Manage the shared key PCs use until they enroll, build the agent for this site, and set what it reports and how often. Each enrolled PC authenticates with its own credential instead; see Settings > Endpoints > Enrollment.
STORE YOUR KEY SECURELY. IT IS SHOWN ONLY ONCE AND CANNOT BE RECOVERED.
Before you generate a key, open the ShopDB Secure Send tool in a second window. As soon as the key appears, paste it into Secure Send, generate a secure link, and send that link to yourself in Teams so the site leader has a one-time, self-destructing backup. Never paste the raw key into a chat message or a plain file.
Every PC installed with the shared key holds this same key. It lets a PC that has not enrolled yet report and ask for its own credential. An enrolled PC is refused it and uses its credential instead, so rotating or revoking the key only affects PCs that have not enrolled. It is scoped to endpoint telemetry and separate from every other collector.
The shared key is switched off in Enrollment, so PCs
that have not enrolled already cannot report with it.
Approve requests, move PCs over and retire the shared key in
Active key {{ key.tokenprefix }}...,
created {{ formatDate(key.createddate) }}.
Last used {{ formatDate(key.lastusedat) }}.
Not used yet.
No shared key is active. PCs that have not enrolled cannot report or auto-enroll until one is generated.
On. The bootstrap COLLECTOR_API_KEY still authorizes endpoint reports. Generating a key turns this off so the managed key becomes the only credential. Off. Only the managed key above authorizes endpoint reports, so revoking it is an instant kill switch.
Anyone with this key can report as a not-yet-enrolled endpoint agent for this site and ask to enroll. Treat it like a password. If it is lost you must regenerate, which revokes the old key; PCs that have not enrolled then need the new one.
Recommended: before you leave this page, open the ShopDB Secure Send tool in a second window, paste this key, generate a secure link, and send that link to yourself in Teams. That gives the site leader a one-time, self-destructing copy to fall back on instead of pasting the raw key into a chat or a file.
Configure it as the agent X-API-Key header value.
{{ secret }}
.env fallback. The full secret is shown
once; it goes into the agent config as the X-API-Key
header.
Generate a one-shot, agentless enrollment tool. Run it once on a PC and it creates a ShopDB PC and Endpoint entry using only the collector key - no service, no polling, no ongoing telemetry. Use this for machines you want inventoried without running the full endpoint agent.
Paste a collector key below (generate one above first; the secret is only shown once). The key is embedded in the downloaded config and is not stored on the server.
{{ adoptmessage }}
{{ adopterror }}
Produce an instance-locked agent package stamped with this server's
URL, server pin, optionally the endpoint agent key, and the reporting
cadence, so it deploys with no manual configuration on the client. The
download includes the agent, a non-secret
appsettings.json, and an install.ps1 that
writes the settings to the registry
(HKLM\SOFTWARE\GE\ShopDB) - the key never lands in
appsettings.
No agent binary is staged on this server. The package will still build with config and installer, but no agent will ship inside it. Upload a current release in the binary section below to have it included in every download.
Current server pin:
{{ agentserverpin || 'not available (no server certificate found)' }}.
Add the next certificate's pin only ahead of a planned certificate
rotation.
The next server pin must be exactly 64 lowercase hex characters.
For a reverse-proxy or internal-CA server this app cannot see, upload
the server's public certificate in PEM format. It is validated,
bundled with the package, pinned, and imported into the endpoint's
Trusted Root store by install.ps1 (a CA-flagged
certificate is bundled and pinned but never imported, so only agents
1.20 and newer will trust the server). Leave empty when the
server uses a publicly trusted certificate. An upload takes precedence
over the bundled server certificate above.
{{ agentmessage }}
{{ agentwarning }}
{{ agenterror }}
Generate a short-lived token and give a technician the command. On a PC with no agent, run it from an elevated PowerShell. The token only fetches the installer: it carries no shared key and provisions nothing on its own. A managed bay should keep getting the agent from GE-Enforce instead.
Copy this now. The token is shown once and cannot be recovered.
Or save the script and run it on the PC instead: Download .ps1 (the same token; it carries the secret, so treat the file the way you treat the command).
Expires {{ formatDate(bootstraptoken.expiresat) }}. {{ bootstraptoken.remaining }} of {{ bootstraptoken.maxuses }} uses remaining.
The PC installs with no shared key and then waits for approval in Settings > Endpoints > Enrollment.
| Token | State | Expires | Uses | |
|---|---|---|---|---|
| {{ entry.tokenprefix }} | {{ entry.state }} | {{ formatDate(entry.expiresat) }} | {{ entry.usecount }} / {{ entry.maxuses }} |
No install tokens yet.
{{ bootstrapmessage }}
{{ bootstraperror }}
Upload {{ binary.name }} updated EXE. Uploading here will update the binaries available for your "Build Site Agent" install package.
Current staged version: {{ binary.current || 'none staged yet - upload a build below' }}
The version is read from the EXE itself. Leave this blank to use the binary's own file version, or enter a dotted-numeric override only when the build carries no readable version.
{{ binary.message }}
{{ binary.error }}
| Version | Uploaded | Size | |
|---|---|---|---|
| {{ entry.version }} | {{ formatDate(entry.uploadedat) }} | {{ formatBytes(entry.size) }} | current |
Define what the agent collects and how often: reporting cadence, monitored processes and services, the curated Windows event list, and whether unknown hosts self-adopt on first contact. These settings are stamped into the build above so a deployed agent needs no local edits.
Monitored processes and services are defined as reusable monitors and attached to PC types through site policies, so a deployed agent fetches the right set for its type.