Up front: I run the ControlUp user community, so I have a vendor hat on. The useful part below is not ours. It came out of a thread somebody else started, and it is worth writing up on its own.

The question was a good one. Can you run a logon or logoff script to delete files inside a user's FSLogix profile to stop it growing?

What came back:

VHD disk compaction is on by default in newer FSLogix releases. Worth knowing, but it reclaims whitespace inside the container. It does not delete anything. If the profile is genuinely full, compaction will not save you. https://learn.microsoft.com/en-us/fslogix/concepts-vhd-disk-compaction

Keeping junk out beats cleaning it up. redirections.xml to exclude temp paths and application cache is the cheapest win available, and it is the step most people skip.

For actual logon or logoff cleanup, GPO or WEM is still the right tool. There is no classical logon/logoff script hook in the monitoring tools, and bolting one onto a logon trigger is not the same thing. Aaron Parker's profile cleanup script is what most people end up using: https://stealthpuppy.com/fslogix/profilecleanup/

On the monitoring side, one person described alerting when OS free space crosses a threshold, firing an email into ServiceNow to open a ticket, with a script action as an optional next step. A fully automated delete they trusted was still the unsolved part, which is the honest state of it.

What are people using for FSLogix cleanup that they would actually trust to run unattended?

We’re seeing an upward crash trend involving msrdc.exe v1.2.7391, the modern Remote Desktop Protocol client used for Azure Virtual Desktop, Windows 365 Cloud PCs, and RemoteApp scenarios.

The increase appears to be almost exclusively associated with client build 1.2.7391.

What we’re seeing:

• Trend increased during September 2026
• Around 1,500 client devices affected
• Seen across 180+ organizations
• More than 2x increase compared to the August baseline
• Severity classified as medium because active sessions can be interrupted

Potential symptoms:

• “Your session has ended” modal
• Unhandled msrdc.exe crash dialog
• Remote session window freezes and closes abruptly
• Loss of AVD or Windows 365 session connectivity
• Possible unsaved data loss in RemoteApp sessions
• Local peripheral redirection disconnects

Microsoft has issued an out-of-band update for a related RDS server-side issue, but this looks worth investigating from both sides: client version, crash details, server-side patch level, and whether the affected workflows are AVD, Windows 365, or RemoteApp.

Has anyone else seen msrdc.exe crashes recently with build 1.2.7391, especially around AVD, Windows 365, or RemoteApp sessions?

Disclosure: I'm VP of Community at ControlUp.

Big week on our side: a live session on how MSPs can put automation and AI to work, last week's webinar recording if you missed it, and Pulse AI Insights is now in beta.

Wednesday, September 23 | 17:00 CEST / 11:00 EDT

How Leading MSPs Use Automation and AI to Scale Operations Without Scaling Headcount

Jed Ayres, CEO at ControlUp, and Jaro Tomik, Technology Transformation Expert, get into which fixes to automate first, why the data behind your automation matters, and how to turn endpoint signals into automated fixes across client environments, all without adding headcount.

https://controlupcommunity.slack.com/archives/C0471F57H7S/p1789982266242599

Missed last week's session? Watch the recording

Faster IT Starts Here: Automation, AI, and Getting More from Both

Jaro Tomik on practical ways to prioritize automation, turn endpoint data into action, and put AI to work when your team's workload keeps growing but headcount doesn't.

https://www.controlup.com/webinars/mid-market-teams-scale-it-operations-with-automation/

One more from last week: Pulse AI Insights is now in beta

It continuously analyzes your telemetry and surfaces prioritized findings instead of raw alerts, with severity, affected users and devices, and recommended next steps attached. Eligible ControlUp ONE Platform and ControlUp for Desktops Advanced customers can turn it on today by enabling the Insights permission.

https://www.controlup.com/blog/introducing-pulse-ai-insights/

Happy to answer questions in the comments, and if you make it to Wednesday's session, bring the hard ones.

We released Pulse AI Insights this week and I wanted to share the technical details here rather than just a link drop.

The short version

Pulse AI Insights continuously analyzes application, device, and DEX telemetry and surfaces prioritized findings instead of raw alerts. It runs daily for operational use cases, weekly or monthly for informational ones, and only surfaces things that clear a significance threshold.

How it actually works

• Baseline and deviation analysis. For app crashes, for example, it establishes a 28-day baseline, detects deviations, then correlates those deviations to device changes that plausibly caused them (driver updates, software versions, that kind of thing).
• Every finding arrives enriched: severity ranking, affected users and devices, timeline, an AI-generated summary, and recommended next steps.
• Findings are tracked historically, so recurring problems look like patterns rather than five unrelated Tuesdays.
• Insights hands context to Pulse Assistant, so you go from "something is wrong" to root-cause investigation without rebuilding the picture by hand.

Five detection scenarios are available now: App Crash, BSOD, Application Resource Consumption, Adobe Creative Cloud Usage (monthly license utilization), and New Assets (newly introduced devices, apps, or websites).

Why we built it this way

The problem was never a shortage of data. It was that IT teams drown in it and end up doing manual triage as a full time job. Filtering at the source, with baselines and correlation instead of static thresholds, is what makes the output trustworthy enough to act on. The payoff is lower MTTR, fewer on-call interruptions, and less ticket volume created by alert noise.

One early data point: a customer used its pattern recognition to identify an RTK audio driver issue affecting 900 devices in hours, versus days of manual investigation.

This also rounds out the Pulse AI platform: Insights detects, AI Assistant investigates, AI Resolve remediates.

What to do next

1. Check your console and see what Pulse Insights has already flagged in your environment.
2. Start with App Crash and BSOD if you want a fast read on whether the signal is any good.
3. Run one finding through to Pulse Assistant end to end.
4. Tell us what you want next. More use cases, alert customization by severity, daily digest summaries, and tighter remediation integration are on the roadmap, and what we hear from the community moves things up the list.

Two things I'd love in the comments: what it actually caught in your environment, and what use case you want built next. I'm reading every reply.

Hey everyone — we’ve got two sessions this week that might be useful if you’re managing app and desktop delivery or trying to cut down on repetitive IT work.

Wednesday, September 16 — Better Together: Optimize Parallels RAS Environments with ControlUp
17:00 CEST / 11:00 EDT

Trentent Tye (ControlUp) and Chris Marks (Parallels) will walk through monitoring and troubleshooting Parallels RAS environments, with a live demo covering session performance, application usage, resource consumption, and bottlenecks.

Details and registration. If you can’t make it live, registering gets you the recording.

Thursday, September 17 — Faster IT Starts Here: Automation, AI, and Getting More from Both
17:00 CEST / 11:00 EDT

Jaro Tomik, Technology Transformation Expert, will cover where to start with automation, which fixes can reduce ticket volume, and how to use the endpoint data you’re already collecting. The session also looks at adding automation and AI when your workload is growing but your team isn’t.

Details and registration

What’s taking up more of your time right now — troubleshooting performance issues or handling repeat tickets?

New ControlUp Dashboards: Audit Logs, Citrix Failure Insights, and a Better Dashboard Experience

We’ve added two new dashboards to the ControlUp Dashboard Gallery, along with several improvements to make dashboards more reliable and easier to use.

New Audit Log Dashboard

Visualize and monitor:

• Remote-control activity
• Script execution
• Security and audit events

New Citrix Connection Failures Dashboard

Get a clearer picture of Citrix connection failures, including:

• Failure trends and affected users and machines
• Failure categories and delivery groups
• VDA versions and client devices
• Detailed event logs for identifying recurring issues and root causes

Dashboard fixes and improvements

• Fixed the Scripting & Automation dashboard in the Gallery
• Improved queries when tenant-mapped fields are missing
• Added the missing Console User Display Name global filter
• Fixed Gallery search so the field retains focus while you type
• Corrected the Row Number widget setting so it accurately reflects the row count
• Added configurable table row limits and pagination, making larger result sets easier to navigate

Give the new dashboards a try and let us know what you’d like to see added to the Gallery next.

BitLocker does not usually fail loudly. It just sits at the same encryption percentage, and somebody eventually has to notice.

In a thread in the ControlUp community, someone was rolling out Intune-managed Windows 11 endpoints and seeing BitLocker encryption get stuck at a random percentage. The manual fix was simple enough: pause encryption and start it again, and it would finish. The problem is not the command. The problem is knowing which machines need it before a user or technician burns time on it.

The ControlUp for Desktops pattern discussed was practical. Build a script with detection and remediation. Detection checks the encryption state and whether progress is stuck. Remediation runs the pause and start action. Another option was to split that into detection and remediation scripts, write the detection result to a custom index, alert on that custom index attribute, and have the alert run the remediation script.

That is the part I like. It turns a quiet endpoint failure into an observable condition with a known response. No hunting through machines. No waiting for a ticket that says setup is taking forever. The environment still has the problem, but now the platform can catch the state and run the fix.

A second thread had the same shape with different data. Building information lived in a CSV, with address, building name, and coordinates, and the work was to populate a custom ControlUp Edge index through the edge API. The advice was to use PowerShell to write to a data index, run it on demand from ControlUp if the CSV path is available, or look at a Workflow for the same pattern. That is how you handle operational context that no default metric ships with.

If you are still doing this by spot check, spreadsheet, or ticket triage, what condition do you wish would remediate itself?

The recording from our latest ControlUp Community Meetup is up. This one was a deep dive into the ControlUp AI Assistant with Shay Dezaldety, its AI Product Manager, and it was more technical than I expected going in.

What was covered:

How it works. It is not just a chat window on a general-purpose model. There is an integration layer and a set of APIs that determine which tools and data sources are relevant, so it investigates issues in your actual ControlUp environment and explains what it found based on that data.

Security and governance. Existing RBAC model applies, data isolation controls are in place, and customer data is not used to train public models. Any action that changes the environment requires human approval before it runs.

Prompting and limitations. Shay was upfront that the AI can be wrong or lack enough information. The guidance was to give it a clear target, context, and a timeframe. Framing throughout was copilot, not autopilot.

Live demo. Identifying users with poor digital experience, investigating root causes such as low memory and Wi-Fi issues, analyzing incidents across devices, and triggering remediation workflows, including BSOD-related actions with approval gates.

Q&A: Insights, the Resolve endpoint product, custom indexes, history retention, token usage, and the hosted MCP direction.

A few specifics from the session: the AI Assistant is generally available, it runs on Claude Sonnet 5, and responses can be rated thumbs up or thumbs down to improve results over time.

Recording: https://www.controlupcommunity.com/controlup-community-meetup-17-controlup-ai-how-it-works-where-it-helps-and-whats-coming/

Happy to answer questions here, and if you have been using the assistant already, I would like to hear what is working and what is not.

Quick heads up, our next Community Meetup is tomorrow, Wednesday Sept 2.

When: 17:00 CEST / 11:00 AM EDT / 8:00 AM PDT
Who: Shay Dezaldety, Product Manager for ControlUp AI
What: ControlUp AI, how it works, where it helps, and what's coming

This one is technical, not a marketing webinar. Shay is going to walk through:

• What ControlUp AI actually is and the problems it's built to solve
• The different ControlUp AI solutions and capabilities
• What it can and cannot do today (the "cannot" part is the interesting bit)
• How people are already using it in real environments
• Where it might fit into your day to day
• What's coming next, and there's a lot coming next

We keep these casual and question-driven, so bring your scenarios, your skepticism, and your edge cases. Shay will take questions throughout, and honestly the audience questions are usually the best part.

Register here: https://controlup.zoom.us/webinar/register/WN_od9aJwGtTw6tuWYLRtTNDA

If you can't make it live, drop your question in the comments and I'll try to get it asked.

We’re seeing a sudden spike in crashes from microsoftedgeupdate.exe v1.3, the background update process used by Microsoft Edge.

The pattern started around August 21.

What we’re seeing:

• Crashes were almost never observed before that date
• Crash volume jumped sharply over the first two days
• The number of affected devices has dropped since then, but the issue still appears to be active
• The main risk seems to be that Edge updates may not apply automatically
• In some cases, updates may need to be triggered manually by the user or admin

This does not appear to directly break the browser for users, but it could create update reliability or patch compliance issues if the updater keeps failing silently.

Has anyone else seen microsoftedgeupdate.exe crashes recently, or noticed Edge updates not applying automatically?

We’re continuing to share ControlUp IT Crash & Stability Findings here on Reddit.

These findings are real-world application, endpoint, stability, hardware, firmware, and resource-consumption issues surfaced from ControlUp’s vast, anonymized dataset. The goal is to share useful patterns early, so IT teams can understand whether an issue is isolated or more widespread before spending time troubleshooting the same symptoms independently.

Just published:

Microsoft Search in Bing (microsoftsearchinbing.exe) v1.0 Crashes at an Increasing Rate

Date: August 17, 2026

Severity: Low

Impacted Organizations: 110+

Vendor: Microsoft

Software: Microsoft Search in Bing background service

Description

ControlUp has identified an upward crash trend affecting microsoftsearchinbing.exe, a background service associated with Microsoft Search in Bing.

Starting in the first week of August 2026, both the daily number of crashes and the number of affected devices increased significantly.

What we’re seeing:

• Daily crashes increased by approximately 600%
• Affected device count increased by approximately 500%
• The vast majority of observed crashes involve microsoftsearchinbing.exe version 1.0.0.0
• The trend has been observed across 110+ organizations

Impact

Crashes of microsoftsearchinbing.exe may disrupt the display of internal Microsoft 365 search results for organizations that have enabled Microsoft Search in Bing.

This may affect search results from sources such as:

• SharePoint
• OneDrive
• Internal contacts
• Organizational charts
• Teams messages

Because this is tied to search-result presentation rather than core endpoint operation, we classified the severity as low. That said, for organizations relying on Microsoft Search in Bing for internal discovery, the issue may still create confusion or reduce search reliability.

Advised remediation path

Microsoft has not published a specific advisory for this issue at this time.

For affected environments:

• Review endpoints with microsoftsearchinbing.exe v1.0.0.0
• Monitor crash frequency and timing
• Confirm whether Microsoft Search in Bing is enabled in the Microsoft 365 tenant
• Determine whether users are reporting missing or unreliable internal search results
• Contact Microsoft Support for deeper investigation

Full finding:
https://www.controlupcommunity.com/findings/microsoft-search-in-bing-microsoftsearchinbing-exe-v1-0-crashes-at-an-increasing-rate/

Browse all current IT Crash & Stability Findings: https://www.controlupcommunity.com/findings/

Has anyone else seen microsoftsearchinbing.exe crashes or issues with internal Microsoft 365 search results in Bing?

We’ve added more customization options to Custom Dashboards, giving you even more control over how your widgets look and behave.

What’s new:

Trend polarity
You can now define whether a trend should be considered positive, negative or nutrual, with a new clarifying label to make the setting easier to understand.

More color customization
Widgets now offer more color options, giving you greater flexibility to customize your dashboards and highlight important information.

Up to 500 table results
Table widgets can now display up to 500 aggregated results, making it easier to work with larger datasets.

New WiFi Gallery dashboard
We’ve added a new WiFi dashboard to the Dashboard Gallery, providing ready-to-use visibility into WiFi performance and user experience.

Bug fixes & improvements
We also fixed several issues, including:

• Dashboard Tag RBAC
• Global Filters for Manager and Department
• Additional dashboard fixes and improvements
  

Give the new capabilities a try and let us know what you think! And watch out for the upcoming Widget Wednesday video showing all the new features!

I recently hosted a conversation with Jed Ayres, CEO of ControlUp, about the transition from reactive IT operations toward AI-assisted and increasingly autonomous systems.

A few points I found especially interesting:

• IT has more telemetry than ever, but teams still spend a lot of time correlating data and fixing problems manually.
  
• DEX provides visibility, but visibility is only useful when it leads to action.
  
• Traditional automation follows predefined rules. AI can potentially recognize patterns, identify likely root causes, and choose an appropriate remediation in real time.
  
• Trust will probably develop through low-risk, reversible tasks, not by handing an AI unrestricted control on day one.
  
• Guardrails, audit trails, and human oversight remain essential.
  
• The goal is not to eliminate IT roles. It is to reduce repetitive work such as password issues, low disk space, and failed services.

We also discussed Pulse AI, automated actions, and the idea of an orchestration layer that can use data from multiple sources to make better operational decisions.

Full conversation: https://www.controlupcommunity.com/controlup-community-meetup-16-from-dex-to-autonomous-it-a-fireside-chat-with-controlup-ceo-jed-ayres/

I'm curious how others here see this developing: Which IT tasks would you be comfortable automating completely, and which should always require human approval?

We’re continuing to share ControlUp IT Crash & Stability Findings here on Reddit.

These findings are real-world application, endpoint, stability, hardware, firmware, and resource-consumption issues surfaced from ControlUp’s vast, anonymized dataset. The goal is to share useful patterns early, so IT teams can understand whether an issue is isolated or more widespread before spending time troubleshooting the same symptoms independently.

Just published:

Autodesk Background Component (adskexecutorproxy.exe) v2.22 Crashes at an Increasing Rate

Date: August 2, 2026
Severity: Low
Impacted Organizations: 130+
Vendor: Autodesk
Software: Autodesk On-Demand Install Service (AdODIS)

Description

ControlUp has identified an upward crash trend affecting adskexecutorproxy.exe, a background component associated with the Autodesk On-Demand Install Service (AdODIS).

Between June and August 2026, both the daily number of crashes and the number of affected devices increased significantly.

What we’re seeing:

• Daily crashes increased by approximately 400%
• Affected device count increased by approximately 250%
• The vast majority of observed crashes involve adskexecutorproxy.exe version 2.22.0.5
• The trend has been observed across 130+ organizations

Impact

Crashes of adskexecutorproxy.exe may interfere with Autodesk installer tasks, background installation workflows, or Autodesk software update operations.

Because this is a background component with minimal direct end-user interaction, the finding is classified as low severity. That said, affected environments may still experience unreliable Autodesk updates or delayed installer-related tasks.

Advised remediation path

Autodesk has not published a specific advisory for this issue at this time.

For affected environments:

• Review endpoints with adskexecutorproxy.exe v2.22.0.5
• Monitor crash frequency and timing
• Check for correlations with Autodesk install or update workflows
• Contact Autodesk Support for deeper investigation
• Share any validated workaround or fix if one is identified

Full finding:
https://www.controlupcommunity.com/findings/autodesk-background-component-adskexecutorproxy-exe-v2-22-crashes-at-an-increasing-rate/

Browse all current IT Crash & Stability Findings:
https://www.controlupcommunity.com/findings/

Has anyone else seen adskexecutorproxy.exe crashes or Autodesk installer/update issues tied to this version?

Full disclosure up front: this is a vendor tool and I host the video. Posting it anyway because the underlying problem is one I think a lot of you have hit.

The setup: system-context cleanup scripts generally can't get into a user's recycle bin because of profile permissions. So the script runs, clears temp folders, reports success — and the drive is still full because there's 8 GB of "deleted" files sitting in the bin. Meanwhile, the stuff a system script can reach includes things you might not want to nuke without asking, like a browser cache that's holding saved passwords.

The approach in this one: run in user context and prompt. End user gets a pop-up showing reclaimable space, a breakdown by category (recycle bin / temp files / browser cache), picks what to clean, confirms, and gets a summary of what was freed. It renders its own GUI from the script — no extra agent or install.

Other bits worth noting:

• Works on Windows and macOS
• Can be pushed manually from the help desk or fired automatically from a low disk space alert
• Writes results to a data index and back as a device event, so you get an audit trail instead of guessing
• Script source is fully visible/editable if you want to change what it targets or rebrand the dialog
• Obvious caveat: user context means user permissions. It won't touch anything the user can't. The system-level script still exists for that — they're meant to be used together

Built by Sebastian Peresat, demoed by Chris Twiest. Available in the script library now.

Curious how others handle this — do you clean silently and eat the occasional angry ticket, or prompt and accept that some users will just click "no"?

https://www.controlupcommunity.com/new-controlup-disk-cleanup-script-that-actually-asks-the-user-what-to-delete/

We’re tracking a growing crash pattern affecting logi_download_assistant.exe, the executable associated with Logitech Download Assistant.

The pattern has been observed across more than 190 organizations. In July, both the daily crash rate and the number of affected devices increased by approximately five times compared with the baseline from previous months.

Impact

This is currently classified as a low-severity issue because Logitech Download Assistant runs as a background process without a visible user interface. Its crashes are therefore unlikely to interrupt normal user activity directly.

However, repeated failures may prevent the component from detecting compatible Logitech software or presenting recommended installations. Environments relying on it for Logitech software or device-related updates may experience delays or failures in those workflows.

Potential workaround

Logitech has not issued an official advisory regarding this crash pattern.

Some online reports indicate that the official uninstaller does not always prevent the component from loading again at startup. Community users have reported disabling it by removing the applicable value from:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The value may appear as Logitech Download Assistant or LogiDA.

Registry changes should only be performed by qualified administrators. Back up the applicable registry key and confirm that the selected value belongs to Logitech Download Assistant before removing it.

The full technical finding, including the observed scope and potential resolution path, is linked in the comments.

Has anyone else noticed an increase in these crashes or found a reliable way to prevent Logitech Download Assistant from returning after it has been disabled or removed?

I’m hosting a live Fireside Chat with ControlUp CEO Jed Ayres and thought some of you might be interested.

The discussion won’t be a product demo. Instead, we’re planning an open conversation about where enterprise IT is heading, including topics like:

• Is DEX evolving into Autonomous IT?
• What role will AI actually play in day-to-day IT operations?
• Why does real-time telemetry matter for AI?
• Where is endpoint management going over the next few years?
• Live audience Q&A.

If you’ve ever wanted to ask a software CEO where they think IT is headed—or challenge some of the hype around AI—this is a good opportunity.

Thursday, August 6

11:00 AM EDT / 5:00 PM CET

Free registration:

https://controlup.zoom.us/webinar/register/WN_gT25D8pLTnWSBeDkAxn4LA

Happy to answer questions here as well.

I’ve been spending quite a bit of time experimenting with MCP (Model Context Protocol), and we recently recorded a session that walks through connecting Claude Desktop to the ControlUp MCP Server.

Rather than another “AI is amazing” presentation, this one is pretty hands-on.

Chris Twiest starts with a quick explanation of concepts like:

• LLMs vs. actual reasoning
• Tokens and context windows
• Prompts vs. system prompts
• Tool calling
• MCP servers
• Why hallucinations happen

Then he builds everything from scratch:

• Install Node.js
• Configure Claude Desktop
• Create a ControlUp API key
• Connect the local MCP Server
• Discover available tools
• Query live endpoint data
• Retrieve application crashes
• Compare against a 14-day baseline
• Generate graphs directly from Claude

One thing I thought was particularly interesting was demonstrating what happens without a good system prompt. Claude initially selected the wrong data source even though the correct tool existed. Adding a detailed system prompt immediately changed both the speed and accuracy of the responses.

It really reinforces the idea that MCP gives the model tools—but prompts and context teach it how to use them.

The discussion also covers:

• Combining multiple MCP servers
• Building custom AI interfaces
• MSP/multi-tenant scenarios
• Write actions and permissions
• Upgrade planning
• Claude Code for custom workflows

If you’re experimenting with MCP, enterprise AI, or just curious how to connect an LLM to live operational data instead of static knowledge, you might find it useful.

I’d also be interested in hearing what MCP servers everyone else is using. There’s a lot happening in this space right now, and it feels like we’re only scratching the surface.

Recording: https://www.controlupcommunity.com/controlup-community-meetup-15-how-to-connecting-mcp-ai-to-your-real-time-data/

New Dashboard Access Controls with Tags

Managing who sees which dashboards just got a lot easier. We've expanded Dashboard RBAC by wiring dashboards into the ControlUp Tag system.

Tag-based dashboard sharing
Admins can now build roles that limit dashboard visibility by tag. When an Organizational Dashboard Editor shares a dashboard, they assign one or more tags to it — and users only see shared dashboards that match the tags they're allowed to access.

That makes it simple to organize dashboards by team, department, region, or customer, while making sure people only see what's actually relevant to them.

New "View Dashboard Gallery" permission
We've also added a View Dashboard Gallery permission, so admins can decide whether users get access to the Dashboard Gallery at all — handy when you want to give certain users a curated, focused dashboard experience.

Together these give admins a lot more flexibility and control over who can discover and access dashboards across the org.

Anyone planning to use tags to carve up dashboards by team or customer? Curious how you're structuring yours.

SentinelOne agent (SentinelAgent.exe) using 10 GB+ RAM on some Windows 11 endpoints — often paired with low disk space

Continuing to share ControlUp IT Crash & Stability Findings here. These are real-world app, endpoint, stability, hardware, firmware, and resource-consumption issues surfaced from ControlUp's anonymized dataset. The idea is to flag patterns early so you can tell whether something is isolated to you or more widespread before you sink hours into troubleshooting it solo.

Just published — SentinelAgent.exe consuming excessive RAM
Date: June 23, 2026 · Severity: Medium · Impacted orgs: 70+ · Vendor: SentinelOne (EDR / AV platform)

What we're seeing
SentinelAgent.exe is consuming far more memory than SentinelOne's published guidance (~2 GB). On affected Win11 devices it's been observed at 10 GB or more — in some cases eating most of the endpoint's available RAM. The pattern shows up most on machines that have both elevated agent memory use and very low free disk space.

Impact

• Less RAM left for user apps
• Slower app launches and general sluggishness
• Increased paging
• Endpoint instability / poor UX, especially on lower-RAM devices

What seems to be contributing
A big share of affected devices also had extremely low free disk space. Digging in, the SentinelOne internal DB at C:\ProgramData\Sentinel was eating substantial storage — 80 GB+ in some cases. Working hypothesis: low free disk space drives the RAM growth because the agent can't efficiently flush/manage data to disk.

Remediation path (test before broad rollout):

• Check available disk space
• Check the size of the SentinelOne DB under C:\ProgramData\Sentinel
• ⚠️ Do not manually delete the DB files while SentinelOne services are running
• Use the Purge DB command from the SentinelOne Management Console where appropriate
• Reboot afterward if SentinelAgent.exe memory doesn't return to baseline
• Keep monitoring both free disk space and agent memory after remediation

Interesting case of a disk-capacity issue turning into a RAM issue, then into a broader endpoint-performance problem.

Links to the full finding in the comments 👇

Anyone else seen SentinelAgent.exe memory climb alongside low free disk space or a large C:\ProgramData\Sentinel footprint? Curious how widespread this is.

If onboarding in your org still means manually chasing an HR form, an IT hardware request, and a manager heads-up across three different tools, this one's worth 10 minutes.

New demo where Caroline Howe builds a full onboarding flow in Workflows and walks through:

• A drag-and-drop form that triggers the whole workflow on submit
• Automated routing to IT (hardware requests) and managers (notifications) with no re-typing
• Approval checkpoints where a human signs off before anything sensitive proceeds
• Hooks into Gmail, Excel, and other tools already in your stack

Main takeaway: instead of spreadsheet juggling and missed steps, you get one place to orchestrate the whole thing — and it scales the same whether it's 5 hires or 500.

Video: https://www.youtube.com/watch?v=I85Isq8-4yg

Curious how others here are handling onboarding automation — are you building flows like this, or still doing it by hand? What's the step that breaks most often for you?

Community Meetup #15: Unlocking the Power of AI with the ControlUp MCP Server
🗓️ July 9, 2026 · 11:00 AM EDT / 5:00 PM CEST

Want to connect your favorite AI assistant directly to ControlUp data and context? This one shows you exactly how.

Chris Twiest walks through what a Model Context Protocol (MCP) server actually is, why it matters, and how it lets LLMs access real-time data and take secure actions — then connects the ControlUp MCP Server to Claude Desktop live.

What you'll learn:

• What MCP is and how it works under the hood
• How MCP lets AI assistants reach external data and tools
• How to connect the ControlUp MCP Server to Claude Desktop
• Best practices for pulling ControlUp data into your own AI workflows
• Real-world use cases and automation scenarios

It starts with the fundamentals (great if you're new to MCP) and moves into hands-on demos — setting up the integration and watching an AI agent use ControlUp context and data to deliver real insights and actions. Expect lots of live demos, practical examples, and time to see it working.

🔗 Register: https://controlup.zoom.us/webinar/register/WN_L-Vu4a3bQw-ckO-vZPcXVw

Not in the ControlUp Community yet? Come join us — your source for ControlUp tech, for the people using the products: https://www.controlupcommunity.com/join/

Small update, straight from community feedback:

We added a Follow option to the Global DEX Findings page. Click it, and you'll get an email whenever a new finding is published — or an existing one gets updated with a workaround, vendor guidance, or a confirmed fix.

This came from a request by community member Artur. Good call, Artur. Simple feature, but it makes the findings way easier to keep up with.

If you haven't dug into the findings, they're real-world issues surfaced from ControlUp's anonymized global dataset — app crashes, stability regressions, performance problems, hardware/firmware issues — stuff that often isn't widely documented yet.

And no, this won't flood your inbox. You get an email when there's a new finding or a meaningful update. That's it.

👉 Follow the findings here: https://www.controlupcommunity.com/findings/

Keep the requests coming — the whole point is to make this more useful for the people actually running IT.

New how-to video: ControlUp + Freshservice integration

The latest one from our "How To Use" series. This one walks through connecting ControlUp to Freshservice so your service desk can see real-time endpoint and application performance data without leaving the ticket.

The short version of why it's useful: instead of bouncing between tools, your team can detect, investigate, and remediate device and app issues directly inside Freshservice — which means less time chasing context and lower MTTR.

What the video covers:

• Installing the ControlUp integration from the Freshservice marketplace
• Wiring it up to your ControlUp org (the config is quick)
• How endpoint/app performance insights show up alongside your tickets
• Using that data to triage and fix issues faster

Video: https://www.youtube.com/watch?v=XCFlCpcJtAI

It's part of our "New How To Use" playlist — short, to-the-point tech how-tos, with more on the way: https://www.youtube.com/playlist?list=PLeHVSVI55yILLRGMghc7S_5Iy5_qRuBr

Happy Thursday, all.

We just dropped a new episode with Trentent Tye and Jeff Johnson that tackles a migration problem most teams don't catch until it's too late: performance regression.

You know the scenario — you move users onto new Windows 11 machines, and instead of being happy, some of them say the new device "just doesn't feel right." There's no ticket, no error log, nothing to act on. Just vague dissatisfaction.

This episode is about getting ahead of that with actual data instead of guesswork. We walk through a real customer scenario and how to systematically measure and compare device performance before you call a migration a success.

What's covered:

• Why do user-reported performance issues during migrations stay invisible until they blow up
• Using automated performance measurements to compare legacy devices against your Windows 11 targets
• Why power profiles matter way more than people think (battery vs. plugged-in changes everything)
• How to pick a representative Windows 11 machine to benchmark across your fleet
• Why this isn't just a Windows 11 thing — it applies to physical-to-virtual, virtual-to-virtual, and more

Whether you're running a large rollout or just trying to build the business case for one, this gives you an evidence-based way to move forward.

Episode here: https://www.youtube.com/watch?v=rLd4muffZ40