# Managing devices {#managing-devices}

This page is for administrators. It covers the console side of [Takumi Agent](/docs/t/endpoint/index.md): enrollment keys, which ecosystems each device enforces, agent updates, decommissioning a device, diagnostics, and tamper evidence. All of it is under **Endpoint** in the left navigation.

Everything on this page needs the **Owner** or **Takumi Manager** role (see [Roles and Permissions](/docs/c/iam/permission.md)).

## Enrollment keys {#enrollment-keys}

An enrollment key registers a Mac as a device in your organization. Keys are listed under **Endpoint → Enrollment Keys**. [Quickstart](/docs/t/endpoint/quickstart.md#enroll-key) shows how to create one. Each key has a label, a maximum number of activations, and an expiry. The key itself is shown only once, when you create it.

**Revoke** on a key rejects new enrollments with it. Devices already enrolled with the key are unaffected.

The **Capabilities** toggles in the create dialog, grouped under **Guard**, limit what devices enrolled with the key get:

- **npm install protection**
- **PyPI install protection**
- **RubyGems install protection**
- **Go modules install protection**
- **Composer install protection**

Leaving them all on adds no restriction, so protections added in the future stay allowed too. A toggle marked **Org-constrained** is off for the whole organization, and turning it on for the key has no effect until the organization turns it on. You can change a key's capabilities later from its panel in the key list. Devices pick up the change without enrolling again.

## Which ecosystems a device enforces {#ecosystem-policy}

A device enforces an ecosystem only when all three of these allow it:

1. **The organization.** Under **Endpoint → Settings → Protections**, each protection from the list above has its own switch. Turning one off applies to every enrolled device at its next check-in: that traffic then goes straight to the registry without being checked.
2. **The enrollment key** the device enrolled with, as described [above](#enrollment-keys).
3. **A per-device override**, if you set one. Open the device, and in its **Protection** section click **Override for this device…**, turn a toggle off or on, then confirm with **Apply override**. The section then shows an **Override** badge. **Clear override** removes it.

When a protection is off, the device's **Protection** section shows which of the three turned it off. The egress lock (the network filter that blocks direct connections to the supported registries) follows the same settings: a device needs it as soon as it enforces at least one ecosystem. A device with ecosystems turned off still counts as protected, and the console shows it as **Protected, N off by policy** (see [Device states](/docs/t/endpoint/features/states.md#off-by-policy)).

## Updates {#updates}

The agent updates itself. New releases are downloaded and installed in the background, with no setup window and no new approvals, and reach every device within about an hour of release. No device is ever downgraded.

## Decommissioning a device {#decommission}

Decommission a device that is no longer used, for example a returned Mac or one that was uninstalled. Open the device and click **Decommission…** at the bottom of its detail panel, then type `decommission` and click **Decommission**.

The device stops working immediately: its identity and every token issued to it are revoked. This can't be undone. To use the machine again, enroll it again with an enrollment key. The device then shows **Revoked** (see [Device states](/docs/t/endpoint/features/states.md#revoked)).

## Diagnostics {#diagnostics}

A user can send diagnostics from the Mac with **Send to admin** on the app window's **Help** page. In the console, the device's detail panel has a **Diagnostics** section listing what the device has sent, newest first, each with a **Download** button. Diagnostics contain the device's status and recent logs, with tokens and private keys removed.

## Tamper evidence {#tamper}

A device can report evidence that its own health reporting was interfered with. The device then shows **Not protected** until an administrator acknowledges the evidence, and its detail panel gets a **Tamper evidence** section with what was detected and when it was **First observed**. [Troubleshooting](/docs/t/endpoint/references/troubleshooting.md#tamper) says what to do.

### Acknowledging tamper evidence {#acknowledge}

Acknowledge the evidence once you have checked the Mac:

1. Open the device and click **Acknowledge tamper…** in **Tamper evidence**.
2. Enter a reason, for example what you checked on the Mac.
3. Click **Continue**, check the reason, then **Acknowledge**.

The evidence clears right away, and the device detail shows who acknowledged it, when and why.

Acknowledging clears the recorded evidence and nothing else. If the device reports tampering again, it turns Not protected again. A device that keeps reporting evidence after being acknowledged really is being tampered with: [decommission it](#decommission) and investigate the machine.