Fleet Posture at a Glance: Which Windows Machines Need Attention Right Now

You run winsentinel-fleet nodes summary and get a tidy roll-up: 40 nodes, 32 active, a grade distribution, some heartbeat ages. Reassuring. But it does not answer the only question a security lead actually has at 9am: which machines do I need to fix, and what are they called? A grade histogram tells you three nodes are failing; it does not tell you they are the two domain controllers and the finance workstation.

Aggregate counts are a scoreboard. Incident response needs names.

Free gives you the agent. Pro gives you the fleet view.

WinSentinel is open-core. On a single machine the free CLI is full-power: every audit module, real-time monitor, scheduled scans, PDF reports, one-click fixes — all local, all unlimited. That is genuinely the best standalone Windows posture tool you can install.

What Free does not do is span machines. The moment you have more than a handful of Windows boxes — a dev team, a startup's laptops, a rack of build agents — you stop caring about any one machine's score and start caring about the worst ones. That cross-node view is the Pro control plane: each machine runs the (free) agent, phones home, and the Pro fleet commands roll it all up.

The needs-attention callout

The fleet nodes summary now ends with an attention line — but only when there is something to act on. A clean fleet stays quiet; a fleet with problems names them:

Fleet nodes summary
───────────────────
  Totals:     40 enrolled  •  38 graded  •  2 ungraded
  By status:  active 34  stale 4  offline 2
  Heartbeat:  freshest 41s ago  •  stalest 9d ago  •  2 never seen
  By grade:   A 18  B 11  C 6  D 2  F 1
  ⚠ Attention: 3 failing (D/F)  •  2 offline  •  2 never seen   e.g. DC-01, FIN-WS-04, BUILD-07, …

That last line is the whole point. In one glance you know:

• 3 failing (D/F) — nodes whose latest scan graded out at a D or F. These are misconfigured or drifting hosts, not just "a bit behind."
• 2 offline — nodes the control plane has marked down. Either the agent stopped or the box did.
• 2 never seen — enrolled but they have never sent a heartbeat. Usually a broken agent install or a firewall eating the phone-home.
• e.g. DC-01, FIN-WS-04, BUILD-07 — the actual machine names, so you open a ticket for the right box instead of hunting through a node list.

The summary also tracks the single stalest node, so "who has gone quietest" is a stable, machine-readable field — useful for alerting and for the --json output that feeds dashboards.

Why "only when it matters"

A monitoring surface that shouts on every run trains you to ignore it. The attention line is suppressed entirely on a healthy fleet — no line, no noise. When it appears, it means action is genuinely required. That is the same discipline the per-machine WinSentinel findings follow: severity you can trust because it is not diluted by busywork.

It is a rollup, not new telemetry

Nothing new is collected to produce this. The attention line is a pure, defensive roll-up of the enrolled-node records the control plane already has: grade, status, and heartbeat age. It works on a sparse fleet (missing fields do not throw), it names up to a few example nodes with a trailing “…” when there are more, and the same numbers are available as structured fields under nodes summary --json for anyone wiring it into their own alerting.

The mental model

Free WinSentinel makes one machine bulletproof. Pro turns a pile of those agents into a managed fleet with a control plane — and the first job of a control plane is to tell you, without you asking, which node to look at next. The needs-attention callout is that answer in one line.

Single machine? The free CLI has everything. Managing many? WinSentinel Pro is the fleet view.