Subscribe to GEN
Login to GEN
GENAMS, our Asset Management System, is a secure window onto every machine you have. A small agent on each Windows machine reports what it is, what it runs and what has changed, carries out the policy, software and files assigned to it, and lets an engineer see what is wrong before connecting to it.
Every change it records is analysed: outdated and weak software is highlighted, and changes and events that look suspect are weighed by our own language model and graded by importance. The same register drives planned maintenance, raising each task as a HelpDesk ticket when it falls due, and switches on Oversight monitoring for any machine with a single tick.
Most support starts with questions: what is this machine, what is it running, what changed. AMS answers them before anyone connects. Each machine sends a complete inventory once a day and shortly after it starts, and AMS compares it with the one before, so the change history of every machine is there to read: the software that appeared, the service that stopped, the administrator account that was added.
Alongside the inventory, each machine sends a map of its disks: folder and file names, sizes and dates, never the contents. An engineer can browse it, find the file they need and fetch that one file, without a remote session and without interrupting the person using the machine.
When an engineer does need to connect, AMS holds the remote access details and credentials for each machine, and opens a NoMachine or RDP session from them. Credentials are shown only to people with permission to see them, and every reveal is audited.
Every machine has a C:\GEN folder. A user who needs to send us a file, a log or a screenshot drags it in, and it arrives in AMS against their machine, ready for the engineer handling their ticket. Each user sees only their own files in the folder, and nothing is removed from it until the copy has been checked.
A single file can be fetched from a machine on request, for example a configuration that works on one machine and fails on another, so the two can be compared. A collection gathers the same file from every machine it is assigned to, keeps the latest copy and lets it be searched across the estate.
An agent that runs on every machine, with the rights to change it, has to be the hardest part of the estate to abuse. AMS is built on the assumption that the network between the agent and the server cannot be trusted, and that a user on the machine may try to turn the agent against it.
Machines are arranged in groups, and anything can be assigned to all your machines, to a group or to a single machine, with the more specific assignment taking precedence. Every change is a new version, so rolling back is publishing the previous one, and the change reaches every machine it applies to within 15 minutes.
Each machine's policy page shows exactly what it has been sent, where each item came from and whether the machine is in step, because the page and the agent are worked out by the same code.
AMS checks how each machine is joined every time it checks in. Local policy goes only to workgroup machines, and software only to machines not enrolled in MDM, so AMS never contends with a domain or another management system for the same machine.
AMS is the asset register behind our maintenance plans. Maintenance schedules, from a monthly health check to an annual review, are attached to each machine, each with its own first due date, interval and notes.
Every morning the maintenance engine finds what has fallen due and raises it as a ticket on our HelpDesk, on your account, under the right topic and support level. The ticket arrives with the machine's details, its location and remote access route, and the notes for the task, so the engineer starts work rather than looking things up.
Once the ticket is raised, the next due date moves on by the interval, in the machine's own time zone, so a task due at 9 o'clock stays at 9 o'clock when the clocks change. A ticket that could not be raised is tried again the next morning, and every occurrence is kept with its ticket number.
A list of changes is only useful if someone works out which of them matter. Each machine's inventory and the changes found in it are passed to a separate analysis system, together with the key indicators of its state: the software installed and the version of each, the Windows build, and the hardware.
Outdated software, and versions with known weaknesses, are highlighted, Windows included. Changes and event log entries that look suspect are weighed, and our own language model takes a view on each one: whether it is routine, or whether it has reached a level that should concern someone.
Anything that reaches that level is graded amber, red or pink, according to its importance, so the finding that matters most is the one seen first, and the routine changes that make up most of any estate's history do not bury it.
The findings come back into AMS, against each machine alongside its inventory, so the engineer looking at a machine sees what the analysis made of it.
Amber Red Pink
A finding is graded only once the language model judges that it has reached a concerning level, and the grade reflects its importance.
Most of what AMS does needs nobody. What does need someone is gathered onto one list, so an engineer opening AMS sees the machines that need attention first, rather than finding them by chance. Findings graded by the analysis sit alongside it, against each machine.
AMS also acts on silence. A machine that has not reported for 48 hours is marked overdue. After 30 days it is marked lost, its certificates are revoked and it can no longer talk to AMS, which is what you want from a laptop left on a train. It comes back only when an engineer re-registers it.
While a fault is being investigated, an engineer can pause a machine's agent: it carries on reporting, but applies nothing and downloads nothing until it is resumed, so nothing changes underneath the person working on it.
Faults that cannot wait, a service stopping or a server going down, are for Oversight, which watches the machine continuously and raises the alarm.
Oversight is GEN's infrastructure monitoring service. AMS handles the daily picture; Oversight watches each machine at close intervals, decides from several vantage points whether something is really wrong, and sends one message per incident.
Putting a machine under Oversight is a single tick in AMS. The agent installs the Oversight agent, gives it a new random token and allows it to answer only your Oversight probes. The token is sealed and passed to Oversight, so nobody needs to see or handle it.
From then on AMS keeps it running: if the Oversight service is missing or stopped, or a newer release is published, it is installed again with a fresh token. Removing the tick uninstalls it, and only an Oversight agent that AMS installed is ever removed.
The AMS agent runs on Windows, as a service on each machine. Every machine on the register can carry maintenance schedules, credentials and remote access details, and a Windows machine with the agent installed adds the full inventory, policy, software, files and Oversight on top.
No. AMS reports how each machine is joined and whether it is enrolled in MDM every time it checks in. Local policy is applied only to workgroup machines, and software only to machines that are not enrolled in MDM, and a machine joined or enrolled later stops receiving them with no intervention. Inventory, files and Oversight work on every machine.
Yes. Your staff sign in through GEN single sign-on with two-factor authentication, from networks you have approved, and see only your own machines. What each person can do is set action by action, from viewing to adding machines, assigning policy or revealing credentials, and everything they do is audited.
Not as a matter of course. The disk tree records the names, sizes and dates of files, never their contents. A file's contents reach AMS only when a user drops it into C:\GEN, or when a GEN engineer with the specific permission fetches or collects it, and every fetch, view and download is audited. Files held only in the cloud, such as OneDrive placeholders, are never downloaded to satisfy a request.
No. The analysis runs on a separate GEN system, and the language model that weighs each change and event is our own, run on GEN's own hardware in our own data centres. Nothing from your machines is sent to a third-party AI service.
It is built not to. The service runs at below normal priority, and the inventory and disk walks run in Windows background mode, with lower processor, disk and memory priority, pausing as they go. The full inventory runs once a day, and shortly after a machine starts.
Full inventories, files sent through C:\GEN and fetched files are kept for 90 days, harvested events for 30 days, and only the latest disk tree is held. The change history, disk space history and audit trail are kept for the life of the machine record.
A machine that has not reported for 48 hours is marked overdue, and after 30 days it is marked lost: its certificates are revoked and its policy and software state is cleared, so it can no longer talk to AMS. A machine can also be retired at any time, with the same effect. Registration is tied to the hardware, so a retired machine's identity cannot be claimed by another.
AMS is in use ahead of general release. If you would like your machines on it, contact us and we will talk you through what is involved.
GEN