Key Task: Analyze Remediation Actions

In order to reduce the number of IT tickets and improve user experience, Aternity developed the Remediation feature. Remediation allows IT help desk personnel to identify issues that can cause problems and remotely fix them before they are escalated. Running remediation actions remotely resolves performance issues on end user Windows devices by one-click reducing the problem-solving time and the risk of human errors. Remediation actions can be triggered automatically based on Service Desk Alerts, manually by IT help desk personnel or from external systems using REST API.

Use the Remediation Actions dashboard to easily track and measure the progress of remediation work. Get an overall view of all actions that have been executed by IT service provider and analyze their value to organization by analyzing their states, such as completed, failed, declined, and others. Analyze what actions are mostly used for remediation and how much end users are willing to run them. For example, if many actions failed, you may want to check the script for errors, if many actions were declined by users, you may want to check if the end user confirmation message is clear enough.

This functionality applies only to Windows end-user devices with Agent 12 or later. Install the Agent for End User Devices locally on a Windows desktop or laptop.


Remediation is supported for Windows devices only.

Analyze Remediation Actions Dashboard

To see the raw data behind this dashboard, access our REST APIs in Excel or PowerBI (learn more). View this specific dashboard's data with the REMEDIATION_ACTIONS_RUN_RAW. Learn more.


  1. Step 1 Open a browser and sign in to Aternity.
  2. Step 2 Select Main Menu > Analyze > Remediation Actions.
  3. Step 3 In the Action Trigger Type menu on the right side, select what type of actions you want to analyze.
    Remediation actions can be triggered automatically based on Service Desk Alerts, manually by IT help desk personnel or from external systems using REST API.
    Field Description

    You can run remediation actions on end-user devices using REST API. You can do that from outside Aternity. For example, use this API to trigger remediation actions from your ticketing system or use it in mass healing flows.

    Learn more.

    In the Action Triggered By menu, there is a value as defined for the triggerBy attribute in the API script.

    Automatic Remediation

    When creating a Service Desk Alert rule, it is possible to enable running remediation action(s) automatically upon that alert. An automatic action is triggered by an SDA it is assigned to. When Aternity generates this SDA, the action will be automatically executed. Learn more.


    Remediation actions can be triggered manually by IT help desk personnel with a certain privilege.

    Users with the Execute Remediation Actions privilege can run actions using the Troubleshoot Device Events dashboard (learn more)

  4. Step 4 In the Measurements menu on the right side, select the measurements you want to display as columns in this dashboard.
    Select the columns to display
    Field Description
    Average Script Duration

    The average time a script was running. Calculates only scripts that ran and completed successfully.

    Confirmed Percent

    The percent of user-accepted actions out of total number of times when users clicked Yes or No.

    Failed Percent

    The percent of failed actions. Considers only the actions in which the script started to run and counts those actions that failed.

    Number of Devices

    A unique number of devices.

    Pending User Confirmation

    Number of actions that are waiting for users to confirm the remediation action execution. By default, this measurement is not selected.

    Total Actions

    A number of all actions in total. For example, action A ran three times and Action B ran two times, the total number of actions is five.

    Unique Actions

    A number of unique actions. For example, action A ran three times and Action B ran two times, the number of unique actions is two. Calculated based on action name. By default, this measurement is not selected.

  5. Step 5 Focus your dashboard using Breakdowns and Filters, to assess whether you are on the right track to understand the cause of the issue.
    1. a Select the two criteria (Breakdowns) that you want to correlate, using the panel on the right hand side.

      When you choose two Breakdowns, Aternity displays them as the two leftmost columns of the dashboard.

    2. b Choose Filters and Filter Values to limit the display to the data where the attribute has that value.
    Choose the two criteria (Breakdowns) to check the remediation actions and their states

    Select any of the following fields to appear as Breakdowns or Filters.


    Aternity only offers to narrow data with filter values which are available. It does not offer values which have not been reported. For example, if you select Week Number as your filter, it will only display the weeks for which monitoring data is available.

    Field Description
    Action Names Displays the name of the remediation action.
    Action Execution Statuses

    Displays the statuses of remediation actions.

    There are several statuses:
    • Completed: The remediation process is completed. Refer to the Action States to learn how it was completed.
    • In progress: The remediation process is running. Refer to the Action States to learn in what stage it is now.
    Action States

    Displays the states of remediation actions.

    Completed actions can be of different states:
    • Completed successfully: The remediation has been successfully completed.
    • User declined: The user does not want to run this operation on the device and declined the action.
    • Failed: The script failed for some reason. Examine the Action Output Message to get more information.
    • Rejected by Agent’s signing policy: The action was rejected because of the signing policy predefined for the Aternity Agent.

    • Action Expired: The action did not eventually run during the allowed time period (set in the action definition). It can be that the user was logged out, or did not confirm the notification message, or the Agent for End User Devices was not connected.
    • Action timeout: If the script is running more than five minutes, the Agent for End User Devices stops the action.
    Actions that are in progress have different states:
    • Triggered: The remedy action has been sent to Windows monitored device.
    • Agent waiting for user login: A user is not logged in and cannot confirm the action execution.
    • Notification issued to user: A user is logged in and the Agent for End User Devices is waiting for user confirmation to start a remediation.
    • Action running: A user confirmed running a remedy script on the device and the script is running on the Windows monitored device.
    Action Output Messages

    Displays the output message for the action state.

    (For Completed successfully and Failed states only): The output message should be set as part of the script during its creation. In case of failure, the message describes the reason of failure, and in case of success, it brings some additional information about the action. For example, the recycle bin has been cleaned or the Agent has been stopped.

    (For Rejected by Agent’s signing policy state only):
    • Signing issue: Script is not signed, or script signature is corrupted - Displayed in case the script is not signed at all or its signature was manipulated.
    • Signing issue: Script signature is not valid - Displayed in case the signature does not match the script.
    • Signing issue: The root certificate is not trusted - Displayed in case the root certificate of the certificate that was used to sign the script is not in the trusted root certification authorities.
    • Signing issue: The certificate is not trusted - Displayed in case the certificate that was used to sign the script is not in the trusted publishers and is not explicitly trusted by the Agent.
    Action Triggered By

    For a manual action - It displays the user name who executed the action. For an automatic action - It displays the name of the SDA alert.

    Action Trigger Type

    Displays the type of the trigger that started the remediation.

    Business Locations

    Displays the name of the current location of the device. This is different from the Office, which is fixed for each user.

    For example, if a user based in the Houston office is working from the Chicago office, the Office is Houston, while the Business Location is Chicago.


    Displays the city of the current location of the device.


    Displays the country of the current location of the device.

    # CPU Cores

    (Desktops, laptops and mobile devices only) Displays the number of CPU cores of the device.

    CPU Frequency

    (Windows, Macs only) Displays the speed of the CPU processors of the device.

    CPU Generation

    (Windows on Intel only) Displays the generation of the Intel Core micro-architecture. For example 6 represents the 6th generation architecture processor, also known as Skylake.

    CPU Model

    (Windows on Intel only) Displays the model and speed of the Intel processor, as displayed in the System control panel. For example Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz or Intel(R) Xeon(R) CPU E5620 @ 2.40GHz.

    CPU Type

    (Windows on Intel only) Displays the core type of the Intel processor, for example i7, E5, and so on).

    Days from Last Boot

    Displays the number of days since the last time the device was booted. If you think that people experience slowdowns because they have not booted in some time, you can compare their performance with users who restart their devices frequently.

    This measure is time zone-agnostic, It uses absolute time and shows a duration of time, the number of days since the last boot.

    Day of Week

    Select to filter the displayed data for one or more days in the week.


    Check if the drop in performance is centered around a specific department, which can point to a configuration which is unique to that group of users, by viewing the performance in the list of departments. For example, if you find that only the Sales department is suffering poor performance, you can trace it to an upgrade which only happened on their computers, like a new CTI which interferes with your application.

    Device Name

    Displays the hostname of the monitored device. View it in the Windows Control Panel > System > Computer Name, or on Apple Macs in System Preferences > Sharing > Computer Name.

    (Mobile) Displays the Device Name field. You can customize the hostname of iOS or Android devices running your enterprise's app, so device names appear in the dashboards with a consistent naming policy. For example, you can dynamically assign the device name according to the enterprise username of the app.

    Device Types

    Displays the type of device reporting performance to Aternity.

    • Desktops are monitored Windows devices without a fitted battery, or for Macs, any monitored MacBook running macOS or OS X.

    • Laptops are Windows devices with a battery and a built-in keyboard (including all Windows hybrid tablet/laptop models), or for Macs, any monitored laptop running macOS or OS X.

    • Remote Devices have applications accessed remotely via an RDP protocol, for example, with Microsoft's Remote Desktop Connection.

    • Smartphones run monitored mobile apps on a small touch screen within a mobile operating system environment.

    • Tablets have larger touch screens, and no built-in keyboard, running iOS or Android. If it runs Windows, it is defined as a tablet if it is a known model of a Windows pure tablet (like Microsoft Surface models).

    • Virtual App Servers offer multiple users access to a single instance of an application, for example, with Citrix XenApp.

    • Virtual Desktops offer the ability to run an application within a VDI environment, which is a virtual instance of the entire desktop operating system (usually Windows).


    (Windows only) Displays the email address associated with the current logged in user.

    Hours of Day

    Select to limit the displayed data of the dashboard by specific hourly slots in the day.

    IP Addresses Displays the device's internal IP address (including IP v6 if the device runs Agent 10 or later) which it uses to connect to Aternity.

    Displays the name of the vendor which created this device, like Samsung, Apple, Dell, Lenovo, and so on.

    Memory Size

    Displays the size of physical RAM of the device.


    Displays the name and the model number of the device, like iPhone 6s, GalaxyTab8, MacBook Pro 12.1, Dell Latitude D620.

    MS Office License Type (Windows only) Displays the type of license for Microsoft Office, if installed. Typically it is either Subscription for Office 365, or Volume License for more traditional license purchases.
    MS Office Versions Displays the high level version of Microsoft Office, like MS Office 2016 or MS Office 2013.
    Network Types

    (Devices with Agent 9.x or later) Displays the type of network connection of the device: Mobile or WiFi, and also LAN (for non-mobile devices only).


    (For all devices except mobile) Displays the office where the current user logged in to this device.

    For example, if a user based in the Houston office is currently visiting the Chicago office, the Office is Houston, while the Location would be Chicago.

    On Site

    (Windows only) Displays true when the device can identify and connect to the Microsoft Active Directory site (either directly or via VPN).

    On VPN

    (For all devices except mobile and Macs) Displays true when the device is connected to the corporate network through VPN.

    The Agent queries Windows for a virtual network adapter with an active connection and a common name in its description: AGN, Checkpoint, Cisco AnyConnect, Citrix VPN products, F5 Networks adapters, Juniper Networks, OpenVPN TAP, Palo Alto GlobalProtect, Pulse Secure, PureVPN, SonicWall, and VyprVPN.

    OS Architectures

    Displays whether the operating system of the monitored device is 32-bit or 64-bit.

    OS Disk Types

    (Windows only, Agent 9.0.3 or later) Displays the type of hard disk containing the operating system. Possible values are:

    • HDD for a traditional spinning hard disk drive

    • SSD for a solid state drive

    • Virtual if this is not a physical device.

    OS Family

    Displays the broad category of the operating system. Use this to differentiate between different major operating system groups. For example, it displays all releases of Microsoft Windows as MS Windows, all releases of Windows Server as MS Windows Server or all releases of iOS as iOS.

    OS Name or Operating Systems

    Displays the generic name and version of the operating system (like MS Windows 10, MS Windows Server 2008 R2, MacOS 10.3, iOS 10 or Android 6). Use this to differentiate between different versions of an operating system.

    For example, it displays Windows 10 Pro and Windows 10 Enterprise all as MS Windows 10, or iOS 10.2 and iOS 10.3 as iOS 10.

    To view this information and the service pack version, see OS Version.

    OS Version

    Displays the full name, the exact version number, and the service pack version of the operating system. In Windows 10, it includes the release ID (like Microsoft Windows 10 Enterprise 1507). Use this to differentiate between details of the same operating system. For example, it lists MS Windows Server 2008 R2 Enterprise SP 1.0 separately from MS Windows Server 2008 R2 Enterprise SP 2.0.

    Pilot Groups

    Displays the pilot group to which the device belongs.

    A pilot group is a custom set of users or devices which undergo a change, like migrating to Windows 10, or updating the type of hard disk to SSD. You must assign a user or device to only one pilot group at a time, to ensure that you do not perform multiple changes at the same time.

    Power Plans

    (Windows only) Displays the Windows power plan which the device uses, governing the way the computer consumes power (like display brightness, sleep and so on). You can see this in Control Panel > Power Options. The default setting is Balanced.


    You can optionally define a region in Aternity to group together several locations under a single label, like the geographical region of EMEA, North America or even Southern Europe, South-Western US any other grouping you choose.


    Displays the geographical state of the current location of the devices (or area, if state is not applicable).


    Displays the device's subnet configuration used to connect to Aternity (including IP v6 if the device runs Agent 10 or later).

    User Domains

    Displays the LDAP domain name for the user who is logged in to the device.

    User Full Name

    (Windows only) Displays the full name of the person accessing the device as defined in the corporate LDAP (not the username).

    User Titles

    Displays the job title of the current user logged in to this device. In Windows, this is the same as the AD Title.


    Displays the username signed in to the device's operating system.

    Week Number (filters only)

    Select this to display only data related to a particular week number in the year.

    WiFi BSSID

    (From Agent 9.2 or Agent for Mac 2.3) Displays the ID (MAC address) of the wireless access point, which the device currently uses to connect to a WiFi network.

    WiFi SSID (From Agent 9.2, or Agent for Mac 2.0 and mobile) Displays the name of the WiFi network where the device currently connects.
    WiFi Channel

    (From Agent 9.2 or Agent for Mac 2.3) Displays the channel number which your device uses to connect to the WiFi router. Use this to ensure channels do not overlap one another in the same physical space. Your network performance significantly drops if a nearby WiFi router uses an overlapping channel with the same network speed.

    Custom Attribute 1-6

    Custom Attribute 1 through 6 are placeholder custom attributes which you can optionally define.

    Only displays if you defined a custom attribute using this predefined name.

  6. Step 6 You can change the start time of the data displayed in the dashboard in the Timeframe menu in the top right corner of the dashboard.

    You can access data in this dashboard (retention) going back up to 90 days.

    This dashboard displays raw data, refreshing every time you access it or whenever you manually refresh the browser page.


    It may take several minutes for dashboard to load or its data to refresh, due to the data processing and cache mechanism we are using.