how-to · Security Open this in the console

Fix a security finding on several machines.

Some findings have a fix BE AI can apply: Windows Firewall or Defender off, SMB1 on, Remote Desktop without network sign-in, Linux automatic updates off, SSH root or password sign-in, the Linux firewall off. Their group shows "Fix N machines". You see the machines first, untick any you want to leave, and approve once.

The fix runs on 5 machines at a time. After each one the machine is checked again: "fixed" when the check no longer finds the problem, "failed" with the reason when it still does or the fix was refused, "skipped" when the machine was offline or the problem had already gone. After 2 failures the job stops and waits for you: read the reasons, then "resume" or "cancel". A failed machine is never tried again by itself. A machine you untick before approving is listed as "skipped", left out by you.

Press Fix N machines

Open Security and find the finding. Press Fix N machines. Every machine that can take the fix is listed and ticked. A machine the hub will not fix is greyed, with the reason beside it. Untick any machine you want to leave as it is.

A finding group with machine ticks, one machine greyed with its reason, and the approve button — Windows Firewall is off on two Windows machines: one is ticked, the other is not offered because it has not reported its security details yet.

Approve, then confirm

Press approve · fix ticked machines. The button asks confirm: fix 1 machine; press it again. Your name is recorded as the approver. reject drops the proposal and nothing changes.

Approve button showing confirm: fix 1 machine — The approve button is waiting for its second press.

Read the result per machine

Each machine shows fixed, failed with the reason, skipped, or running while it is being done. A job that stopped after 2 failures shows resume and cancel. undo puts one machine back as it was; undo every changed machine does the whole job. A machine the fix changed but did not finish, or that the check still flags, can be undone too. A machine's own fix history is on its Security tab under Work.

Finished fix job with one machine fixed with an undo button and one failed with its reason — Yesterday's automatic-updates fix: files01 fixed and can be undone, the lab host still has the problem.

Why a machine is not offered. Before it offers a fix the hub checks it is safe on that machine, and the machine checks again just before it changes anything. For example, SSH passwords are only turned off when an administrator can still sign in with a key, and the Linux firewall is only turned on when every port in use is allowed. A machine that fails that check is listed greyed with the reason and is left alone.

Undo. Every fix records how the machine was before. undo puts that back, on one machine or every fixed machine of the job. An undo is approved like a fix.

Customer logins see these buttons only when their access includes updates. Findings that need a person or a software update: Work through the security checklist.