Documentation

What is Triage?

Triage is a Windows health tool for IT professionals and small businesses. It scans any Windows 10 or 11 computer in under two minutes, shows you a plain-English list of every fixable problem, and lets you apply fixes one click at a time — with a safety backup created before anything is changed.

There are two ways to use Triage:

Both modes use the same scan and repair engine. Fleet mode adds automatic monitoring, a central dashboard, and the ability to run fixes on machines remotely — without physically sitting at them.

What do I need?

To use the desktop app

• A Windows 10 or Windows 11 computer (64-bit)
• Administrator access on that machine — Triage needs this to scan and fix protected system settings
• About 90 MB of disk space
• An internet connection is optional — only needed for AI-powered diagnostics and checking for driver updates

To use fleet mode

You'll need two things: a server to run the dashboard, and the Agent installed on each machine you want to monitor.

For the server (one machine that acts as the central hub):

• Any computer that stays on — a Windows PC, Windows Server, or a cheap Linux virtual machine all work
• Docker Desktop installed on that machine (free download — it's the software that runs the Triage Server)
• The server needs to be reachable over the network from your other machines (same Wi-Fi or LAN is fine)

For each managed machine (the Agent):

• Windows 10 or Windows 11 (64-bit)
• Administrator access for the initial install
• Network access to the server machine

Install the desktop app

irm 'https://raw.githubusercontent.com/Kayem196/triage/main/Install-Triage.ps1' | iex

Running from a USB drive

Triage can also run directly from a USB drive with no installation required — useful when you're visiting a client's machine and don't want to leave anything behind. Copy Triage.exe to a USB drive and run it. Administrator access is still required on the machine.

First launch

Find Triage in the Start menu. Windows will ask for administrator permission — click Yes. This is expected: Triage needs this access to scan and repair system settings.

Running your first scan

Once Triage is open, a full scan takes less than two minutes. Nothing is changed during the scan itself — it's purely a read-only inspection.

What Triage can fix

Triage includes over 40 automated fixes, organised by category. Every fix shows a risk rating before you run it.

System files

Windows Update

Disk & storage

Shell & display

Network

Microsoft 365

How fleet management works

Fleet mode lets you monitor and fix all your Windows machines from a single web page — without sitting at each one. Here's how it fits together:

What the day-to-day looks like

1. You set up the Server once on a machine that stays on (15–20 minutes).
2. You install the Agent on each machine you want to monitor — takes about 30 seconds per machine, or you can push it to all machines at once via Intune or a script.
3. From that point, everything is automatic. The Agent runs health scans every hour and sends the results to your dashboard.
4. You open the dashboard whenever you like, see which machines need attention, and apply fixes — without leaving your desk.
5. Both the Server and the Agent update themselves automatically when a new version is released. There's nothing to manually maintain.

Set up the server

The Triage Server runs as a Docker container — Docker is free software that packages the server into a self-contained unit that's easy to start, stop, and update. You install Docker once, then Triage handles the rest.

irm 'https://raw.githubusercontent.com/Kayem196/triage/main/Setup-TriageServer.ps1' | iex

Automatic updates

The server keeps itself up to date automatically. A companion program called Watchtower checks for a new version every hour and updates the server in the background. When an update happens, any open browser sessions will briefly show a "Server update in progress" notice, then reconnect automatically.

Backing up your data

All machine data is stored in a single database file on the server. You can back it up from Settings → Backup in the dashboard, or copy the triage_data Docker volume manually. Keep regular backups if your machine data is important to you.

Put Triage on every machine

Once your server is running, you need to install the Triage Agent on each machine you want to monitor. There are a few ways to do this — pick the one that fits how you manage your machines.

irm 'http://your-server:8080/install.ps1' | iex

After the Agent is installed

The machine registers with your server within a few seconds and sends its first health report within a minute. You'll see it appear in the dashboard with its current health score. From that point:

• The Agent runs a full health check every hour automatically
• It checks in with the server every 5 minutes and picks up any remote fix commands you've sent
• It updates itself automatically when a new version is available
• Staff using the machine see nothing — the Agent runs silently in the background

Using the fleet dashboard

What the colours mean

Pages in the dashboard

Pushing a fix to a machine

Click any machine card or open the machine detail page. You'll see a Push scan button (run a health check right now, outside the hourly schedule) and a Fix button to send a specific repair. The machine picks up the command within 5 minutes and reports back the result.

Your data & privacy

Where your data goes

All machine data stays on your server — it never goes anywhere else. Triage has no cloud backend and no central data collection. Everything the Agent reports goes directly to the Triage Server you're running, stored in a database file on that machine.

The only exception is AI diagnostics: if you choose to enable the AI-powered analysis feature (which requires you to configure an Anthropic API key in settings), Triage will send finding descriptions to the Anthropic API. No personal information about your staff or their files is included.

What the Agent collects

The Agent collects technical health indicators — nothing personal:

• Computer name and Windows version
• Whether key background services are running or stopped
• Startup programs and whether they're enabled
• How much space temp files are taking up (not the files themselves)
• Network settings (DNS addresses, proxy configuration)
• Driver version numbers for key hardware
• Microsoft 365 app health indicators (cache sizes, sync error flags)

The Agent never collects file contents, browser history, passwords, emails, documents, or any information that identifies individual people.

Keeping your server secure

• Use a strong dashboard password and don't share it broadly
• If your machines connect to the server over the internet (not just your local network), put Triage behind a reverse proxy with HTTPS — your IT team or hosting provider can help with this
• Use an enrollment key so only your machines can join your fleet — set this during server setup
• The server updates itself automatically, so it stays patched without manual effort

Removing Triage

Remove from a Windows machine

One script removes everything — the desktop app, the background Agent, all Triage files, and any related scheduled tasks. Run it as administrator in PowerShell:

irm 'https://raw.githubusercontent.com/Kayem196/triage/main/Uninstall-Triage.ps1' | iex

You'll be asked to confirm before anything is deleted. To skip the confirmation (for example, when deploying via Intune), add -Force to the command.

Remove the server

On the machine running the server, open a terminal in the folder where you ran the setup script (where docker-compose.yml lives) and run:

# Shut down the server, but keep all your machine data
docker compose down

# Shut down the server AND delete all stored data
docker compose down -v

To also remove the Docker images from your machine: docker compose down --rmi all

Troubleshooting

Triage says "You need administrator rights"

Triage requires administrator access to run scans and apply fixes. Close Triage, right-click the Triage icon in the Start menu, and choose Run as administrator. If you don't have administrator rights on that machine, ask your IT admin to run it.

The MSIX install fails or says "app not trusted"

This means the developer certificate wasn't installed first — or was installed to the wrong place. The certificate must go to Local Machine → Trusted People (not "Current User"). Use the one-line install command instead, which handles this automatically, or re-run the certificate install with admin rights and double-check you selected Local Machine on the first screen.

A machine isn't showing up in the dashboard

Check these things in order:

1. Is the Agent installed? Open Services on the machine (press Win+R, type services.msc) and look for Triage Agent. If it's not there, run the install command again.
2. Is the service running? If it shows Stopped, right-click it and choose Start.
3. Can the machine reach the server? In PowerShell on the machine, run: Test-NetConnection -ComputerName your-server -Port 8080. If it shows "TcpTestSucceeded: False", there's a network or firewall issue between the machine and the server.

The Agent is running but keeps going offline

This usually means the machine can reach the server on the network, but something is blocking the connection. Check that port 8080 (or whichever port you configured) is allowed through any firewalls on both the machine and the server host. Also check that the server is actually running: open the dashboard address in a browser from a different machine — if it loads, the server is fine.

The server auto-update isn't working (machine stays on old version)

The auto-update system (Watchtower) needs to be able to pull the new server image from the internet. If you set up the server from a private GitHub repository, go to github.com → your profile → Packages → triage → Package settings and change the visibility to Public. Without this, Watchtower can't download updates.

The dashboard keeps logging me out

Sessions last 8 hours and then expire — this is expected. If you're being logged out more frequently, it usually means the server was restarted recently and generated new security tokens. This is normal after a server update. Just log in again; the issue won't recur until the next update.

Still stuck?

Email us at hello@triage-tool.app and we'll help. Include the machine name, a description of what you were trying to do, and any error messages you saw.