Trigger automations upon user login and when alarms are triggered

Abstract

The trigger catalog covers four scenarios: New Device, Schedule, Manual, and Restart. Two scenarios are missing, and both involve features I’d like to carry over from my previous RMM:

  1. When a user logs in. Anything that affects the user profile needs to happen at this point. A schedule won’t trigger it.

  2. When a check triggers. I want to react to a detected state, not check every minute to see if it has occurred.

I’m requesting two additional triggers: UserLogin and CheckStateChanged. The first one is the more important one to me.

What octoja can do today

Four triggers, clearly separated from the execution context—that’s the right setup and it works well:

Trigger When

DeviceAdded

Device is added

OnBoot

Device restarts

Schedule

Cron plus time zone

Manual

Technician starts

For each step , executionContext: "User" or "System. " So the user context is already there—I just need to know when it actually takes effect.

Where the problem lies

1. User Login

On managed Windows workstations, there are a number of settings that must be configured specifically during login. Four typical examples:

Context module: Why during login

Disable Windows ads and suggestions

The user

writes to HKCU; does not exist before the first login

Disable automatic folder type detection in File Explorer

System

Does not take effect until the current session

Set time source

System

The time at which the computer is verifiably connected to the network

Report logged-in users

System

Login is the event

I can’t get this to work properly with Schedule. A cron job every 30 minutes runs about 15 times a day per workstation—for a setting that changes exactly once per login. If there’s a gap in the schedule, the user sees the ad tiles until the next run. Shorter intervals make it worse, not better.

OnBoot doesn’t help: the login happens afterward, and on shared computers and terminal servers, users switch accounts without a reboot.

The workaround using a scheduled Windows task triggered by login works, but it shifts the logic exactly where I don’t want it: onto the device. As a result, octoja no longer reflects what’s actually happening, and the task is excluded from reporting.

2. Response to a Check

Two typical cases:

Detected condition Desired response

A business application is missing or is too old

Run the installation package

Remnants of a deprecated agent found

Run the removal script

Today, I have a schedule for this that runs on all devices and almost always determines that nothing needs to be done. For software with a target version, this takes care of software distribution for me—and that’s where octoja actually has an advantage. But as soon as the status isn’t “Package X in version Y,” but rather “Registry key present,” “Service not running,” or “File remnant found,” all I have is the schedule.

The check already knows this. It’s running anyway, it knows the result, and it’s listed in the alert log. What’s missing is the path from there to automation.

For comparison: as I’ve seen with Ninja...

Please authenticate to join the conversation.

Upvoters
Status

In Review

Board
💡

Feature Request

Date

About 1 month ago

Subscribe to request

Get notified by email when there are changes.