Staff ask a fair question about the small program IT installed on every PC: what can it actually do? This page answers it straight — the full power list, the real limits, and the governance that makes the power acceptable.
Let us say the quiet part plainly: the Endpoint Central agent is powerful by design. It runs on the PC as a service with system-level rights, because the jobs it does — installing patches and software without asking the user to be an administrator, enforcing configurations, scanning the whole machine — are impossible without that level of access. The same power is why the agent is protected against casual uninstall, and why the console behind it deserves serious security. Honesty about the powers, plus visible governance, is what separates 'management agent' from 'spyware' in the minds of the people whose PCs these are — and the distinction is real, so it is worth explaining properly.
The agent's working day: it scans the PC for missing patches and installed software and reports the results; it installs patches, software packages and updates with system rights, including when no user is logged in; it applies configurations the admin deploys — settings, scripts, policies; it carries remote control, letting an admin connect to the desktop to fix problems; and it reports inventory — hardware, software, and changes to both. Nothing on this list is hidden functionality; it is the published job description of an endpoint management agent, and it is exactly what the office is paying the product to do. If a capability is not on the admin's console, the agent does not invent it.
Of all the powers, remote control is the one users picture, so handle it with the most transparency. A remote session is initiated by an admin from the console — the agent does not wander desktops by itself — and Endpoint Central can be configured to ask the user's confirmation before a session connects, which is the right setting for office PCs where someone is working. Sessions are administrative events, visible in the product's logs and reports. The sensible office policy writes this down: who may take sessions, that confirmation is on, and that sessions are for support. Staff who have read that policy stop fearing the agent; staff who discover remote control by rumour do not.
The limits matter as much as the powers. The agent cannot act while the PC is off, and cannot reach a server it cannot contact — the roaming gap from the laptop guide. It cannot read the contents of properly encrypted data without the keys, and it does not record keystrokes or harvest personal files as part of management — its inventory is of the machine and its installed software, reported in the console for anyone with console access to see. It also cannot act on its own initiative: everything it does arrives as an instruction, scan schedule or policy from the server. An agent on a PC whose server is retired sits idle — which is precisely why the uninstall guide insists on removing agents when a server is decommissioned.
Follow the power to its source: whoever controls the Endpoint Central console can, through the agents, touch every managed PC. So console security is fleet security. Use individual admin accounts (never a shared 'admin' login the whole IT team uses), give each person only the role they need, protect those accounts with strong passwords and the product's available sign-in protections, and keep the server itself patched like the critical system it is. Review console users when staff leave IT. These are unglamorous controls, but they are the actual answer to 'is this agent safe' — the agent is as trustworthy as the hands on its console, so make sure those hands are few, named and accountable.
The PC end has its own protections, covered in depth in the uninstall guide: the Agent Protection Settings that stop users uninstalling the agent without a console-held OTP, and stop them halting the agent service. Enable them, and also think one step further — the agent's trust depends on the PC's own hygiene. A user who is a local administrator can ultimately defeat most installed software given enough determination; the protection settings handle the 99 percent (accidents, tidiness, casual curiosity) and the console's last-contact reports catch the rest, because a PC whose agent vanishes shows up stale within days. Power plus visibility, on both ends, is the complete design.
Finally, the human layer, which decides whether this powerful tool is accepted or resented. Tell staff, in writing, in plain words: the office PCs carry a management agent; it keeps the PC patched, lets IT fix problems remotely with your confirmation, and reports the machine's health and installed software to IT; it exists on office machines because they are office machines. That one honest paragraph — modelled on this page — prevents almost every rumour an agent can attract. Management tools deployed quietly and explained never are the ones that end up called spyware in the canteen. The agent's powers are legitimate; say them out loud and they stay that way.
See exactly what gets installed on the PC in the video — the program whose powers and limits this guide has laid out.
▶️ Watch Full VideoThe agent reports machine inventory — hardware, installed software, patch state — and enables admin-initiated remote control. It is not a file-harvesting or keystroke-recording tool. On office PCs, though, the honest rule stands: treat the machine as a work machine, because IT administration on it is real.
A remote session is started by an admin from the console, and Endpoint Central can require the user's confirmation before connecting — the setting offices should enable for attended PCs. Sessions are administrative actions in the product's logs, attributable to the admin who started them.
Because its jobs require them: installing patches and software for users who are not administrators, applying machine-wide configuration, and scanning the whole system. Management without that level of access would fail at the first install. The rights are the reason the console and the agent both deserve the protections described in this guide.