This guide is written for administrators. Everywhere it says "you", it means the person administering the fleet.

About this guide

Who this is for

This guide is for the administrator who installs, configures and runs TruGrid RDS Manager Enterprise. There is no non-administrator user of this product: the people who open the Enterprise Client are your IT staff, so "end user" and "administrator" mean the same thing here.

It assumes you are comfortable with Windows Server, Active Directory and Remote Desktop Services. It does not assume you know anything about this product.

How this guide is versioned

Two version numbers appear on the cover and they mean different things:

You can see your own build number in three places: the bottom right corner of the Data Collector Configuration app, the bottom right corner of the Enterprise Client, and the About dialog in the Enterprise Client.

Revision history

Related documents

These are published on the TruGrid help site. Where they disagree with this guide, this guide is newer.

How to read the instructions

• File paths and service names are written out in full, like C:\ProgramData\TruGrid RDS Manager Enterprise.
• Anything you are meant to type is on its own indented line, in a fixed-width font.
• Button and field names are written exactly as they appear on screen, such as the Save Settings button.
• Numbered lists are procedures. Do the steps in order.
• "Important" boxes are things that will cost you time or data if you skip them. "Note" and "Tip" boxes are worth reading but will not hurt you.

In this article

• Part 1 - Understanding what you have installed
• • 1.1 What this product does
  • 1.2 The four pieces
  • 1.3 How the pieces talk to each other
  • 1.4 What the Session Host AGENT adds
• Part 2 - Installing and setting up
• • 2.1 Before you start
  • 2.2 Firewall and Group Policy prerequisites
  • 2.3 Install the Data Collector
  • 2.4 Set the service account
  • 2.5 Tell it which computers to watch
  • 2.6 Decide who can sign in, and what they can do
  • 2.7 Review the settings
  • 2.8 Optional: turn on HTTPS
  • 2.9 Connect with the Enterprise Client
  • 2.10 Deploy the Session Host AGENT
  • 2.11 Turn on the two audit policies the AGENT needs
  • 2.12 Check your work
• Part 3 - Day-to-day administration
• • 3.1 Finding your way around
  • 3.2 Dashboard
  • 3.3 Computers
  • 3.4 Users and Sessions
  • 3.5 Logon Performance
  • 3.6 Analytics
  • 3.7 Alerts
  • 3.8 Audit Log
  • 3.9 How to do the common jobs
• Part 4 - VM Pools
• • 4.1 What VM Pools does
  • 4.2 The two kinds of pool
  • 4.3 What you need before your first pool
  • 4.4 The one-time Group Policy step
  • 4.5 Create a pool
  • 4.6 Watching a pool build
  • 4.7 Everyday pool jobs
  • 4.8 Updating the image
  • 4.9 Going back to an earlier image
  • 4.10 The VM Pool Library
  • 4.11 When virtual machines fail to build
• Part 5 - Keeping it running
• • 5.1 Upgrading to a new build
  • 5.2 Certificates and AGENTs
  • 5.3 Database size, history and backup
  • 5.4 Troubleshooting
• Appendix A - Ports and firewall rules
• Appendix B - Where the files live
• Appendix C - What each role can do
• Appendix D - Settings reference
• Appendix E - What is collected, and from where

Part 1 - Understanding what you have installed

1.1 What this product does

TruGrid RDS Manager Enterprise gives you one window onto a Remote Desktop Services or VDI fleet. It answers four questions that are otherwise hard to answer:

• What is every session host doing right now - processor, memory, disk, how many people are signed in?
• Who is signed in where, and what can I do about it - message them, sign them out, shadow them, look at their processes?
• Why are logons slow - and which part of the logon is slow, on which host?
• Optionally, with VMware: build and rebuild pools of virtual desktops from a master image, without touching vCenter by hand.

Everything it shows you is recorded, so you also get history, trends and a full audit log of what your administrators did.

1.2 The four pieces

There are four programs. You will install two or three of them.

1.3 How the pieces talk to each other

Two things follow from this that are worth knowing early:

• AGENTs and clients always dial out to the Data Collector. You never have to open a port inbound on a session host for the AGENT to work.
• The Data Collector dials out to session hosts only when it has to. Once a host has a healthy AGENT, the Data Collector stops polling that host across the network entirely, which is why the AGENT makes firewall problems disappear.

1.4 What the Session Host AGENT adds

The Data Collector can monitor a computer with no AGENT installed. It pings it, asks it for processor and memory figures over WMI, and lists sessions using the built-in quser command. That gets you the basics.

The AGENT gets you everything else. None of the following is available without it:

Part 2 - Installing and setting up

Work through this part in order. The first installation on a prepared server takes about 1 hour, plus however long it takes you to deploy AGENTs.

2.1 Before you start

The Data Collector server

Give the Data Collector its own Windows Server. It must be domain joined. Size it by how many computers you are going to watch:

Aim to keep steady-state processor and memory use under 70 percent. The database lives on local disk and must stay on local disk: it uses a journal mode that is not safe on a network share.

The admin workstations

Anyone running the Enterprise Client needs Windows 11 or Windows Server, in the same Active Directory domain as the Data Collector. There is nothing to install. Just run the single program file. Some organizations may choose to publish the Enterprise Client as a RemoteApp application via TruGrid.

Accounts you will need

2.2 Firewall and Group Policy prerequisites

Get these in place before you install, or your first look at the Computers page will be disappointing.

On the Data Collector server

• Allow inbound TCP 5743. Add 5744 as well if you plan to turn on HTTPS.
• Allow outbound TCP 135 and the dynamic RPC range 49152 to 65535, to your session hosts.
• Allow the usual domain traffic outbound: DNS 53, Kerberos 88, LDAP 389, LDAPS 636 if you use it, and global catalog 3268 if you use it.
• If you will use VM Pools, allow outbound TCP 443 to vCenter.

On the monitored session hosts

These rules are only needed for computers you monitor without an AGENT. Deploy them by Group Policy to the organizational unit that holds your session hosts:

1. Enable the inbound rule group Windows Management Instrumentation (WMI), all three rules in the group.
2. Enable the inbound rule Remote Procedure Call (RPC) on TCP 135.
3. Enable the inbound rule for RPC dynamic ports, TCP 49152 to 65535.

2.3 Install the Data Collector

You need one file: TruGrid-RDSM-DC-Config.exe. It contains the service and the AGENT.

1. Copy TruGrid-RDSM-DC-Config.exe to the Data Collector server. There is no installer and nothing is written to Program Files.
2. Right-click it and choose Run as administrator. It will refuse to start without elevation.

• On first run it unpacks the Data Collector service and the AGENT into C:\ProgramData\TruGrid RDS Manager Enterprise; and creates the database.

1. Go to the Windows Service tab.
2. Click Install Service. A message tells you to set the Log On account and then start the service. Read the next section before you click Start Service.

• Service name: TruGrid-RDSM-DC
• Display name: TruGrid RDS Manager Data Collector
• It starts automatically, and restarts itself if it crashes.

The status pill in the top right corner shows the service state and refreshes every few seconds. Watch that pill rather than waiting for dialog boxes: if a service action fails, the pill is often the only sign.

2.4 Set the service account

The service is registered as LocalSystem. Change it to your domain service account now.

1. Open services.msc on the Data Collector server.
2. Find TruGrid RDS Manager Data Collector.
3. Open its properties, go to the Log On tab, choose This account, and enter your domain service account and password.
4. Return to the Configuration app, Windows Service tab, and click Start Service.

Then confirm the account has what it needs on a monitored computer. The quickest test is the Computers page in the Enterprise Client: if the processor and memory columns have numbers in them, remote WMI is working under that account.

2.5 Tell it which computers to watch

The Data Collector does not scan your network. It watches the member computers of Active Directory security groups that you nominate.

1. Go to the Computer Groups tab.
2. Click Add.
3. In the Browse AD Groups window, type part of the group name and click Search.

• Only Active Directory groups can be added. There is no organizational unit picker.
• The search returns at most 50 results, so type enough of the name to narrow it down.

1. Select the group and click Select. The group is added immediately, with no second confirmation step.

Group membership does two jobs, not one. It decides which computers are monitored, and it is also how an AGENT proves it is allowed to report in. A session host whose computer account is not in one of these groups will install its AGENT successfully and then be refused by the Data Collector.

The VM Pool Groups box

Lower on the same tab is a box titled VM POOL GROUPS with the option "Automatically add new VM Pool groups to:". If you tick it and choose a group, every new VM Pool you create has its own security group placed inside that group. The effect is that pool virtual machines are monitored from the moment they are built, without you coming back here. Existing pools are not changed. This saves immediately, with no Save button.

2.6 Decide who can sign in, and what they can do

Nobody can use the Enterprise Client until they are listed on the Access Control tab, either directly or through a security group.

1. Go to the Access Control tab.
2. Click Browse AD, search for a user or a security group, and click Add Selected.
3. Select the new entry on the left, then choose one of the four roles on the right.

The first entry you ever add is set to Admin automatically. Every entry after that starts as Help Desk and you raise it deliberately. Role changes save the moment you click them and take effect immediately.

Full detail of what each role can and cannot reach is in Appendix C.

2.7 Review the settings

Go to the Settings tab. There are four things worth a decision on a new install.

Click Save Settings. Port and interval changes need a service restart, and the app tells you so.

The File Locations section at the bottom lets you move the database and the service program to another drive, which is worth doing for better performance or if your system drive is small. Follow the on-screen procedure exactly: it requires stopping and uninstalling the service, moving the files, then reinstalling. Note that the configuration file and the HTTPS certificate always stay in C:\ProgramData\TruGrid RDS Manager Enterprise, even after you relocate everything else.

2.8 Optional: turn on HTTPS

Out of the box, traffic between the Enterprise Client and the Data Collector is plain HTTP on port 5743. Turning on HTTPS encrypts it, using a self-signed certificate that the product generates for itself.

1. On the Settings tab, tick Enable HTTPS, confirm the port, and click Save Settings.
2. Restart the Data Collector service. The certificate is generated on startup.
3. Come back to the Settings tab. The thumbprint now appears under HTTPS Certificate.
4. Click Install to Trust and Update Connected AGENTs. That adds the certificate to the server's trusted store and tells every connected AGENT about it, in one step.

2.9 Connect with the Enterprise Client

1. Copy TruGrid-RDSM-Enterprise.exe to an admin workstation and run it. No elevation needed.
2. In the Connect to Data Collector window, type the address of your Data Collector.

• A bare name or address is fine. If you do not type a scheme, http is assumed.
• Examples: http://dc-server:5743 or http://10.1.2.3:5743
• For HTTPS you must type it in full: https://dc-server:5744

1. Click Connect.

If the account you are signed in with is not on the Access Control list, you are told your account is not authorised. Add it as described in 2.6.

The certificate prompt, and what it means

With HTTPS and a self-signed certificate, the client quietly remembers the certificate the first time it connects to a given address. It only prompts later, if the certificate changes. The prompt is titled Security Alert, says the certificate has changed, and shows you both thumbprints.

Accept it only if you know a certificate change was expected, for example because you have just rotated it. Otherwise treat it as worth investigating: the same prompt appears whether the cause is a legitimate rotation or something pretending to be your Data Collector.

2.10 Deploy the Session Host AGENT

There are three ways to install the AGENT. All three end up in the same place: a service named TruGrid-RDSM-Agent, running automatically, with its settings in C:\ProgramData\TruGrid RDS Manager Enterprise\Agent.

Before you start, make sure the computer accounts of the hosts you are deploying to are in one of the groups from 2.5. Without that, the AGENT installs and is then refused.

Option 1: push from the server with PsExec, best for a handful of hosts

1. Download PsExec (part of SysInternals) from Microsoft and put it on the Data Collector server, for example in C:\Tools.
2. Go to the AGENTs tab and click Push with PsExec. Choose PsExec64.exe or PsExec.exe. It is recommended to use PsExec64.exe on 64bit operating systems
3. Type the host names, one per line.
4. Confirm the PsExec path, then click Deploy and watch the log.

This copies the AGENT to the target's C$ share and runs the installer remotely, so administrative file sharing has to work on the targets. Failures are logged per host and the run carries on.

Option 2: the installer ZIP, best for a hands-off or scripted rollout (SCCM / Intune)

1. On the AGENTs tab, click Download ZIP and save the file.
2. Copy the ZIP to each session host and extract all three files into a folder.
3. From an elevated command prompt in that folder, run install.cmd.

The ZIP is built for your Data Collector specifically: its address and, if you use HTTPS, the certificate thumbprint are already inside. That is why you download it from your own server rather than from TruGrid.

Option 3: the PowerShell script, best for existing deployment tooling

Install-Agent.ps1 ships in the deploy\agent folder. Run it elevated, with the AGENT program and your Data Collector address. If your Data Collector uses HTTPS you must also pass the certificate thumbprint, and the script stops if you do not.

Confirming it worked

Go to the AGENTs tab and click Refresh. The grid does not fill in by itself, so click Refresh each time you open the app.

2.11 Turn on the two audit policies the AGENT needs

Two Windows audit settings are what make the logon and application pages work. The AGENT reports whether each one is enabled, and the AGENTs tab shows it in the AUDIT column.

Set them by Group Policy on your session host organizational unit. To test one host quickly, run these in an elevated PowerShell window on that host:

auditpol /set /subcategory:"Logon" /success:enable

auditpol /set /subcategory:"Process Creation" /success:enable

If you forget, the product tells you. The Logon Performance page and the App Launches view both show an amber banner naming the affected hosts and giving you the exact command above.

2.12 Check your work

Run through this list before you call the install done.

Part 3 - Day-to-day administration

This part covers the Enterprise Client, which is where you will spend your time. VM Pools has its own part.

3.1 Finding your way around

The sidebar

Down the left, from the top:

• A DATA COLLECTOR card showing which server you are connected to and how many groups it watches.
• An ONLINE ADMINS card, which only appears when another administrator is connected at the same time.
• A group filter. Choose one of your Active Directory groups here and every page narrows to it. It starts on (All Groups).
• The page buttons: Dashboard, Computers, Users and Sessions, Logon Performance, Analytics, VM Pools, Alerts, Audit Log. VM Pools is hidden for the Help Desk role.
• Switch Data Collector at the bottom, if you run more than one.

The header and the status bar

How the data refreshes, and what stale looks like

You do not need to refresh anything by hand. The Data Collector pushes updates to you: a full picture after each poll cycle, a lighter status update every few seconds, and session changes within about five seconds when the host has an AGENT.

When a page has a Refresh button, it asks the Data Collector to run an extra poll right now rather than waiting for the next cycle. That takes a few seconds.

3.2 Dashboard

A read-only summary. Nothing on this page changes anything.

The top row counts computers and sessions: TOTAL COMPUTERS, COMPUTERS ONLINE, COMPUTERS OFFLINE, ALL SESSIONS, ADMINS ONLINE. The second row shows FLEET UX SCORE plus ACTIVE, IDLE and DISCONNECTED session counts.

The Fleet UX Score

One number out of 100 for how the fleet feels to its users, recalculated every five minutes over the previous 24 hours. It is a weighted blend of logon times, responsiveness, resilience and availability, with responsiveness and logon time carrying the most weight.

Lower down, COMPUTER HEALTH gives one card per computer with processor and memory bars that turn amber then red as they climb, and COLLECTOR INFO plus SESSION BREAKDOWN summarise the connection and the session mix.

3.3 Computers

One row per monitored computer. This is where you act on whole machines rather than individual sessions.

The buttons

The columns

The search box filters on computer name only. Right-clicking a row gives you the same actions plus View Analytics, which jumps to the Analytics page already filtered to that computer.

The two errors you are most likely to see from these actions are "Access denied. Admin rights required on target." and "Registry key not found on target." Both point at the rights of your Data Collector service account on that host, not at the product.

3.4 Users and Sessions

One row per session. This is the help desk page.

Narrowing the list

Four filters combine: Computer, State (Active, Idle, Disconnected), Type (RDS, VDI, AVD, App) and a search box that matches either the user name or the computer name. The sidebar group filter applies on top of all of them.

The buttons

The columns worth explaining

The Processes panel

Select a session and click Processes. You get process name, process ID, processor and memory. Select one or more and click Terminate, which does confirm first. Critical system processes are refused by the AGENT, so you cannot accidentally kill the host.

What happens after you act

• Logoff and Reset: the row vanishes straight away, and the product suppresses it for 30 seconds so a slow update cannot make it flicker back.
• Disconnect: the row stays and changes to Disconnected. That is correct, not a failure.
• Restart and Shutdown: no confirmation message appears. The computer simply drops to Offline at the next poll.
• If the user signed themselves out at the same moment, the product treats that as success rather than showing you an error.

3.5 Logon Performance

This page answers "why is signing in slow, and which part is slow". It needs the AGENT, and it needs Logon auditing turned on as described in 2.11.

Choose a window with the Show last box. It opens on Last 1 Day. The five tiles across the top are LOGONS, AVG TOTAL, P95 TOTAL, AVG PROFILE and AVG GPO.

The five phases

Click any row and the detail pane shows a bar split into those five phases, sized in proportion, so the expensive phase is obvious at a glance. Underneath, CORRELATED EVENTS lists what Windows logged on that host around that logon, which usually names the cause outright. The "Filter to this user" tick box starts on, and turning it off widens the list to everything happening on the host at the time.

3.6 Analytics

The toolbar at the top applies to every tab: a Computer filter, a User filter, a Period running from Last 1 Hour to Last 90 Days, Refresh, and Export PDF.

Prism, the executive view

Prism answers four questions in four tiles, each with a pill in the corner reading OK, WATCH or ALERT.

Below the tiles, a STATUS strip collapses to a green pill when there is nothing to report, and TOP APPS ranks the busiest applications by memory or processor.

3.7 Alerts

A read-only history of what the product noticed. There are no buttons here beyond Refresh, and no way to acknowledge or close an alert by hand: alerts resolve themselves when the condition clears.

The tick box "Open alerts only" starts unticked, so you see history as well as current problems. The three tiles always count the whole window even when the grid is filtered.

3.8 Audit Log

Everything your administrators did, plus session events the product noticed itself. Search matches the administrator, the action or the target. The window opens on Last 7 Days, and Export PDF exports whatever you have filtered.

Columns are Time, Admin, Action, Target, Details and a Result pill reading OK or Failed. Click a row for the full detail, including the error text when something failed.

3.9 How to do the common jobs

Take a host out of service for patching

1. Computers page, select the host.
2. Click Drain. Existing users carry on working and can still reconnect, but nobody new lands there.
3. Wait for the Sessions count to fall to zero, or use Logoff All if you cannot wait.
4. Patch and restart.
5. Click Enable Logon when it is back. This does not happen by itself.

Help someone whose session is stuck

1. Users and Sessions, find them with the search box.
2. Click Shadow to see what they see. This starts immediately.
3. If an application is hung, click Processes, select it and click Terminate.
4. If the session itself is beyond help, click Disconnect first: it keeps their applications running so they can reconnect. Use Reset only when you accept losing unsaved work.

Investigate a complaint about slow sign-in

1. Logon Performance, set Show last to cover the complaint.
2. Search for the user or the host.
3. Check LOGONS to be sure you have enough samples to trust.
4. Click the slowest row and read which phase owns the bar.
5. Read CORRELATED EVENTS underneath for the cause.
6. If several hosts are affected, look at Analytics, Timeline to see whether it lines up with a processor, memory or network problem.

Tell everyone on a host that it is going down

1. Computers page, select the host.
2. Click Message and type it.
3. Remember it reaches every session on that host and stays on screen for 60 seconds.

Find out who changed something

1. Audit Log, set the window wide enough.
2. Search for the administrator, the action or the computer.
3. Click the row for the full detail.

Part 4 - VM Pools

VM Pools is optional. It only applies if you run VMware vSphere and want the product to build and rebuild virtual desktops for you. If you only monitor existing session hosts, skip this part.

4.1 What VM Pools does

You prepare one master image. VM Pools clones it into as many virtual machines as you ask for, names them to your pattern, joins each one to your domain, and puts them all in an Active Directory security group so they are monitored automatically. Later, when you update the master image, it rebuilds the pool onto the new image without you touching vCenter.

4.2 The two kinds of pool

You choose this on the first screen of the wizard and you cannot change it afterwards.

Exactly when a non-persistent machine is wiped

A non-persistent machine is wiped by being reset back to its clean baseline. Everything written since it was built is discarded. A reset happens in these four cases:

The wipe is complete, but it is the reset that causes it rather than the sign-out on its own. If you want each machine cleaned as soon as its last user leaves, turn on the drain-to-zero option: that is what turns the final sign-out into a reset. Otherwise a machine is cleaned at its next restart, on its schedule, or when you reset it by hand.

4.3 What you need before your first pool

A vCenter connection

Set this up in the DC CONFIG app, on the Hypervisor Connections tab. Click Add and fill in a friendly name, the vCenter address, and an account. Tick Trust self-signed certificate only for a laboratory: in production, install your issuing certificate authority into the Data Collector server's trusted root store instead.

Click Test Connection before you save, then use the Test button on the saved connection to run the full permission checklist. The dialog splits results into privileges it could verify now by reading, and write privileges it can only confirm when you actually build a pool.

The vCenter account needs these privileges:

An Active Directory account for VM Pools

On the same tab there is a card called VM Pools AD Account. This is the account that creates and deletes computer accounts as machines come and go. Enter it as a user principal name or in domain\user form, give it a test organizational unit, and click Test. The test binds to the directory, creates a throwaway computer object in that organizational unit, reads it back and deletes it, then shows you each step.

A master image that is ready to be cloned

• Generalize the image with sysprep before you use it.
• Remove or handle any Windows Store applications that block generalization. They are a common cause of failure.
• Make sure the image can reach a domain controller and resolve DNS.
• Do not leave Windows Update mid-installation in the image.
• Check how many times the image has been generalized. Windows limits it.

4.4 The one-time Group Policy step

Non-persistent pools need one manual step, once, before the first person signs in. Without it, machines fall off the domain a few weeks later and users cannot sign in.

The reason is straightforward. Windows changes each computer's own account password roughly every 30 days. The clean baseline your machines revert to was captured at one moment in time, and it contains the password as it was then. If Windows has rotated the password since, a machine that reverts comes back with the old one, the domain no longer recognises it, and you get a trust relationship failure. Stopping the rotation keeps the captured password valid.

4.5 Create a pool

In the Enterprise Client, go to VM Pools and click Create Pool. There are four steps.

Step 1: Persistence

Choose Persistent or Non-persistent, using 4.2. It starts on Persistent. You cannot change this after the pool is built.

Step 2: Source

Pick the vCenter connection and click Discover sources. You get a tree of templates, powered-off virtual machines and snapshots, with chips to filter by type and a search box.

• Snapshots appear underneath the machine they belong to.
• Running machines are shown for context but cannot be selected. You can select a snapshot underneath one.
• For non-persistent pools, templates are not listed at all, because a linked clone needs a snapshot to hang off.

Large vCenters can take a while to enumerate. If discovery times out, raise the Discover timeout on the connection: the default is 60 seconds and very large environments sometimes need 180 to 300.

Step 3: Pool config

Step 4: Review

Check the summary. For non-persistent pools there is a one-line reminder about the Group Policy from 4.4, with Show details and Copy GPO details. Then click the green Provision button.

4.6 Watching a pool build

The pool page refreshes itself every few seconds. Each machine moves through Queued, Cloning, Customizing, Joining AD and then Ready.

Expect a full build to take a while. Each machine has to clone, boot, run generalization, join the domain and report its own name back. The product waits up to 30 minutes for a clone and 10 minutes for a domain-join before it gives up on a machine.

4.7 Everyday pool jobs

4.8 Updating the image

Non-persistent pools only. Update the master image, then point the pool at the new version.

1. Prepare and generalize the new image, and make sure it is powered off or has a snapshot.
2. Open the pool and click Update Image.
3. Choose the new source. The same rules from 4.3 apply: it must be sysprep-ready.
4. Write a reason. It is saved into the pool's history.
5. Choose when, and how fast, using the table below.
6. Click the button, which reads Start Update, Schedule Update or Apply on Recycle depending on your choice.

You can also warn signed-in users before their machine rebuilds, with a lead time and a message. The default message includes the time, substituted automatically.

While an update is running the header shows Cancel Update. Cancelling stops further rebuilds. Machines already moved keep the new image, so you may be left with a mixed pool deliberately.

4.9 Going back to an earlier image

Open the VM Pool Library tab, find the entry you want, and click Revert. It rebuilds the pool from exactly the image content recorded at that point, not from whatever that source looks like today.

4.10 The VM Pool Library

The second tab on the VM Pools page is the change journal for every pool: what it was built from, every image update and revert since, the reason somebody typed, and the exact vCenter snapshot behind each one.

4.11 When virtual machines fail to build

The commonest failure by far is generalization. The pool page shows a Troubleshooting card listing six causes when a pool is Partial or Error, and each failed machine shows its own error underneath its name.

Part 5 - Keeping it running

5.1 Upgrading to a new build

Upgrades are manual and deliberate. Nothing updates itself without being told to, and the product never installs an update behind your back.

You will find out that an update exists from a blue banner across the top of the Configuration app and the Enterprise Client, naming the new build. Dismissing the banner hides it only for that build.

Upgrade in this order.

1. Upgrade the Data Collector.

• Download the new TruGrid-RDSM-DC-Config.exe and replace the old copy on the server.
• Run it as administrator. Go to the Overview tab and look at the Data Collector Software box: Installed is what the service is running, Included is what this new file carries.
• Click Upgrade. It stops the service, replaces it and starts it again. Connected administrators drop for a few seconds.

1. Upgrade the AGENTs.

• Go to the AGENTs tab and click Refresh.
• For non-persistent VMs created via VM Pools, update the AGENT on source image and UPDATE the pool
• For all others, an amber banner reports how many are behind. Click Update all out-of-date.
• Each AGENT downloads the new version from your own Data Collector and restarts itself.
• Only AGENTs that are connected can be updated in this manner. Repeat later for hosts that were switched off, or the amber banner will keep reminding you.

1. Upgrade the Enterprise Client on each admin workstation, by replacing the program file. The banner in the client links to the download.

5.2 Certificates and AGENTs

This section only matters if you turned on HTTPS. It is short, and worth reading before you have a problem rather than after.

When an AGENT is installed against an HTTPS Data Collector, it is told which certificate to expect and it remembers it. From then on it will only talk to a Data Collector presenting that certificate. That is what stops something else impersonating your server.

Doing it safely

• Change the certificate only from the Configuration app, using Install to Trust and Update Connected AGENTs on the Settings tab. That tells every connected AGENT in the same action.
• Do it while your hosts are on, not overnight. Only connected AGENTs can be told.
• Afterwards, check the AGENTs tab. The certificate column should be clear for every row.
• Back up the certificate file with the database, as described in 5.3. Restoring a Data Collector without its original certificate has the same effect as changing it.

Reading the AGENTs tab

Fixing a host that can no longer connect

This has to be done on the host, or over the network to its disk, because there is no working connection to fix it over.

1. Get the current thumbprint from the Configuration app, Settings tab, HTTPS Certificate.
2. Open the AGENT's settings file on the affected host. Over the network that is: \HOSTNAME\C$\ProgramData\TruGrid RDS Manager Enterprise\Agent\appsettings.json
3. Set the CertificateThumbprint value to the current thumbprint. Take a copy of the file first.
4. Restart the TruGrid-RDSM-Agent service on that host.

Restart-Service TruGrid-RDSM-Agent

The host normally reappears within about a minute. Once it is back, it can be updated normally again.

5.3 Database size, history and backup

What is kept, and for how long

Detailed history is kept for 45 days by default. Older detail is summarised into hourly figures rather than being thrown away, so long-range charts still work while the database stays a sensible size. Tidying runs once a day in the background.

How big to expect

For a few hundred computers the database typically runs to a few gigabytes. If your system drive is small, move it to another volume using the File Locations section in 2.7 before it becomes a problem. It must stay on local disk: a network share is not safe for it.

Backing up

Everything that matters lives in one folder: C:\ProgramData\TruGrid RDS Manager Enterprise. Back up the whole folder.

1. Stop the TruGrid-RDSM-DC service. This flushes the database cleanly.
2. Copy the folder, including the database file, the configuration file and the certificate file.
3. Start the service again.

5.4 Troubleshooting

Nothing is appearing at all

A page or column is blank

An AGENT is not reporting

1. On the host, check the service is running: sc.exe query TruGrid-RDSM-Agent
2. Check the host's computer account is in one of your watched groups. Allow five minutes for a membership change to be noticed.
3. Look for a crash log at C:\ProgramData\TruGrid RDS Manager Enterprise\Agent\agent-crash.log
4. Check the host can reach the Data Collector on 5743 or 5744.
5. If the service is running and nothing is arriving, suspect the certificate. See 5.2.

An action failed

Appendix A - Ports and firewall rules

Not used by TruGrid RDSM Enterprise Manager: WinRM on 5985 and 5986, SMB on 445 for monitoring, SSH, and SNMP.

Appendix B - Where the files live

Appendix C - What each role can do

Appendix D - Settings reference

Set in the Configuration app, Settings tab

Port and interval changes need a service restart. The dark or light theme and the two path settings save separately from the main Save Settings button.

Set elsewhere in the Configuration app

Not on any screen

These exist but have no user interface. Contact TruGrid support if you think you need one changed.

Appendix E - What is collected, and from where

End of guide | TruGrid RDS Manager Enterprise | Rev 3, 2026-07-27 | Covers releases up to and including 2026.05.176

Updated on: 04/08/2026