From inventory to remote action, one panel
For small IT teams carrying the whole company, whether you look after everything on your own or as one of a few people in a large business. Every EndpointGuard module works together to make your Windows fleet visible and manageable; below, each one in detail and which plan includes it.
Who it is for
Small IT teams carrying the whole company
One person or a handful of people looking after hundreds of computers, including the only IT person in a large business. Inventory, licenses and security status stay current without being collected by hand.
Small and mid-sized manufacturers
Office PCs, shop-floor stations and older Windows versions side by side. The agent runs on Windows 7 SP1 too, and you can turn off USB storage from the panel.
IT service providers (MSPs)
Manage your clients from your own account with the access they grant you. Every action you take is logged where the client can see it.
Software & hardware inventory
The agent reads every installed application and its version directly from the registry (Win32_Product is never used — that WMI class triggers an MSI consistency check on every query, which can take minutes and floods the event log). CPU, RAM, disk type (SSD/HDD via real detection, not the manufacturer label) and network components are collected per device.
The Windows license type (OEM/Retail/Volume) is detected from the machine's actual licensing source; the product key itself is never logged. A full inventory is only re-sent when something actually changed (hash comparison) — no bandwidth or server load wasted on unchanged machines.
- Registry-based software scan (32/64-bit + all user profiles)
- CPU/RAM/disk with real SSD/HDD detection
- Windows license type and OEM/Retail/VL source
- No re-send unless something changed
Extended inventory
On top of core inventory, 8 separate sections are added: security status (AV/firewall/BitLocker), accounts, runtime, network, hardware detail, usage/events, extended software (including browser extensions), and USB history. Each section has its own collection period and its own change hash — a section that changes often (e.g. security status) never forces the others to re-sync.
The panel derives automatic attention flags from this data: an outdated antivirus signature, BitLocker turned off, a disk over 90% full, a newly added local administrator. These surface directly on the device card and the dashboard.
- Security status, accounts, runtime, network, hardware detail, usage, USB history
- Separate period and change hash per section
- Automatic attention flags (old signature, BitLocker off, full disk...)
- Personal file names or browsing history are NEVER collected
Remote actions
Restart a device, turn USB storage on or off, or force an immediate inventory refresh — all from the panel, in seconds. Before a restart, an unclosable, branded warning appears on the user's screen (you choose a 1–15 minute countdown), and the action can be cancelled from the panel.
Every command is signed server-side as single-use (ECDSA P-256); the agent only knows the public key and refuses any command whose signature does not hold. The panel never sends free-text commands — only a fixed command type is selected, so even a compromised deployment cannot become a tool for running arbitrary code.
- Restart (unclosable warning, cancellable countdown)
- Turn USB storage on/off
- Force an instant inventory refresh
- Signed, single-use commands — no free-text commands
Device groups and batch commands
Sort devices into groups such as "Warehouse terminals" or "Field laptops"; a device can belong to more than one group. Groups are kept apart from tags and departments because they do a different job: a group is the list of machines you send a command to together. An account can have up to 50 groups.
Turn USB storage off or on, send a restart or force an inventory refresh on a whole group, or on devices you pick from the list, in one go, with up to 200 devices per request. The confirmation dialog shows how many devices are affected and the first 10 names, and you type the group name (or the device count for a selection) to confirm. The command stays valid for 24 hours, so a computer that was switched off picks it up when it comes back. Every device gets its own signed command, and the result screen shows which machines ran it, which are still waiting and which expired.
- Turn USB storage off/on, restart, refresh inventory
- Up to 200 devices per request, valid for 24 hours
- Affected-device count and typed confirmation
- Per-device result: done, failed, offline, expired
Email notifications
Get an email when a device has not checked in for 15, 30 or 60 minutes or 4 hours, when a volume is more than 90% full, when BitLocker, antivirus or the firewall is turned off, when new USB storage activity shows up on a computer (delayed, because it follows the inventory interval), when a new device joins the account, when a batch command finishes, when an IP Pinger target stops answering, or when a new ticket comes in from the support form. Each rule is switched on and off on its own and has its own recipients, who can be users on your team or outside addresses.
A rule sends instantly or as a daily summary, which arrives at 08:00 in your organisation's time zone. The offline, disk, BitLocker, security and IP Pinger rules also send a "resolved" email once the problem is gone. You get at most one alert per device and rule per hour. Switching a rule on sends nothing about devices that already had the problem; only later changes are reported. Free allows 1 recipient per rule, the other plans 10.
- 9 rules: offline, disk, BitLocker, antivirus/firewall, USB, new device, batch command, IP Pinger, support ticket
- Instant or daily summary (08:00, in your time zone)
- "Resolved" email when the problem clears
- At most one alert per device and rule per hour
End-user support form
Your staff send a support request from a link that belongs to your company, without creating an account. Put the link on the intranet or print the QR code and pin it up. Name, email, subject and description are required; phone, computer name and up to 3 attachments (10 MB each) are optional. If the computer name matches exactly one device in the inventory, the ticket is linked to that device.
The form is protected by Cloudflare Turnstile and accepts 5 requests per hour per IP and 100 per day per organisation. You can accept addresses from your own domains only (up to 10 domains) or have a 6-digit code sent to the address before the request goes through. The requester gets the ticket number and a single-use tracking link by email; every reply from your team brings a new link, and the requester answers from the same page. Your internal notes are never shown to them.
- No sign-in, a company-specific link and QR code
- Turnstile, allowed email domains, optional verification code
- Email to the requester with a single-use reply link
- Ticket linked to the device by computer name
Security policies
Turn USB storage and AutoRun/AutoPlay behavior on or off per device. The panel first reads the device's ACTUAL state, then shows a single state-aware button — you never have to guess which direction it will go.
Every policy change is written to the device's change history, along with who made it and when. This module is designed to share the same "what is this device allowed to do" screen with application control (block/allow-listing), planned for a later session.
- USB storage on/off
- AutoRun / AutoPlay on/off
- No button is shown until the state is known
- Every change is recorded in history
Change history
Every inventory cycle is compared against the previous state, and only REAL changes are recorded: software installed/removed/updated (matched by product identity — even when a version number is embedded in the name, "PuTTY 0.84" and "PuTTY 0.80" are recognized as the same product), hardware/security field changes, a disk added or removed.
The very first inventory does NOT create 200 lines of "everything was added" noise — a single "baseline" entry is recorded instead. If a license key changes, it is flagged as an event, but the value itself is never written to history.
- Software install/remove/version update (matched by product identity)
- Hardware and security field changes
- Disk added/removed
- The license key value is never written to history
Reports
Ready-made templates for device inventory, software inventory, offline devices, OS licenses, disk health, changes, security posture, USB storage, local administrators, support tickets and IP Pinger SLA. Every report has filters, column choice and sorting; with the device group filter you report only on the machines in a group such as "Production line".
Keep the filters you use often as a saved report and run it again in one click. Download the result as CSV, Excel (XLSX) or a PDF with your organisation's name on it. License keys are masked in the output; an unmasked export needs a separate confirmation and is logged.
- 11 ready-made templates, filters, column choice, sorting
- Device group and device filters
- Saved reports
- CSV, XLSX and PDF export
Personnel, department and tags
Assign devices to a person from a personnel catalog (the same person can own several devices); a device's department is either inherited from the assigned person or set directly. Tags (up to 50, colored) are a separate catalog for freely classifying devices — not to be confused with department.
Who can see the assigned person's email/phone (admin only / admin+operator / everyone) is a rule the org admin sets for KVKK/GDPR reasons; the person's NAME is always visible regardless of that rule.
- Personnel catalog — one person can own multiple devices
- Department (independent of tags, the device's org unit)
- Colored tags (up to 50 per tenant)
- Role-based contact-info visibility (GDPR/KVKK)
First sign-in wizard
When you sign up on the site, the panel greets you with three short steps: add your first device (the install command and download link are ready), invite a colleague, turn on two-factor authentication. A step is ticked off by itself once you have done it.
You can skip any step, close the wizard with "Later" and come back, or choose "Don't show again". While there are no devices yet, empty screens say in one sentence what to do and show the button for it.
- Three steps: add a device, invite a colleague, 2FA
- Steps complete themselves
- Skip, Later, Don't show again
- Guidance and an action button on empty screens
Reseller & MSP delegation
As the owner of your data, you grant your IT service provider (MSP) view-only or manage access, logged and revocable at any moment. The granting party is ALWAYS the customer — an MSP can request access, but it only opens with your approval.
Decisions like user management, plan/billing, privacy settings and the enrollment token can NEVER be reached through delegation — those always stay with your own admin. A clear banner is shown whenever the panel is operating on another customer's behalf.
- Scope: view-only or manage, you choose
- Revocable instantly, every action is logged
- User/plan/privacy management cannot be delegated
- A separate reseller portal — commercial view only, NO inventory
Two-factor authentication
Users can add an optional second layer to their account with an authenticator app (TOTP); the org admin can make it mandatory for ALL users. 8 backup codes are shown once, at setup.
Password resets NEVER skip or remove the second factor — a stolen mailbox alone is never enough. In the vendor admin panel, two-factor authentication is always mandatory.
- TOTP via authenticator app (6-digit code)
- Can be enforced organization-wide
- 8 single-use backup codes
- Password reset never bypasses 2FA
GDPR/KVKK-minded data boundaries
Personal file names, browsing history, Wi-Fi passwords, passwords or email content never enter any inventory section. Account information is stored only as an ACCOUNT NAME — never a real name or email. "Blank password" status is learned from the OS's own flag, never by attempting a password.
License keys are encrypted at the application layer with AES-256-GCM; every time one is decrypted and shown, it is logged. Visibility of an assigned person's contact info can be role-restricted. Resellers/MSPs cannot see your inventory by default at all.
- Personal file names/browsing history/passwords are NEVER collected
- License keys encrypted with AES-256-GCM, every reveal is logged
- Assigned-contact info can be role-restricted
- Resellers/MSPs cannot see inventory by default
IP Pinger — 10 targets free, more with the cloud
IP Pinger is a desktop app that monitors your servers, printers and network devices over ICMP — no administrator rights needed. It shows status as green/yellow/red and charts latency and loss.
In Free mode, the license you receive by email lets you monitor up to 10 targets. Link it to your EndpointGuard account (Cloud mode) and targets, history and events appear in the panel, with the target limit set by your plan.
Desktop app: target list and latency/loss chart
Panel: targets across all installations, uptime and last-hour charts
Panel: target detail — latency, loss and events
Free mode vs. Cloud mode
| Free mode | Cloud mode | |
|---|---|---|
| What you need | A free license by email | An EndpointGuard account (link code) |
| Monitored targets | Up to 10 | By your plan (Free 10, Pro 100, Business unlimited) |
| History | Local, on this computer | In the panel: Free 7 / Pro 90 / Business 365 days |
| In the panel | — | Targets, charts, events, groups |
| Multiple installations | No | Yes — combined in one panel |
IP Pinger 2.2: monitoring by name, DNS pools, self-update
When you add a target by name instead of IP, IP Pinger resolves every address behind the name, pings each one three times and picks the closest one that answers: same subnet first, then private, then public, with the lowest latency breaking ties. The chosen address is kept for as long as it answers, so the app does not flip between equivalent addresses and report changes that are not real. When the address really changes, an "IP changed" event is logged, and it does not count as an outage.
- A name that returns 4 or more different addresses within an hour (a CDN or load balancer) is marked as a DNS pool; IP changes inside a pool do not create events. The addresses seen can be searched and copied in a separate window.
- "Name not resolved" and "No reply" are separate states: the first is a DNS problem, the second is the device itself.
- In Cloud mode, a target whose name matches a computer in the inventory shows that device and the IP its agent reports; if the pinged address is not one of the device's addresses, a yellow warning appears.
- Updates come from inside the app: it checks once a day, and the download is verified by SHA-256 hash, Authenticode signature and publisher name before it installs in place. A check box under Settings → Updates also offers beta versions.
- Columns fit the window width and a column you resize by hand keeps its width; a check box on the last setup screen starts the app right away.
DNS pool: addresses seen in the last 24 hours, with search and copy
Download IP Pinger — 10 targets free User guide Release notes
Roadmap
These are planned, not yet shipped. We are not committing to dates; we are building them in sequence.
Network devices
Inventory for switches/routers and backups of their running configuration.
Application control
Process-level blocklisting first, extending to Windows WDAC allow-listing.
Support tray app
A tray icon your staff click to open a support request with the computer name already filled in.
Remote desktop
A direct remote-desktop connection from the panel. Today you can connect from a support ticket with a RustDesk ID.
Frequently asked questions
Which operating systems does EndpointGuard support?
The agent supports Windows 7 SP1 and later (32 and 64 bit). It installs silently from a single MSI, manually or through Group Policy.
What data is collected from devices?
Installed software, operating system, hardware, security status and local account names. Personal file names, browsing history, Wi-Fi passwords and password values are never collected.
What can I do to devices remotely?
You can enable or disable USB storage, restart a device with an on-screen warning, force an instant inventory refresh and uninstall software. Remote actions are part of the paid plans.
Are remote commands secure?
Every command is signed on the server and the agent runs nothing whose signature cannot be verified. Commands expire and run only once; there are no free-text commands.
Can my reseller or IT provider see my data?
Not by default. You can grant view or manage access with a scope and duration you choose, revoke it at any time, and every action is logged.
Is two-factor authentication available?
Yes. It is optional for panel users and an organization admin can require it for everyone.