SWARM – Help & User Guide

What is SWARM?

SWARM (Secure Workplace Asset Remote Management) is the operator console used to monitor endpoints, manage assets, launch diagnostics, and orchestrate General Service and System Prep workflows.

The platform is built around explicit operator actions. SWARM publishes queue files and settings, the endpoint agents poll for work, and progress flows back into SWARM for reporting, HaloPSA updates, and operator review.

• Systems, diagnostics, and assets in one console
• General Service and System Prep orchestration from the operator UI
• HaloPSA-aware ticketing and progress-note workflows
• Low-touch agent polling rather than always-on remote control

New to SWARM? Read the Onboarding Guide — it covers sign-in, the dashboard, every automation workflow, and admin tasks in one place.

Dashboard Layout

The main SWARM console is split into a left operational pane and a right details pane.

• Header: branding, installer link, help link, live summary badge, theme toggle, refresh, current user, logout, and settings
• Quick-service strip: coloured shortcut bubbles for Microsoft and other operator portals
• Search/report row: view toggle, sorting, global search, clear button, and report exports
• Left pane: Systems / Printers / Networks / Mobile tabs, summary pills, and the system list or card view
• Right pane: system details, diagnostics controls, edit mode, and bottom-of-pane actions such as uninstall

General Service and System Prep selection currently depend on the Systems list view checkbox column. Card view remains useful for review, but not for service batching.

Quick Service Buttons

The quick-service strip near the top of the dashboard gives fast access to operator portals and tools.

• Most quick-service buttons open their configured URL in a new browser tab.
• The Microsoft button uses the local SWARM Browser Helper so admin.microsoft.com opens in a private browser window.
• The order of the bubbles is controlled in Settings → Suppliers.

• Microsoft
• PAX8
• uSecure
• BlackPoint
• SentinelOne (PAX8)

Microsoft Quick Link

• Click Microsoft.
• SWARM attempts to hand off to the local swamhelper:// protocol handler.
• If the helper is installed and current, Microsoft Admin opens privately.
• If the helper is missing or outdated, SWARM prompts you to download or update it.

Editing Service Buttons

• Open Settings → Suppliers.
• Add, edit, or remove service rows.
• Drag and drop rows to control the bubble order in the dashboard.

Servicing Drawer

General Service, Recurring Service, and System Prep are now managed from the dedicated Servicing side drawer rather than the old Settings → General workflow.

• The drawer opens from the quick-service row and contains separate tabs for General Service, Recurring Service, and Sys Prep.
• It reuses the current Systems list-view selection.
• Saved defaults such as the reboot threshold and System Prep checklist are now stored from this drawer.
• The Settings → General area now acts as a handoff into the drawer rather than hosting the automation controls directly.
• A Hardening Report button at the bottom of the drawer opens a modal that summarises recent blocked-task classifications across General Service and System Prep runs. The report shows top blocker codes, recent examples, recommendation themes, and a ready-to-copy GPT developer prompt for feeding signals back into the engineering backlog.

General Service

General Service is SWARM’s managed maintenance workflow for endpoint review, cleanup, update work, and safe remediation.

• SWARM creates and tracks one service run per endpoint.
• The queue is published to service.txt.
• The endpoint agent picks up the queue on its 5-minute control poll.
• Progress events flow back into SWARM and can create HaloPSA updates server-side.
• Only one active General Service run can exist per endpoint at a time.

Queueing a General Service Run

• Open the Systems tab and switch to List View.
• Tick one or more systems in the selection column.
• Open the Servicing drawer and go to the General Service tab.
• Confirm the selected system count.
• Optionally enable Exclude serviced systems to skip selected systems that completed General Service or System Prep in the last 31 days.
• Choose start now or set a specific scheduled time.
• Optionally enable Reboot before service.
• Optionally enable Reboot as needed to allow planned mid-service restart-and-resume behavior.
• Click Queue General Service.

Reboot Options

• Reboot before service uses the saved reboot-threshold-in-days setting to decide whether the pre-service reboot workflow is required.
• Reboot as needed allows the launcher to perform planned restarts during the task flow and resume automatically after boot. Required for Windows Update installs that need a reboot before the next patch round can proceed.
• If a timed General Service run is missed and either reboot option is enabled, the endpoint waits for the next matching scheduled time instead of starting immediately on the next boot.
• If no reboot option is enabled, an overdue timed run can still start on the next boot/poll.

Run Lifecycle

• Queued – the run is published and waiting to be picked up
• Awaiting Window – the run is waiting for its scheduled time
• Awaiting Reboot Confirmation – the pre-service reboot prompt is active
• Postponed – a user postponed the reboot window
• Rebooting – the endpoint is restarting for service
• Awaiting Task Execution – reboot handling is complete and task execution is next
• Running – the task flow is active
• Completed / Failed / Cancelled / Timed Out – the run is closed

What Windows General Service Currently Covers

The Windows task flow runs 33 tasks in the following order. The sequence is deliberate: pre-patch preparation runs first to ensure disk space, a clean DNS cache, and freed temp space before any patching or repair begins. Cleanup and optimisation follow patching. HP firmware updates run after the cleanup block so disk space freed by cleanup is available for HPIA pack downloads.

Pre-patch preparation

• Power Plan Review (enforces High Performance plan and AC sleep/hibernate baseline before any long-running work)
• Pending Reboot Detection (gates further work; schedules or defers reboot as required by policy)
• SentinelOne Health Check (confirms endpoint protection status; attempts service restart if not running)
• Disk Space Review (reports free space on all internal drives; flags low-space conditions before patching begins)
• Temporary File Cleanup (frees temp space before patch downloads — helps low-disk endpoints)
• DNS Cache Flush (clears stale DNS before Windows Update server resolution)
• System File Integrity Check (DISM CheckHealth → RestoreHealth if repairable → SFC verifyonly → SFC scannow only if violations found)

Patching lane

• Windows Update Service Health Check (verifies wuauserv, BITS, UsoSvc; attempts restart if stopped)
• Windows Update Scan Readiness Review
• Windows and Microsoft Update Remediation (installs available updates; may reboot and resume multiple rounds with Reboot as Needed)
• Microsoft 365 Apps Update (triggers M365 Click-to-Run update channel)
• WinGet Third-Party Update Remediation (updates managed third-party applications)

Post-patch cleanup

• Post-Patch Cleanup and Space Recovery (DISM StartComponentCleanup; recycle bin; recovers space after patching)
• Windows Update Cache Cleanup
• Delivery Optimization Cache Cleanup (removes stale peer-download cache)
• Temporary Internet Files Cleanup
• Browser Cache Cleanup
• Temporary User Profile and Installer Cleanup
• Windows Upgrade Remnant Cleanup (removes old Windows.old and upgrade staging folders)
• Memory Dump Cleanup (removes aged crash dump files)
• Old Driver Package Cleanup
• Windows Error Reporting Cleanup

Health, optimisation, and firmware

• Storage TRIM Health Check
• Notebook Battery Health Check (laptops only — measured health vs design capacity)
• Automatic Network Optimization
• HP Driver Update (HP endpoints only — HPIA Drivers category; skipped automatically on non-HP hardware)
• HP BIOS Update (HP endpoints on AC power only — suspends BitLocker for one reboot; skipped on battery or non-HP)
• SysMain Optimization Scheduling
• Windows Search Index Health Check

Audit and review

• Event Log Cleanup
• User Account Inventory Review
• Account Security Review
• Event Log Review (runs last — captures the full picture including any events generated during servicing)

HaloPSA Behavior

• Queue creation makes a best-effort attempt to open the Halo ticket.
• SWARM, not the endpoint, posts Halo progress notes and completion entries.
• Task-level progress notes are technician-only.
• The final customer-facing completion note now shows only positive completed outcomes.
• If follow-up remains, SWARM posts a hidden technician note plus a technician review email labelled Pending Technician Checks.

Monitoring and Cancelling Runs

The General Service tab in the Servicing drawer also acts as the run manager.

• Use Refresh to reload current run data.
• The list defaults to active runs, with an option to reveal recent closed runs.
• Cancelled runs in the closed list include Resume, which republishes the same run when a cancellation was accidental.
• If an active run stops reporting progress, SWARM posts technician-only warnings every 12 hours with the total disconnected time and countdown to the 72-hour terminator.
• At 72 hours, SWARM finalises the Halo ticket with General Service terminated following disconnection timeout of x hours.
• Use Cancel & Submit Ticket under an active job's Cancel button to trigger the same timeout finalisation before the automatic 72-hour tombstone.
• Cancel actions republish service.txt immediately.
• The next agent control poll removes cancelled or timeout-finalised work from the endpoint queue.

macOS General Service

macOS endpoints run a separate conservative General Service workflow. The Mac launcher (general-service.sh) covers review-only and safe maintenance tasks — it does not install OS updates, change firewall or remote-access state, delete user data, or manage MDM enrollment.

• macOS General Service is queued the same way as Windows — select the endpoint in list view and use the Servicing drawer.
• Progress events and Halo updates follow the same lifecycle as Windows runs.
• Tasks that are not applicable to the hardware (e.g. battery review on a desktop Mac) are skipped automatically.

What macOS General Service Currently Covers

• Startup Disk Space Review
• RAM Usage Review
• CPU Load Review
• Running Processes Inventory
• Startup Items Review
• Network Interface Review
• Storage SMART Health Review (skipped if macOS reports no actionable startup-disk status)
• Notebook Battery Health Review (skipped on desktop Macs)
• DNS Cache Flush
• Safe Cache Cleanup (conservative system temp locations only — no user browser or profile caches)
• Local Account Inventory Review
• Firewall and Remote Access Review (review only — does not change state)
• System Log Review

Recurring Service

Recurring Service creates an ongoing company-level General Service schedule rather than a one-off queue item.

• Open the Servicing drawer and switch to Recurring Service.
• Select a company, recurrence interval, optional next-run time, and reboot policy.
• SWARM builds a live company system list and stores only the excluded systems, not a fixed endpoint snapshot.
• New systems added to that company later are included automatically unless they are excluded.
• When a recurring schedule becomes due, SWARM materializes normal endpoint runs and preserves the schedule time in those runs.

System Prep

System Prep is SWARM’s Windows onboarding and setup workflow. It is managed separately from General Service, but can automatically hand off into a follow-up General Service baseline run when prep completes successfully.

• Open the Servicing drawer and switch to Sys Prep.
• Select one or more systems in the Systems list view first.
• Choose the prep checklist options and the PDF client (Foxit by default, Adobe optional).
• Queueing publishes the prep queue to prep.txt.
• The Windows agent polls prep.txt every 5 minutes, downloads the signed prep launcher, and executes the selected tasks.

• SWARM opens a Halo ticket for the prep run at queue time.
• Selected prep tasks post technician-only Halo entries.
• Successful prep completion posts one visible non-billable customer-facing entry.
• SWARM then automatically queues the follow-up General Service run into the same Halo ticket.

macOS TeamViewer Push

TeamViewer Host can be pushed to macOS endpoints directly from SWARM_DOT_SENTINEL. This is the primary remote-access deployment workflow for Mac machines — full System Prep is not available on macOS.

• Select a macOS endpoint in the Systems list view.
• Open the details pane and click Push TeamViewer.
• SWARM queues the push and publishes it to prep.txt.
• The Mac agent downloads and installs TeamViewer Host from the IN2Tech custom TeamViewer permalink.
• After installation, the agent prompts the logged-in customer to manually approve Screen Recording, Accessibility, and Full Disk Access in System Settings.
• SWARM posts System Prep lifecycle events and a Halo completion entry for the run.

• TeamViewer push is blocked if a General Service or System Prep run is already active on the same endpoint.
• Windows endpoints continue to use the standard System Prep workflow for TeamViewer deployment.

Running Diagnostics

Diagnostics are operator-requested and agent-driven. They are not pushed instantly to the endpoint.

• Select a system in the right-hand details workflow.
• Click Run Diagnostics.
• Choose the duration and start the run.
• SWARM publishes the request immediately.
• The endpoint picks it up on the next agent run.
• The first data packet usually arrives around 2 minutes later, then continues at 2-minute intervals until complete.

Resetting and Clearing Diagnostics

• Reset Diagnostics removes existing diagnostic results and returns the panel to a clean state.
• Clear Diagnostics resets a run that became stuck because the final completion packet never arrived.
• Diagnostics do not resume automatically after an interruption such as a shutdown or reboot.

Remote Agent Uninstall

The uninstall action at the bottom of the details pane schedules agent removal from the endpoint.

• There is a short cool-off period where the request can still be cancelled.
• SWARM publishes the uninstall request to the hosted uninstall control file.
• The agent performs the uninstall on its next run after the request becomes eligible.
• Endpoint tasks, files, and agent components are removed.
• The endpoint disappears from the console after uninstall and ingest state clears.

System Management

Endpoint Capability Strip

The details pane shows a compact capability strip below the system header. It classifies what automation workflows are available for the selected endpoint based on its detected platform and current state.

• Available — the workflow can be queued normally.
• Review — the workflow may be queued but has limitations (e.g. unknown platform identity).
• Unavailable — the workflow is blocked for this endpoint type, with a reason shown on hover.

Covered capabilities: Diagnostics, General Service, System Prep, and TeamViewer Push. Use this strip to confirm at a glance whether macOS-specific restrictions apply before queueing work.

Last General Service Date

The General tab in the details pane shows a Last General Service date. This is set automatically when a General Service or System Prep run posts a successful completion event. It reflects the Australia/Sydney completion date and is not editable.

Editing System Details

• Select a system and click Edit in the details pane.
• Editable fields include company, description, notes, tags, and health exclusions.
• The company field uses the shared SWARM company registry rather than free-text entry.
• Saving exits edit mode and refresh resumes normally afterward.

Deleting a System

Use Edit → Delete System to remove the record from the console only.

Health Exclusions

Use exclusions only for conditions the team intentionally accepts and does not plan to remediate. Do not use exclusions simply to clear a system from red or amber.

• Antivirus
• Uptime
• CPU
• Memory
• Disk

Search, Filters & Views

SWARM search is powerful and intuitive. You can combine words and phrases to narrow results quickly.

• Multiple plain words use AND logic.
• Quoted phrases search exact text, for example "Windows 11 Pro".
• The word or can be used to build alternate matches.
• The same search bar also works across the non-system asset tabs using substring matching across their configured columns.

Systems can be viewed in list or card mode. Bulk General Service and System Prep selection currently exists only in list view.

Exports & Reports

Use the Reports menu to export the currently relevant data from the operator console.

• CSV exports are available for systems and status-based views.
• SWARM also supports XLSX exports, including multi-sheet details exports that can include systems plus printer, network, and mobile asset sheets.
• Visible/filtered console state drives the export content, so filter first if you want a company-specific output.
• Admin users can also configure and trigger the daily HTML executive report from the Admin settings area.

Essential 8

SWARM supports Essential Eight evidence workflows for clients with the company-level Essential 8 checkbox enabled. The current hardening workflow targets Maturity Level 1 requirements for Microsoft Office macro restrictions and user application hardening.

When to Enable It

• Open a client endpoint from the company.
• Open the subscription popover and tick Essential 8.
• Select the SentinelOne console if Application Monitor evidence is also being used.
• Save the subscription settings.

ML1 Hardening Scope

• Office macros are disabled for users without a demonstrated business requirement.
• Office macros from internet-origin files are blocked.
• Office macro runtime antivirus scanning is enabled.
• Office macro security settings are locked by policy.
• Internet Explorer 11 is disabled or removed.
• Browsers do not process Java from the internet.
• Browsers do not process web advertisements from the internet.
• Browser security settings cannot be changed by users.

Deployment Approach

• For domain clients, use a GPO first. SWARM provides the GPO pack content and verifies endpoint state after policy applies.
• For Intune-managed clients, let Intune remain authoritative and use SWARM for verification and reporting.
• For small non-domain clients, use SWARM local policy only after report-only assessment and explicit approval.
• For Action1 patch management, save the company-specific MSI under /data/installers/action1 or the configured SWAM_ACTION1_INSTALLER_DIR. SWARM matches the MSI to the selected Essential 8 client and stages it into the approved package runner when deployed.
• Do not use ordinary user preference registry keys for Office or browser security controls. Use policy paths under Software\Policies or the browser's managed policy store.

Operator Workflow

• Open Deployment from the system details toolbar.
• Select the Essential 8 tab.
• (1) Select Client: choose the client with the company-level Essential 8 checkbox enabled.
• (2) Run ML1 Evidence Assessment: click the large assessment panel before changing GPO, Intune, or endpoint policy. This creates the baseline evidence used by the report and sign-off.
• (3) Choose the Enforcement Path: use Domain GPO, Microsoft 365 Business Premium, SWARM Local Policy, or Deploy Action1 Agent based on how the client is managed.
• For domain clients, click Download GPO Pack, then create/link the GPO in Group Policy Management so existing and future users receive the controls.
• For Microsoft 365 Business Premium clients, click Confirm MS 365 Business Premium after licensing is verified, choose the permission mode, click Connect to Intune, complete Microsoft tenant admin consent, then click Run Intune Audit.
• For non-domain or pilot endpoints, click Deploy SWARM Policy to queue the SWARM local policy bundle through the endpoint package runner. The bundle applies Office user policy to loaded users, offline local profiles, and the Default User profile for future users.
• For patch management onboarding, click Deploy Action1 Agent. The card shows whether SWARM found the saved company MSI; when queued, click Review Deployment Run to monitor endpoint completion.
• After SWARM Local Policy is queued, click Review Deployment Run in the Essential 8 status panel. This opens Deploy Existing > Package Deployment Runs, refreshes the run list, and highlights the queued Essential 8 policy run.
• As each endpoint reports completion, SWARM records that endpoint's Essential 8 policy evidence. When the last endpoint finishes, SWARM sends the technician the final completion email with the ML1 App Hardening report attached.
• (4) Approve Customer Applications: review the selected client's Application Monitor catalog, approve allowed applications, block unwanted software, add manual entries, and generate the Application Control PDF.
• (5) Generate ML1 Report and Digital Sign-off: use this manually only when you need to regenerate the signed report after the automated completion email, or after GPO/Intune evidence has been refreshed.

Reports

• Essential 8 Audit Log: Application Monitor audit events.
• Essential 8 Change Log: Application Monitor software-change findings.
• Application Control Review: client approval checklist or approved application list.
• ML1 App Hardening: Office macro and user application hardening assessment evidence, assessment outcome, and digital sign-off block.

Settings & Admin

Settings are split across operator and admin concerns.

• Theme tab: theme, multi-column threshold, auto-refresh, and refresh interval
• Suppliers: quick-service link configuration and ordering
• CustomLinks: personal toolbar menu links, folders, separator bars, nested placement, drag ordering, and A-Z sorting
• Health/thresholds: offline, CPU, RAM, disk, antivirus overrides, and related health controls
• Servicing drawer: General Service, Recurring Service, and System Prep defaults and queueing
• Admin: users, Graph settings, daily HTML report, Halo company sync/remap, and lookups

User Management

Admins manage users from the Admin settings area.

• Add or remove users
• Promote or demote admin access
• Reset passwords or use the login-page reset path where applicable
• SWARM supports Microsoft Entra-first sign-in, with the local-password path retained as a rollback feature flag

Publishing Agent Scripts

Windows scripts that run on endpoints must be signed and published with the matching workflow for that script.

• Run the Windows publisher scripts from an elevated Administrator PowerShell prompt.
• Use the publisher that matches the file you changed.

• publish-swam-agent.ps1 – Windows SWARM agent
• publish-general-service.ps1 – Windows General Service launcher
• publish-prep.ps1 – Windows System Prep launcher
• publish-swam-diagnostic.ps1 – Windows diagnostics script
• publish-swam-uninstall.ps1 – Windows uninstall script

General Service Launcher

• Use publish-general-service.ps1 whenever agent/general-service.ps1 changes.
• The publisher signs the launcher and regenerates general-service.ps1.sha256 plus general-service-version.txt.
• Publish the launcher before rolling out a Windows agent change that depends on a newer General Service launcher version.

Windows Agent

Use publish-swam-agent.ps1 when agent/swam-agent.ps1 changes.

• The script bumps $AgentVersion, signs the agent, regenerates swam-agent.ps1.sha256, and updates agent/version.txt.
• Because the Windows agent controls queue pickup and launcher download, publish it before relying on new poller behavior.

macOS Publish Paths

The current Mac-native publish workflow is run from the MacBook Pro, not from the Windows signing workstation.

• Use the Mac publisher/build scripts from the MacBook Pro for macOS agent and installer work.
• The normal script publication path for Mac endpoints remains the signed shell-script workflow.
• For notarized installer packages, use the package-specific build/notarization workflow from the MacBook Pro.

Operational Notes

• Agents act on explicit server-published instructions only.
• General Service and System Prep are queue-based and poll-driven, not instant push actions.
• Windows General Service and System Prep depend on signed launcher/hash/version publication being kept current.
• macOS General Service and TeamViewer Push use a separate signed shell-script workflow published from the MacBook Pro — not the Windows signing workstation.
• Full System Prep (Windows onboarding) is Windows-only. macOS onboarding uses the TeamViewer Push workflow only.
• macOS TeamViewer Push requires the customer to be present at the machine to approve three privacy permissions. Queue it only when the customer is available.
• HP Image Assistant tasks (Driver, BIOS) run only on HP endpoints and are skipped automatically everywhere else. The BIOS task requires AC power and suspends BitLocker for one reboot.
• Card-view parity for non-system asset tabs and Systems selection is still incomplete in some areas by design.
• The endpoint capability strip in the details pane reflects backend-derived platform data. For endpoints with unknown platform identity, some workflows show as Review rather than Available until a full ingest payload is received.
• If operator behavior and this guide disagree, review the current architecture and workstate docs before assuming the UI is wrong.