The Devices roster at a glance
Every machine you know about sits in one list, whether our agent is on it or another system told us about it, and the two columns on the right are how you tell which is which and what you can do about it.
Roster, Unapproved, and the bar above the list
Roster is every machine that is already trusted. Unapproved counts the ones still waiting for a person to say yes, and the tab reads zero when there are none. Search, Client and Status stay on the bar because nearly every question uses one of the three. Everything else is behind Filters.
The columns
Status, the machine and its operating system, Health, the client it belongs to, Agent, Security, Control, when it last checked in, and the menu at the end of the row.
Agent, and Health
Agent
A small mark saying whose software is on the machine. Our own shield means our agent is installed and talking to us, and hovering the shield reads back the exact version it is running. A vendor logo, such as NinjaOne, means another system also knows about the machine - it does not mean we have no agent on it: a device can carry both marks together when our agent is installed AND a vendor also reports the same machine. The vendor logo only shows while that integration stays connected in Settings; disconnect it and the logo goes away, even though the device still remembers the link underneath, and it comes right back the moment you reconnect. Our own agents sort to the top of the list.
Health
An empty cell means nothing is wrong. Each icon is one thing that needs a look, and hovering it reads what it is. Here a box with an X says third party app updates are broken on that machine, a triangle says there is an open alert, and a circle arrow says a newer agent version is out. A machine behind the newest agent version in your fleet shows that here, not in the Agent column.
A client whose machines carry no agent of ours
A vendor logo, and an empty cell
A vendor logo is a machine we only know about because another system told us. An empty cell is a machine with nothing on it at all. Both are still in the roster, so you can see them, and neither can be reached or run against until our agent is on it.
The row menu on a machine with no agent of ours
The shorter menu
A machine with no agent of ours gets four entries: Install agent, Open, Edit device and Move to another client. Install agent opens the installer with that machine's client already picked, which is how you put our agent on it.
The row menu on one of ours
Everything you can do from this list
Three dots sit at the end of every row. Run script and Schedule a script are there when you are allowed to run code on a device. Open takes you to the device page. Edit device changes the display name, the type, the role, who it is assigned to and its tags. The display name is what everyone sees instead of the reported hostname - leave it blank and the hostname keeps showing. Move to another client moves it and asks you first. Remove archives the device here and tells the agent to uninstall itself, and it asks you first too.
The rest of the filters
Filters
Approval, agent, version, ring, warranty, type, operating system, alerts and patches all live behind the button, with archived at the end. A small number on the button says how many are set, every one you set also shows as a chip under the bar, and the web address keeps the same names so an old bookmark still works.
A machine that came in from another system
No agent version, and no policy
Agent version is blank and Policy reads Not managed by our agent. Policies only reach machines with our agent on them, so this machine picks one up the moment the agent is installed from the roster's row menu.
Nothing to read
Troubleshoot is not available on this machine, and the card says why in one line: there is no agent, so there is nothing to read.
One Windows machine with our agent on it
Whose machine, and whether it is up
The header names the client, says Online or Offline, and prints when the machine was last seen.
Nine tabs
Overview, Monitoring, Activity, Policy, Tickets, Integrations, Inventory, Files and Alerts. Overview carries the live readings, the drives and the device's own facts.
The full column set, on a live instance
Control
Control sits between Security and Last check-in. It launches a remote-control session on that one machine, right from the row - no separate console to open first. A logo with a small green dot means your team's connected remote-access tool is on this machine and ready: click it to launch. A dimmed logo means that same tool is on the machine but was installed by someone outside your team, so nothing here can launch it. An empty cell means no remote-access tool is on the machine at all - true of every row here, since this roster has no devices yet.
Install agent, opened
EXE, MSI and Linux installer
Three rows, each collapsed behind a caret with Download always at the right - the hint and, for MSI and Linux, the exact command sit behind the caret. All three carry the same enrol link rather than a bare key: one signed installer serves every client, so the link has to say which one - it carries this client's address, the install credential, and the certificate the agent should trust, and the agent refuses any address outside agents.ezcyber.app. A silent MSI push runs: msiexec /i EZCyberAgent.msi /qn ADDDESKTOPICON=1 ENROLLURL="<link>" - ENROLLURL is the one that matters and is required (a fresh machine refuses the install without it), ADDDESKTOPICON=1 is an optional desktop shortcut you can drop, and /qn just means no window. Linux is one line, run as root: curl -fsSL "<link>?platform=linux&asset=install" | sudo bash. The exe's own -enroll-url, -yes, -base and -token flags only matter for a hand-run or scripted install - a real MSI push never sets any of them, since msiexec passes no command-line arguments of its own; Windows Installer keeps its own exit code instead.
Install key
The same durable, permanent credential the client's own Devices tab shows: copy it here, or follow Manage keys to regenerate it, add a named key, or reach the one-time link instead. Use the install key for almost everything - it never expires. Reach for the one-time install link only for a single, one-off install: it self-expires in 24 hours and works exactly once, where the install key keeps working no matter how many machines use it.
Why it works this way
One roster, not two, is the point. A machine another system knows about and a machine our agent is on sit in the same list, in the same order, so nobody has to remember which tool holds which fleet.
The Agent column is what tells you why an action is missing. A menu with no Run script on it is not a permission problem, it is a machine with nothing of ours installed.
The vendor mark and our own shield are unioned, not either/or (owner ruling 2026-09-20, "show both"): src/app/admin/rmm/devices/fleet-devices-view.tsx's agentMark, and src/lib/domains/devices/fleet-list-synced-provider-wiring.test.ts's disconnect test, at 4b5e59a2f - both cited rather than re-shot this pass, since demonstrating a live dual-mark or disconnected-vendor row needs an enrolled device this synthetic tenant does not currently carry.
Other ways to do this
From a client's own Devices tab
Open the client, then Devices.
By web address
Set a filter, then copy the address out of the bar.
Questions this page answers
What does the Agent column mean?
It says whose software is on the machine, as a small mark. Our own shield means our agent is installed and talking to us. Hover the shield to read the version. A vendor logo, such as NinjaOne, means another system also knows about the machine. That logo only shows while the integration stays connected - disconnect it in Settings and the logo goes away, even though the device still remembers the link underneath, and it comes right back the moment you reconnect. A device can carry both at once - if we have our own agent AND a vendor also reports the same machine, both marks show together. An empty cell means nothing is on it at all. To put our agent on a machine, open the row menu at the right and pick "Install agent". It opens the installer with that machine's client already picked. Our own agents sort to the top of the list. A machine that is behind the newest agent version in your fleet shows that in the Health column, not here.
Why does a computer say we do not manage it?
Our agent is not on it. That machine came in from another system, so we can read about it but we cannot run anything on it. Policies only reach machines with our agent. Install the agent from the customer's Devices tab and it will pick up a policy.
Was this helpful?