Reading a device
The device page's tabs and how Revo judges protection, Windows updates, operating system support and stale data.
Updated
On this page
Open a device from Devices for its tabs: Overview, Updates, Software, Security,
Vulnerabilities, Activity and Settings. The ring next to its name is the
device score; click it for what's affecting it. Under the name is the device's full
hostname (for example BigMacMini.localdomain) when it differs from the name.
| Tab | What's there |
|---|---|
| Overview | Status, last seen, OS and hardware, the full hostname, protection, encryption, patch state, what needs attention (each issue with the score points fixing it adds), Windows version block, notes for the next technician, release channel and agent version |
| Updates | Missing, failed (each error explained, with Retry) and installed updates; Scan now, Install now, the device's policy, ring and next window. History shows installed updates and Revo's jobs |
| Software | Installed programs and packages, including per-user installs on Windows. Uninstall for Windows Installer apps (see Uninstalling applications) |
| Security | Microsoft Defender status (real-time protection, signature age, last scan, tamper protection, threats) and recent alerts |
| Vulnerabilities | Known vulnerabilities in the device's software. See Vulnerability management |
| Activity | Patch deployments, agent jobs, detected changes and setting changes, newest first |
| Settings | Display name and tags, patch policy and ring, Windows version, release channel, Disable, Enable and Remove from Revo |
Signed-in users
With agent 0.9.0 or later, the device header and the Device facts show who is signed in now (for example Jane Smith (GRACE\jsmith), at the device; Remote Desktop and disconnected sessions are labelled) and who signed in last, and when. The devices list shows it under the device name (or as the Signed in column), and the search finds devices by user name. When the device is offline, it's who was signed in when it was last seen.
- Only account and display names are collected: no passwords, session details or where remote sessions come from.
- Needs agent 0.9.0: older agents only report how many people are signed in.
- Turned off on this device: the device's owner switched reporting off (see Local controls).
- User names are customer data: they aren't given to the AI assistant.
Protection
A Windows device counts as protected when at least one of these is true:
- Microsoft Defender Antivirus is actively running;
- a recognised antivirus or EDR product is installed (for example SentinelOne, CrowdStrike, Sophos, Bitdefender or ESET);
- default-deny application allowlisting such as ThreatLocker is installed. Whether this last one counts is set in Settings → Endpoint policy (on by default) and can be changed per customer in its ideal state.
Defender running alongside ThreatLocker is protected, with both products listed. A device is reported unprotected only when Revo can see none of these. If its status can't be read, it shows as unknown, not red.
Your expected security stack (Settings → Endpoint policy, or per customer in its ideal state) lists products every Windows device should have, such as ThreatLocker and Huntress. A device missing one gets a medium issue naming it.
Security tools that are installed but whose service is stopped are flagged. One the customer expects is shown in red and counts against the device score. One it doesn't require is shown as a warning, not required: worth starting if the device relies on it, but it doesn't count (the device's protection is judged on its own).
Both settings are applied to what the device last reported as soon as you change them: the device's protection, its issues and its score don't wait for its next report.
Defender for Endpoint isn't required: Defender data comes from the standard Defender Antivirus, read by the agent.
Windows updates
The security and critical updates Windows Update says the device still needs, from its own update source (Windows Update or WSUS), and how long the oldest has been outstanding, counted from its Patch Tuesday.
| State | Meaning | Finding |
|---|---|---|
| Pending | Inside the update window (14 days by default) | None |
| Overdue | Past the update window | Medium |
| Critically behind | Past the critical limit (45 days by default) | High |
A pending update that fixes a vulnerability on CISA's Known Exploited Vulnerabilities list is tagged Actively exploited, with its CVEs and Microsoft's severity. Install these first, even inside the window.
The device also shows its update source, any deferral or pause, its last successful scan and install, and whether a restart is pending. That often explains why a device is behind.
The update window and critical limit are set in Settings → Endpoint policy and can be overridden per customer in its ideal state.
Third-party applications
About 25 common business applications (browsers, PDF readers, Java, Zoom, remote-access tools, archivers and so on) are compared with the latest version in Microsoft's winget catalogue. A full release behind is out of date; a minor update the app usually installs itself is shown but isn't a finding. Software whose vendor has ended support (for example Office 2016/2019/2021, Flash, Java 6/7, classic Teams) is listed separately.
Operating system support
- Windows: whether the release still gets security updates, from Microsoft's published lifecycle for its edition (Home/Pro and Enterprise/Education differ). Windows 10 22H2 shows as needing Extended Security Updates; if the device is enrolled in ESU, accept the risk on that finding and note the ESU reference.
- Linux: the release's end of security support from the vendor's policy. Ending within 90 days is a low finding; ended is high. Ubuntu LTS past standard support is covered only by paid Ubuntu Pro, which the device can't prove, so it shows as needing extended support. Debian LTS counts as supported. On RHEL, Rocky Linux and AlmaLinux only a major release's current minor stream gets fixes, so a minor release other than the final one shows support as unknown. Distributions Revo doesn't track show unknown.
- macOS: the current release and the two before it are supported. Older Macs get an Operating system out of support finding.
No recent data
A device that hasn't reported within the freshness limit (7 days by default, Settings → Endpoint policy) shows No recent data instead of a stale verdict. Its last known state is kept, but Revo doesn't present it as current. For patch compliance a quiet device counts as not compliant, so going offline can't improve the number.
Agents report every few hours (6 by default, Settings → Endpoint policy → self-report interval). Collect now (see Device actions) refreshes a device straight away.
Device names
A device is listed by its name. When the agent enrolls, the name is the computer's name without its domain: a Mac
that calls itself BigMacMini.localdomain is listed as BigMacMini, while the full name stays the device's
hostname (shown on its page and in Settings). Windows computers usually report a plain name such as SC-053,
so the two are the same. IP addresses are never shortened.
- Rename a device in Settings (or Edit name, notes and tags…). This only changes how Revo shows it; the computer keeps its own name.
- If the computer is renamed, its hostname follows at its next report or scan, and so does its name, unless you gave it a name yourself in Revo. A name you chose stays whatever the computer is called later. To go back, click Follow the hostname again under the name in Settings. The Activity tab records each change.
- Prefer full hostnames? In Devices, turn on Columns → Show full hostnames. It's your own setting: the device lists, the device's page and the patching lists then show full hostnames, with any name you chose underneath.