Agent Monitor

01What the monitor is

CRM: 261011-1131 · Agent: stamped at each deploy (shown on every card) · Function: relax-monitor-ingest · Updated 2026-10-11

The Server Agent Monitor gives Orbit a live health card for every client Windows server. A small PowerShell agent on each server reports every 10 minutes to an Azure Function, which saves it to SharePoint; Orbit reads SharePoint and shows one card per server.

Client server                 Azure (MCPP sub, your-resource-group)        SharePoint (your-tenant)        CRM
ReLax-Agent*.ps1 ──POST──▶   relax-monitor-ingest / agentIngest   ──Graph──▶  CRM_AgentHeartbeats  ──▶  Agent Monitor cards
(Scheduled Task, 10 min)     relax-monitor-ingest / agentDownload  ◀─ update ─  CRM_DiskAlerts             + detail modal

02What it monitors

The agent runs at idle priority (task priority 8), waits a random 0–5 minutes before each run so servers don’t report at the same second, and has a 20-minute time limit. Each check-in is a few KB; the line at the bottom of the Agent Monitor shows the measured total (about 1 MB a day per server).

03Using it in Orbit

Finding servers (top of the Agent Monitor) - 🔍 Search by domain, server name or client name. - Status badges are filters: click 🔴 Offline, 🟢 Online or 📭 without client email to show only those servers; click again (or ✕ next to the search box) for all. With nothing offline the badge shows a grey ⚪ 0 Offline. - 🆕 New this week shows servers added in the last 7 days; new cards show 🆕 Added . - Select: chips (Time sync off, Pending reboot, Failed backups, Backups 2+ days old, Stopped services, 🧱 Firewall off) show only the matching online servers and select them for the bulk-action bar (sync clock, start services, assessment, reboot). Several chips = servers with any of those problems. ✕ Clear shows all again. - 📶 Agent traffic at the bottom: the measured data all agents send per day (hover for details). - 📘 Agent guide opens this guide.

Cards and details - Cards. Each server shows Online/Offline, disks, space, backup, Defender, reboot, stopped services, uptime, OS and agent version. A server is Offline after 35 minutes without a heartbeat. - Colors. A drive under 25 % free is amber and under 15 % is red. Stopped services and disk-error banners show at the bottom of the card, including the Windows Update service is stopped banner. - Detail modal. Click a card to see every field, grouped into System, Storage, Security, Network, Services & Tasks, and Updates & Backup. - Failed logins. The card shows the 24 h count once it reaches 10 (amber) or 50 (red). The detail modal shows any non-zero count plus Targeted Accounts and Login Sources. Failed-login tickets are OFF. To enable, set the app setting FAILED_LOGIN_ALERT_THRESHOLD (for example 50). The function then opens an unassigned High ticket tagged security-monitor, once per server per day. - Disk alerts. An unhealthy disk creates a CRM_DiskAlerts row, shown on the card. Click ✔ Resolved to clear it. - Antivirus. When another antivirus (Bitdefender, SentinelOne …) runs, Defender is shown grey as passive - that is normal and is not an issue. Only “no antivirus running” is a critical item. - USB backup drive unplugged. If a server that backs up with Windows Server Backup has no USB drive plugged in, its card shows 💾 USB backup drive unplugged since (amber, red after 60 minutes). After 60 minutes the card’s Client Alert contacts get one email asking them to reconnect it (help@ on copy; help@ alone if the card has no contact), and the card adds · client emailed. Plugging a drive back in resets it. Servers that never had a USB drive, backups handled elsewhere and drives gone more than 7 days are skipped. Test mode: app setting USB_ALERT_TEST_TO. - Firewall readiness. For a server with a firewall profile off, the detail window shows 🧱 Firewall readiness (read-only): a verdict (Safe to turn on or Turning the firewall on now would block N ports), advice on the network type (Public on a domain server usually means restarting the Network Location Awareness service or setting it to Private), and a table of every listening port with the program behind it, which computers connected this week, and whether it would be allowed or blocked. Let it watch for a full week before acting. Nothing on the server is changed. (Not available on PowerShell 2.0 servers.) - Repair authorization (clients not on contract). When a non-contract server has findings, its card shows 📝 Request repair authorization. The window lists the critical and minor items in plain English as a ready-to-copy email asking the client to approve the work. Once they approve, enter who approved, the date/time and how, then click Save approval & create ticket. Orbit opens a ticket for the repair and the card shows ✅ Repair approved. - Automatic client alerts. In a server’s detail window, 📧 Client Alerts takes the client’s email address(es). From then on the system emails them from help@pnw.com when a new critical issue appears right away. Open items are repeated in the weekly server report, sent every Tuesday at 5 AM Pacific: one email per client, with a summary, per-server details, approval buttons for non-contract clients, and a box to request a change of recipients. Contract clients are told we’re monitoring it and will fix it as soon as possible if it doesn’t resolve on its own. Non-contract clients get an approval request with one-click buttons that email help@pnw.com. Every alert is saved in help@ Sent Items. Leave the address blank to turn alerts off. - Daily backup report (7 AM) and Friday drive-swap reminder (2 PM). The same Client Alert addresses get a short daily email listing every backup for the client (Windows Server Backup plus email-reported jobs such as Synology), and every Friday a reminder to swap the backup drive and take the removed one off-site. Set these per server in Client Alerts: daily report every day / only failures / off, and drive-swap reminder on / off (on by default for servers using Windows Server Backup). - Clients can see their servers in the HelpDesk. Anyone whose HelpDesk sign-in email is one of a server’s Client Alert addresses sees that server under Your Servers on helpdesk.pnw.com. They can click it for details, approve repairs, or ask a question, and either becomes a HelpDesk request. Alert emails include a link to the HelpDesk. - Contract clients: critical issues become tickets automatically as soon as they’re detected, one per issue (never duplicated). The ticket number appears in the client’s alert email, the weekly report and their HelpDesk ticket list. - Agent key (since Oct 2026). Every server has its own secret key and is locked to it (details: section 8). The detail window shows Agent Key: 🔒 Locked to this server, Added by (the tech whose new-server window let it join) and, if something was refused, Key refused with time and IP. A red “Check-in refused” line on a card means a machine tried to report as that server without its key. - Remote commands (Schedule Reboot, Sync Clock, Start Stopped Services, Run Assessment, Uninstall Agent, Reset agent key) only work from Orbit: each one is signed for that one server and logged with who asked. Typing them into the SharePoint list does nothing. The demo account cannot send them. - Remove a decommissioned server. Open the card and click 🗑 Remove server (decommissioned). This deletes the heartbeat row and the server’s disk alerts. Uninstall the agent first (section 5), or the server re-appears on its next heartbeat. The confirm box warns you if the server reported in the last 30 minutes. The button is blocked in demo mode.

04Installing on a new server

New servers are refused unless a tech allows them (since Oct 10, 2026). Do step 0 first for any server that is not yet in the Agent Monitor. Reinstalling on a server that is already listed needs no step 0.

Step 0 — allow new servers (any tech). In the Agent Monitor click ➕ Allow new servers (2 h), tick the acknowledgement (“I am installing the Re-Lax agent on a client server I support, and I am responsible for this installation”), optionally add a note (client / server), and confirm. For the next 2 hours any new server can join. Your name, the time and every server that joins are recorded in 📋 New-server log, and the server’s detail window shows Added by. If you forget step 0, the server never appears and its Application log shows event 9001 with “New servers are closed” - open a window and run the agent again.

Always download a fresh installer for each install. Since Oct 10 the installer downloads to %TEMP% and lets the agent place itself, which works with strict antivirus. A .cmd saved weeks ago can carry an old address or key and fail with “An exception occurred during a WebClient request”. Delete old copies (for example in C:\PNW) so nobody runs them by mistake.

Option A — Installer from Orbit (recommended)

1. In Orbit, click ⬇ Download Agent.

2. Client Domain: pick the client’s domain (for example contoso.com). It must match the domain in CRM_ClientDomains so the card groups under the right client.

3. Agent Endpoint URL: leave it pre-filled.

4. Click ⬇ Download Installer (.cmd). You get ReLax-Install-<domain>.cmd.

5. Copy the file to the server (through ScreenConnect, for example) and double-click it. It asks for Administrator rights, downloads the current agent from Azure, and installs it.

6. The first heartbeat arrives within about 10 minutes. To send one right away (use ReLax-Monitor.ps1 instead if the installer said so):

   powershell -ExecutionPolicy Bypass -NoProfile -File C:\ProgramData\ReLax\ReLax-Agent.ps1 -NoJitter

7. If the installer says “the scheduled task … could not be created”, see Access is denied in section 6.

Option B — Manual (elevated PowerShell)

$ep = 'https://relax-monitor-ingest-b8a3ahc5a9beaec7.westus2-01.azurewebsites.net/api/agentIngest?code=<FUNCTION-KEY>'
New-Item C:\ProgramData\ReLax -ItemType Directory -Force | Out-Null
Invoke-WebRequest ($ep -replace '/agentIngest','/agentDownload') -OutFile C:\ProgramData\ReLax\ReLax-Agent.ps1 -UseBasicParsing
& C:\ProgramData\ReLax\ReLax-Agent.ps1 -Install -ClientDomain contoso.com -Endpoint $ep
& C:\ProgramData\ReLax\ReLax-Agent.ps1 -NoJitter

To get the function key: Azure Portal → relax-monitor-ingest → Functions → agentIngest → Get function URL.

What gets installed

Requirements: Windows Server 2012 or later with PowerShell 3.0 or newer (5.1 recommended), and outbound HTTPS to *.azurewebsites.net. Servers that must stay on PowerShell 2.0 (SBS 2011 / 2008 R2 with Exchange) get the PS 2.0 edition automatically from the installer (version ends in -ps2).

Antivirus: since Oct 10 the agent avoids what strict antivirus flags: it never overwrites the script its task runs (updates are new files), sets the config file permissions in-process instead of with icacls, and new tasks have no hidden-window switch. If the antivirus still blocks the name ReLax-Agent.ps1 (seen with Bitdefender at Gascoigne Lumber), the installer saves ReLax-Monitor.ps1 instead and says so. If it removes the agent files or the scheduled task, whoever manages that antivirus should add a folder exclusion for C:\ProgramData\ReLax\ (on-access and behaviour/ATC).

05Updates (automatic)

Each heartbeat response includes latestVersion (the function’s LATEST_AGENT_VERSION). When it differs from the agent’s version, the agent downloads the new script from agentDownload and saves it as a new file ReLax-Agent-<version>.ps1 - the script the scheduled task runs is never overwritten (antivirus treats that as an attack). Every run starts in the task’s script and hands over to the newest saved version that checks out (right version inside, parses cleanly, runs on this PowerShell); if that fails it simply runs itself, so a bad file cannot stop the agent. Older versioned files are removed after each update. Event 9002 is logged. The new version runs from the next check-in.

To update a server right away, run it twice and check the files (use ReLax-Monitor.ps1 if that is the task’s script):

powershell -ExecutionPolicy Bypass -NoProfile -File C:\ProgramData\ReLax\ReLax-Agent.ps1 -NoJitter   # downloads the new version
powershell -ExecutionPolicy Bypass -NoProfile -File C:\ProgramData\ReLax\ReLax-Agent.ps1 -NoJitter   # runs it
Get-ChildItem C:\ProgramData\ReLax -Filter *.ps1 | Format-Table Name, LastWriteTime

A check-in that started just before the update can still report the old version once; the next one shows the new one.

06Uninstall / decommission

Easiest: open the card and click ⬇ Uninstall Agent (remote) - the agent removes itself (both ReLax-Monitor-Agent and a ReLax-Monitor-Agent-Temp task) on its next check-in and the card disappears.

Or on the server (elevated):

Get-ScheduledTask -TaskName 'ReLax-Monitor-Agent*' | Unregister-ScheduledTask -Confirm:$false
Remove-Item C:\ProgramData\ReLax -Recurse -Force

Then in Orbit, open the server’s card and click 🗑 Remove server (decommissioned).

07Troubleshooting

Function logs (Cloud Shell, no extra sign-in needed):

az rest --method post \
  --url "https://management.azure.com/subscriptions/8764236c-4697-493b-af2d-130bbf7bd0fa/resourceGroups/your-resource-group/providers/microsoft.insights/components/relax-monitor-ingest/query?api-version=2018-04-20" \
  --body '{"query":"traces | where timestamp > ago(30m) and message has \"[agent]\" | project timestamp, message | order by timestamp desc | take 30"}' \
  --query "tables[0].rows" -o tsv | cut -c1-160

09Security model (Oct 2026)