Features — Lillith

Rich system inventory

OS edition and build, CPU, RAM, disks, time zone, IP addresses, logged-in users, and Windows activation status from the Software Licensing service.

Hardware health

Physical disk SMART prediction, wear, temperature, and power-on hours; battery charge and design capacity; network adapters with gateway, DNS, DHCP state, and link speed.

Live presence

Online, reconnecting, and offline states driven by a 10-second watchdog. Transitions are recorded in the Events log and pushed to every open browser.

Disk guardianship

Primary system-disk usage is flagged at 90% and 95%, with a live toast, an Events entry, and a machine-list notice that links to affected hosts.

Tags that mean something

Free-form host and application tags with bulk editing, tag filters on the fleet, Events, and Jobs, plus tag-on-tag hierarchy with a cycle-safe descendant tree.

Inventory history

Up to 100 system and program snapshots per host, browsable from the System and Software tabs. Sort any column; numeric, version, and relative-age values sort naturally.

Tokens or approvals

Issue enrollment tokens scoped to a site with expiry and use limits, or let tokenless clients appear on the Pending page for Permit / Deny review.

Editable approvals

Permit lets the admin correct the hostname and choose the site. Pending requests expire after a configurable idle window and revive if the agent polls again.

Automatic agent updates

Agents update on connect and hourly as a safety net. An out-of-process Windows updater replaces the binary after the service exits, then relaunches the tray.

Staged rollouts

Hosts carrying the beta tag receive a new binary first. Once every beta host reconnects on the target version, the rest of the fleet follows. Admins can advance a stuck phase.

Hardened identity at rest

The machine secret is a DPAPI machine-scope blob, so copying state.json to another PC does not expose the enrollment secret.

Self-diagnostics

Upload a log bundle from the tray or with --upload-logs. Admins read it from the machine's Logs tab without shell access.

Drag, drop, detect

Upload MSI and EXE installers with progress and cancellation. Product and version are read from MSI properties or EXE version resources; the file is streamed to disk with SHA-256 verification.

Targeted, not scattershot

Packages must target an installed application. The Applications page compares versions across hosts and flags outdated machines, with per-host and bulk deploy actions.

Silent arguments & guards

Per-package silent arguments, stop-process and stop-service lists. Hosts with a pending reboot are blocked with a clear tooltip, and the server rejects the request.

Honest results

MSI installs use verbose logging; failures include the failing log excerpt. Exit codes 3010 and 1641 count as success with reboot pending.

Automatic refresh

After a successful install the server refreshes that host's application inventory automatically, so the comparison stays accurate.

Undo the mistake

Deleted packages go to a 30-day recoverable trash with an Undo action. Package history survives deletion.

Pending update scans

Query the Windows Update Agent COM API for pending software updates, select individually or install all, and report reboot requirements. Reboots are never forced.

Driver & firmware

A separate scan and install flow for driver and firmware updates, with per-host status on the machine page and the fleet Updates page.

Update history

Installed hotfixes from Quick Fix Engineering with KB, status, description, install date, and installer — cached per host and listed fleet-wide.

Force a resync

Run w32tm /resync /force on one host or every host, set the NTP server list, and see measured clock drift before and after the action.

Time zones & repair

Set the time zone by Windows ID after validating against the host's own tzutil /l list. Reset a missing or damaged Time service registration in place.

Scheduled hygiene

Optional weekly fleet resync and periodic drift sampling, with configurable intervals. Say what happened with parsed w32tm /query /status fields.

In-browser VNC

A noVNC client proxied through the server over an authenticated WebSocket. The proxy-to-agent leg is TLS-encrypted with a per-session certificate pinned by the server.

Ephemeral by design

The RFB server is dormant until requested, listens only until the first viewer connects, serves one session, then returns to dormant. Stop listening ends it immediately.

Sessions that leave a trace

Recording starts when the in-browser client connects. The VNC tab lists duration, size, frames, and status, with replay and delete actions.

File browser

Browse drives and directories, upload and download through streamed HTTP transfers capped at 4 GiB, with pause, resume, cancel, delete, rename, and SHA-256 checksum view.

Registry editor

Browse HKLM, HKCU, HKCR, HKU, and HKCC; edit REG_SZ, EXPAND_SZ, DWORD, QWORD, MULTI_SZ, and BINARY values; create keys and delete empty ones.

On-demand screenshots

Desktop capture runs in the logged-in user's tray, where the interactive desktop is visible. PNGs are stored on the server with thumbnail history per host.

Services under control

List Windows services and start, stop, or restart them. Stop and restart also stop dependent services. Change startup type, including delayed automatic.

Utility actions

Refresh inventory, restart the agent, rename the computer, reboot after a 30-second warning, or wake an offline host with Wake-on-LAN.

Offline job queue

Requests for disconnected hosts persist as queued and send on reconnect. Edit arguments as JSON, reorder, set a per-job expiry, or cancel from /queue.

Deadlines that mean it

Timeouts start when the job is actually sent. Expired jobs are marked expired on reconnect instead of running late, and the server enforces its own deadline.

Retry with context

Failed, timed-out, cancelled, and expired jobs retry from the Jobs page or the machine History tab with their original arguments.

Two logs, one truth

Presence events and job history, both filterable by tag, exportable to CSV or Excel up to 100,000 rows, and guarded against formula injection.

Roles that hold

Admins change the fleet and manage users. Viewers browse every page while every mutating request is rejected with 403 — and the UI hides write controls behind a read-only banner.

Local or Entra ID

Argon2id local accounts, or Microsoft 365 OIDC authorization-code + PKCE. The Lillith.Admin app role maps to admin; other assigned users become viewers.

Sessions on a short leash

One-hour default sessions, immediate revocation of one or all other sessions, rate-limited login, and automatic CSRF tokens on state-changing requests.

Encrypted in transit

ACME / Let's Encrypt with Cloudflare DNS-01, an in-process HTTPS listener, HSTS, Secure cookies, and certificate/key downloads for reverse proxies.

Systemd hardening

A dedicated user, ProtectSystem=strict, PrivateTmp, NoNewPrivileges, and an ambient CAP_NET_BIND_SERVICE.

Evidence

An audit log for package, user, token, enrollment, settings, and machine actions, plus server-log and agent-log viewers that do not require shell access.

Deep links

Every machine tab has a hash route — #software, #files, #registry, #vnc, #time, #history, #jobs, #utility — and URLs take precedence over saved state.

Per-account preferences

Default site, notification choices, last used machine tab, and open/closed disclosure sections are stored server-side for each account.

Five themes

Windows XP Luna (the default), Vista Aero, Mac OS 10.1 Aqua, Windows 3.1 Hotdog Stand, and AlfCurtis — selected from the global nav and remembered per browser.

Sortable everything

Click any column header on any list. Numeric, version, percentage, and relative-age values sort naturally; each click toggles direction.

Live status, not refresh

A WebSocket keeps presence, events, jobs, pending approvals, inventory, and screenshots current, with a small pill for connection state and toasts for important transitions.

Single binary

The server embeds the web UI and noVNC assets. No static files to copy, no separate frontend process, no Node toolchain on the server.