What Happens During a Scan from Automox?

Overview

When Automox performs a scan, the agent executes several key commands to gather information about the device, and the combined results are what populate the Device Details page after the scan completes. (For how scans differ from check-ins, see What is a Check-In vs Device Scan.)

Two behaviors explain most questions about scan activity:

• The scan runs one command at a time, in order.
  • Each step waits for the previous command's result before the next command is dispatched, with NeedsReboot always last — its result is what updates the device's reboot-required status.
  • Because the steps are sequential, a slow step delays everything after it; a scan that seems to pause mid-way is usually waiting on GetSoftware, the most time-intensive step.
• The command set depends on which scan experience the organization is on.
  • On the newer scan experience, the scan is a four-command chain: GetOS → GetSystemDetail → GetSoftware → NeedsReboot. GetHostname and GetAWSID no longer run as scan commands — hostname and cloud-instance data are collected through the device inventory system instead, so their absence from scan activity is expected, not an error.
  • On the older scan flow, GetHostname and GetAWSID also run as part of the scan.

Main Commands

1. GetOS

Retrieves the device's operating system information, including version and build number. The script verifies and updates the Automox Worklet Development Kit, secures local files, syncs software catalogs, and queries native OS tools (WMI on Windows, sw_vers on macOS, or os-release on Linux).

2. GetSystemDetail

Collects critical system details including compliance status, last logged-on user, and update source configuration. It queries system APIs for CPU, RAM, disk drives, volumes, and network adapters.

3. GetSoftware

Scans the registry and file system to catalog installed applications, patches, and updates, and evaluates applicable OS updates and supported third-party updates. This is the most time-intensive command and produces the largest payload.

4. NeedsReboot

Checks whether the device requires a reboot by querying OS-native flags. It includes custom filtering logic to avoid false-positive reboot flags. Always the final scan step.

Older Scan Flow Commands

These run as scan commands only on organizations using the older scan flow; on the newer scan experience this data comes from device inventory instead.

GetHostname

Fetches the device name for console identification. This lightweight script uses native system utilities like hostname, with fallback to environment variables if unavailable.

GetAWSID

For AWS environments, this command gathers relevant AWS metadata. The script checks hardware/BIOS metadata for "EC2" or Amazon manufacturer designation, then queries the internal AWS metadata IP address (169.254.169.254) using IMDSv2 security tokens. An empty result on any device that is not an EC2 instance is normal.

Conditional & Evaluation Commands

• ModifyOsAutoUpdateSetting: Dispatched when the scan detects the device's OS auto-update setting does not match the assigned group's configuration (Windows and macOS).
• Worklet Evaluation: Triggered if Worklets are associated with the device or group.

Troubleshooting

• A command reports a failure or "Command timed out": see Activity Log Shows "Command timed out".
• A macOS scan stalls specifically on GetSoftware: see macOS Encounters Stuck GetSoftware Command.
• GetHostname or GetAWSID do not appear in scan activity: expected on the newer scan experience (see Overview) — not an error.
• Device Details shows stale data: the device most likely has not completed GetSoftware yet; run Scan Device from Device Details and allow the scan to finish.

Notes

• Patch and remediation commands (for example, InstallUpdate) are not scan commands — they run only when a policy or console action dispatches them. For interpreting their result codes, see Automox Return Codes.
• The same command names are used on Windows, macOS, and Linux; the collection method differs per platform.