. Set the items expression, item variable, optional index variable, and maximum iteration count, then add body steps. Replay GUI automation steps are not supported inside loop bodies. Keep GUI replay at top level or inside branches outside the loop.

While loop

Re-evaluates a condition and repeats the body until it becomes false or the maximum iterations is reached. Set the condition, optional maximum iteration count, and the body steps. Replay GUI automation steps are not supported inside loop bodies. Keep GUI replay at top level or inside branches outside the loop. The condition editor supports the same string operators and variable override checks as If branch.

Variables & data

Set job variable

Stores a runtime value under job.vars for later workflow branches and steps. Set the variable name and the expression that should populate job.vars.

Read key/value file value

Reads a key from a dotenv or INI file. Set the file path, file format, and key to read.

Write key/value file value

Sets, updates, clears, or deletes a key in a dotenv or INI file. Set the file path, file format, key, write operation, and value when you choose Set or Update existing. Update existing succeeds without writing when the file, section, or key is missing, and never creates them.

Messaging

Log message

Renders a message from the current package workflow context and stores it with the step in the job history. Use template paths such as {{ endpoint.hostname }}, {{ package.version }}, {{ job.vars.release }}, earlier step results, or loop variables to record the values used by the workflow.

The message is rendered separately for every endpoint and loop iteration. Unknown template paths are rendered as null without failing the step. Empty rendered messages are stored as [empty], output larger than 64 KiB ends with [truncated], and exact known secret values are stored as [REDACTED].

The rendered text is available in the administrative job history. The endpoint self-service portal shows the step status but not the rendered message.

Process & service management

Inspect process

Checks whether matching processes are running by name or PID and reports the matches. Choose whether to search by name or PID, then set the match mode when you use the name search.

Terminate process

Terminates one or more matching processes before or after package execution. Set the process name, match mode, force behavior, and whether child processes should be included. Use the scope setting to target the whole device, all sessions for a Windows account, or a specific Windows session ID. In self-service workflows, {{ trigger.self_service.source_session_id }} targets the session that launched the portal request.

User messages

Choice prompt

Shows a prompt on the endpoint and waits for the user to select one of the configured choices. The selected value can be stored for later package workflow branches and steps.

Choose the display target:

• All active sessions: show the prompt to every active signed-in Windows session.
• Specific Windows session ID: show the prompt only in the selected Windows session.

On Windows endpoints with multiple active sessions, choose a specific Windows session ID for choice prompts. In self-service workflows, use {{ trigger.self_service.source_session_id }} to target the session that launched the portal request.

Notification

Shows a non-blocking message on the endpoint. Notifications can auto-close after the configured duration.

Choose the display target:

• All active sessions: show the notification to every active signed-in Windows session.
• Specific Windows session ID: show the notification only in the selected Windows session.

In self-service workflows, use {{ trigger.self_service.source_session_id }} to show the notification in the session that launched the portal request.

Services

Inspect service

Checks whether the selected service exists and reports its current state. Select the service name.

Start service

Starts the selected service. Select the service name.

Stop service

Stops the selected service. Select the service name.

Restart service

Restarts the selected service. Select the service name.

Artifacts

Collect artifact

Collects files or logs as workflow artifacts. Set the artifact paths to collect.

Use {{ package.artifact_directory }} to collect files written by earlier package workflow steps, for example {{ package.artifact_directory }}\*.log.

Artifact paths also support platform environment variables. On Windows, use CMD-style variables such as %TEMP%\installer.log and %ProgramData%\Vendor\*.log. On Linux, use shell-style variables such as $TMPDIR/package.log or ${TMPDIR}/package/*.log. Variables are expanded by the agent before glob matching.

Environment-variable expansion uses the package workflow collection runtime environment. If earlier steps run under a different Windows execution context, %TEMP% may not point at that user's temp directory. Prefer {{ package.artifact_directory }} and {{ package.log_file }} for workflow logs and diagnostics that must be collected reliably.

Extract staged install archive

Downloads and extracts an attached staged install ZIP into the workflow directory. Select the staged install archive to unpack into the package workflow directory.

The archive is published only after its paths and extraction budgets pass validation. See Agent Runtime Limits for the entry, expanded-size, depth, ratio, and disk-headroom limits.

Filesystem

Inspect file

Checks whether a file exists and reports its metadata. Set the file path.

Read file

Reads a text file from the endpoint filesystem. Set the file path, and choose the encoding and read limit if needed.

Write file

Writes inline content to a file on the endpoint filesystem. Set the file path, content, encoding, overwrite behavior, and whether Ordyn should create the parent folder. Use Place file on endpoint when the source is a stored Ordyn file.

Place file on endpoint

Places a stored Ordyn file onto the endpoint filesystem. Set the target path, uploaded file, optional file name, overwrite behavior, and parent-folder handling.

Delete file

Deletes a file from the endpoint filesystem. Set the file path.

Retrieve file

Retrieves one or more files from the endpoint into Ordyn storage. Set one or more source paths and an optional archive name.

Inspect directory

Checks whether a directory exists and reports its metadata. Set the directory path.

List directory

Lists files and folders from the endpoint filesystem. Set the directory path and, if needed, recursive listing, maximum depth, and entry limits.

Create directory

Creates a directory on the endpoint filesystem. Set the directory path and whether recursive handling is allowed.

Delete directory

Deletes a directory from the endpoint filesystem. Set the directory path and whether recursive handling is allowed.

Retrieve directory

Retrieves a directory as a ZIP from the endpoint into Ordyn storage. Set the directory path and an optional archive name.

Registry

Inspect registry key

Checks whether a Windows registry key exists and reports its metadata. Set the registry hive and path.

List registry key

Lists subkeys and values under a Windows registry key. Set the registry hive and path.

Create registry key

Creates a Windows registry key if it does not exist. Set the registry hive and path.

Delete registry key

Deletes a Windows registry key, optionally recursively. Set the registry hive and path, and choose whether recursive deletion is allowed.

Inspect registry value

Checks whether a Windows registry value exists and reports its metadata. Set the registry hive, key path, and value name.

Read registry value

Reads a Windows registry value from the endpoint. Set the registry hive, key path, and value name.

Write registry value

Creates or updates a Windows registry value on the endpoint. Set the registry hive, key path, value name, value type, and value data.

Delete registry value

Deletes a Windows registry value from the endpoint. Set the registry hive, key path, and value name.

Retrieve registry key

Exports a Windows registry key into Ordyn as a .reg file. Set the registry hive, key path, and an optional file name for the export.

Automation

Wait for Windows desktop readiness

Waits until Windows setup/OOBE handoff is complete, Windows Update servicing is idle, no shutdown or restart is in progress, and either a usable desktop or a normal logon screen remains stable. A pending-reboot report is informational and does not trigger a restart or block an otherwise idle endpoint. If a reboot interrupts a generated managed-preparation wait, Ordyn retries the wait after the agent reconnects and replay protection is synchronized.

Inspect desktop session

Inspects the active Windows console session.

Desktop logon

Logs on to the active Windows desktop using the package Windows execution context. Choose the desktop logon user mode and, when needed, the Windows account to use. When you author it manually, add a matching Desktop logoff cleanup step unless the workflow intentionally leaves the user session active.

Lock desktop input

Locks local keyboard and mouse input until an unlock step or emergency PIN releases it. When you author it manually, add a matching Unlock desktop input cleanup step that runs even when replay fails.

Unlock desktop input

Releases the current Ordyn keyboard and mouse input lock.

Desktop logoff

Logs off the active Windows console session.

Replay GUI automation

Replays an uploaded Windows GUI automation definition with takeover policy and interactive session handling. Select the GUI automation definition, launch settings, and whether Ordyn should manage desktop preparation.

Manage desktop preparation is enabled by default. Ordyn surfaces the related desktop-control steps in job history so operators can see when replay setup or cleanup is happening. When an unlocked console user already exists, the replay can reuse that desktop; otherwise Ordyn bootstraps a managed login before the replay runs. Disable managed preparation only when the workflow already contains the desktop-control steps manually. Replay GUI automation is not supported inside For each or While loop bodies.

When a console user is already active, Ordyn keeps that session and uses the replay account inside it.

Step	What Ordyn does
desktop.session.readiness.wait	Waits until Windows is past setup/OOBE handoff.
desktop.session.inspect	Checks whether the active console session can be reused.
desktop.session.logon	Skipped.
desktop.input.lock	Locks the active desktop for the replay.
desktop.gui_automation.replay	Runs the GUI replay in the active console session.
desktop.session.logoff	Skipped.
desktop.input.unlock	Releases the input lock after replay cleanup.

When no unlocked console user is available, Ordyn runs the replay through a managed login.

Step	What Ordyn does
desktop.session.readiness.wait	Waits until Windows is past setup/OOBE handoff.
desktop.session.inspect	Checks whether a managed login is needed.
desktop.session.logon	Logs on the selected replay account and opens the managed desktop.
desktop.input.lock	Locks input after the managed session becomes active.
desktop.gui_automation.replay	Runs the GUI replay in the managed desktop session.
desktop.session.logoff	Logs off the managed session after replay completes.
desktop.input.unlock	Not used on this path, because the managed login cleanup releases the desktop control with logoff.

Other

Prompt user

Prompts the logged-in user and stores the selected button value under job.vars. Set the prompt title, message, buttons, default button value, target variable, and display target. For self-service workflows, use {{ trigger.self_service.source_session_id }} as the Windows session ID when the prompt should appear in the session that launched the portal request.