Knowledge Base

Get started with TeamViewer DEX Essentials

Last Modified: Dec 2, 2025

TeamViewer DEX (Digital Employee Experience) Essentials is the streamlined, easy-to-deploy digital workplace platform explicitly built for modern businesses. It helps IT teams proactively resolve issues before interrupting work, enhancing efficiency, strengthening employee productivity, and keeping IT in control.

By reducing repetitive tasks, preventing downtime, and delivering actionable insights for compliance, TeamViewer DEX Essentials empowers IT teams to make smarter decisions faster. The result? A streamlined, future-ready platform that ensures employees stay productive, connected, and supported—wherever they work, on whatever device.

This article applies to all TeamViewer DEX Essentials customers.

Prerequisites

To utilize TeamViewer DEX Essentials, the following prerequisites must be met.

A TeamViewer Business, Premium, Corporate, Tensor license, TeamViewer One Standard or TeamViewer One Advanced must be activated for the account/Company Profile.
Windows 10 (x64) (22H2) or later is installed.
macOS 14 Sonoma or later is installed.
TeamViewer Host or Full Version 64-bit (x64) version 15.72.4 or later must be installed.
The TeamViewer account must have a Company set up, and the Devices must be managed by the Company.
The new UI must be used.

TeamViewer DEX Essentials interactive demo

To get a feel for the services, we have created the following demo that walks through the main components:

TeamViewer DEX Essentials interactive demo

How to activate TeamViewer DEX Essentials

Once the license is activated for the account and Company Profile, the region for tenant provisioning (and, therefore, data storage) must be selected. Currently, the EU, UK, Canada, or the US (East or West) can be chosen.

Tenant provisioning begins after activation, working in the background, and takes about 5 minutes. Customers will be notified upon completion, both in-product and via email, as soon as the device is ready for usage. Once completed, device setup can begin.

TeamViewer DEX Essentials can be activated via device groups or by selecting individual devices.

Service Administration Permission

To activate TeamViewer DEX Essentials on a group or device, the user must be a group or device manager and require the Service administration permission. If the manager of the device is a company admin or has Manage administration permission on the device or group level, then the Service administration permission is added automatically during the DEX Essentials activation process, no need for extra steps.

Activate via device groups

Group activation is recommended for automated and large-scale activation. Offline devices will be pending activation and will try to activate once they turn online. When using group activation, new devices added to selected groups will be activated automatically. You can only select a maximum of 100 groups at a time for activation.

Activate via devices

Individual device activation is recommended for selective activation, allowing you to activate specific devices without affecting the rest of the group. Offline devices will be pending activation and will try to activate once they turn online. You can only select a maximum of 100 devices at a time for activation.

Manage activations

To access and manage your activations, click the Manage Activations button located in the top right corner of the DEX Essentials page header.

The Manage activations page has 2 tabs: Activated and Pending.

Activated: Shows all devices and groups you manage that are currently activated with DEX Essentials.

Actions:

Deactivate DEX Essentials on an individually-activated device.
Deactivate DEX Essentials on a group.

Note: Devices activated on the group level cannot be individually edited.

Pending: Shows all devices in pending states or for which (de)installation has failed.

Status:

Pending activation/deactivation – Offline devices pending (de)activation will attempt to (de)activate once they come online.
Failed activation/deactivation – devices where there was an error in the (de)activation.

Actions:

Retry for failed activation/deactivation
Cancel activation for pending activation/deactivation

Note: Pending activations/deactivations for devices activated on the group level cannot be canceled.

Deprecation of activation via TeamViewer policy

TeamViewer Host or Full Version 64-bit (x64) version 15.71 or earlier uses a different activation process, where TeamViewer DEX Essentials is activated for the devices via a TeamViewer policy by adding the Advanced Monitoring (using 1E technology) policy rule. An existing TeamViewer policy can be used (updated with an additional setting), activating TeamViewer DEX Essentials for all online devices currently assigned to the policy.

Activation via policy is being deprecated and replaced with activation via devices/groups.

Please update TeamViewer Host or Full version on devices using this setting. Devices must be updated to at least TeamViewer version 15.72.4 or later to manage activation via devices/groups. For devices with DEX Essentials currently activated via policy, once TeamViewer is updated on the device, the device will automatically migrate to the new way of managing activations and remain activated with DEX Essentials.

Functionality

Insights

Upon product activation, the 1E offline agent is deployed to each device. This begins the delivery of instruction packages that scan for common IT health issues. TeamViewer DEX Essentials presents actionable insights across all monitored devices, and users can drill down to specific topics by clicking on device icons.

If a compliance check fails, the device is displayed as Impacted and, therefore, non-compliant.

One feature of TeamViewer DEX Essentials is the generation of Insights. This is done via prebuilt policies applied to devices under management, via the installation of the 1E agent. The following insight categories are provided:


Performance	Improve productivity and experience by eliminating device slowdowns before they impact work.
Applications	Keep employees productive by resolving app crashes and slowdowns that impact productivity.
Operating System	Reduce frustration and IT noise by keeping devices stable and responsive, without user disruption.
Security	Ensure critical security services and apps are working correctly, keeping your business secure.
Networking	Ensure seamless collaboration and fewer support tickets by resolving connectivity issues before users even notice.

Another Insights feature is the Purpose and context section, which is found in the device drawer. This section provides a description of the Insight itself, explaining its function and how it can help.

The following breakdown explains the insights provided by TeamViewer DEX Essentials.

Windows-specific Insights

Insight	Reasoning	Compliance Check	Remediation Process
Critical Services	Essential to core system functions such as networking, printing, updates, and system management. If any of these services are not in their expected state, whether stopped or incorrectly configured, it can lead to failed updates, broken group policies, delayed troubleshooting, or degraded user experience.	An endpoint fails compliance if one of the set of monitored services is not in the expected state A compliance check is run if any monitored service changes state (no fixed check interval).	For the BITS Service, remediation consists of setting the service startup mode to Manual and stopping the service. For all other services, remediation consists of setting the service startup mode to Automatic and starting the service.
Disk Space Management	The Disk Space Management Insight monitors free disk space on endpoints. When disk space falls below a trigger value, the insight check indicates that the endpoint is not compliant. Disk space can then be freed manually or automatically.	An endpoint fails compliance if its primary drive (OS drive) free space falls below 10 GB. A compliance check is run every 4 hours.	The Windows disk cleanup manager (cleanmgr.exe) is run with the /autoclean parameter. This removes temporary setup files and other files that should not be required on the endpoint, which may have been retained after Windows updates. User files are not affected. This includes the contents of the Recycle Bin.
Office 365 Crashes	The Office 365 Crashes Insight examines the activity history of core Office 365 components to determine whether any of them have crashed within a 24-hour window.	An endpoint fails compliance if any monitored Office 365 component has crashed more than once in that period. Compliance checks to see if Office 365 has crashed more than once in a 24-hour period.	Remediation is attempted only for the first logged-on user who is found. The Office File Cache is deleted. The Office Roaming Cache is deleted.
Operating System Crashes	Operating system crashes and BSODs are serious indicators of system instability, often caused by driver issues, hardware faults, or corrupted OS files. Even a single crash can disrupt work, lead to data loss, and signal deeper reliability problems.	An endpoint fails compliance if any monitored OS component crashes at least once in the specified period. A Compliance check is run once every 4 hours.	The Windows System File Checker tool (SFC) is run with the /scannow parameter to detect and repair corrupt Windows operating system files.
Page File Configuration	The Page File Size Insight determines whether the page file on the operating system disk is sized appropriately for the device's physical memory. It allows this to be automatically adjusted to the appropriate size.	An endpoint is compliant if the page file size is considered appropriate for the amount of physical memory reported by the endpoint. A compliance check is run once every 48 hours	If the endpoint reports that it has SSD-based storage, Windows will automatically manage the pagefile size. If the endpoint reports HDD-based storage, the pagefile size is set to 1.5 * the physical memory reported by the endpoint UNLESS this would result in less than 3 GB free disk space. In that event, no change is made to the page file size.
System Restore	The System Restore Insight verifies that system restore functionality has been activated on an endpoint.	An endpoint fails compliance if System Restore functionality is found to be disabled. A compliance check is run once every 48 hours.	Remediation consists of running the PowerShell Enable-ComputerRestore cmdlet on drive C.
Teams Crashes	Frequent Teams crashes can disrupt meetings, reduce user productivity, delay decision-making, and cause department frustration.	An endpoint fails compliance if any monitored Teams component crashes more than once during that period. A Compliance check is run if Microsoft Teams has crashed more than once in a 24-hour period.	Teams cache is deleted, and required updates are being run. Remediation is attempted for all logged-on users.
Time Sync	The Time Sync Insight verifies that the endpoint local clock is correctly synchronized with the time reported by the platform switch component.	An endpoint fails compliance if the endpoint's local time differs by more than 30 seconds in either direction from the reported Platform Switch time. A Compliance check is run once every 4 hours.	Remediation consists of running the Windows w32tm (Opens in a new tab)executable with the /resync parameter
Windows Fast Startup	The Windows Fast Startup Insight checks whether an endpoint is configured for Windows Fast Startup. If it is, the remediation instruction allows the feature to be turned off on the target endpoints.	An endpoint fails compliance if the Fast Startup option is enabled. A Compliance check is run once every 48 hours	Customers may choose to configure the insight to be remediated manually (the default) or automatically. In either case, the actual remediation process is identical. The Fast Startup registry key is updated to disable Fast Startup.
WMI Repository	The WMI (Windows Management Instrumentation) repository is a core Windows component used by system tools, scripts, and management platforms to retrieve hardware and software information. If the repository becomes inconsistent or corrupted, it can cause failed inventory scans, broken automation, and inaccurate device reporting, impacting everything from software deployments to compliance audits.	An endpoint is compliant if the WMI integrity check returns success. The WMI integrity check is performed using the Microsoft WinMGMT tool. A Compliance check is run once every 48 hours	Remediation consists of running the wmimgmt tool with the /salvagerepository option. This will attempt to repair any repository corruption.
Windows Defender Signature Age	The Windows Defender Signature Age insight determines the age of the most recent Windows Defender Signature file. It allows the file update to be manually or automatically initiated to ensure that the most recent signature file has been uploaded.	An endpoint fails compliance if the signature file is more than one day (24 hours) old. A Compliance check is run once every 24 hours.	The PowerShell cmdlet Update-MpSignature is run as shown below: Update-MpSignature -UpdateSource MMPC.
OneDrive Sync	If OneDrive is not syncing correctly, the user may find that files they update locally in their OneDrive folder are not synchronized with the cloud copy or that changes they make to the local OneDrive folder, such as adding or deleting files, are not mirrored in the cloud. This can cause data loss or other productivity issues.	An endpoint fails compliance if the latest entry in the OneDrive log folder for the user is more than one day old. A Compliance check is run once every 24 hours.	The OneDrive.exe control program is run as shown below: OneDrive /reset
Windows Firewall	If the Windows Firewall is not enabled, or not configured to block inbound ports, this can allow malicious software to make connections inbound to the endpoint and potentially exfiltrate information from the endpoint.	An endpoint fails compliance if the firewall status is enabled for all profiles and inbound ports are blocked. A Compliance check is run once every 24 hours.	Remediation consists of running the PowerShell cmdlet get-netfirewallprofile. This is run twice, first to ensure all profiles are enabled and secondly to ensure that inbound ports are blocked and outbound ports are allowed.
ThreatDown	If an endpoint running ThreatDown is not correctly configured, essential antivirus protection might be lost, allowing an attack against the endpoint.	An endpoint fails compliance if any of the monitored services are not running or their startup mode is not Automatic. A Compliance check is run every 5 minutes	If any monitored service is not running or not configured with a startup mode of Automatic, it is started, and the startup mode is configured to Automatic. Note that some MalwareBytes services are marked as Protected. This should mean that they cannot be changed in their state or startup mode.
Windows Update Failure	Windows Update is critically important to ensure that endpoints are fully protected from malware and to ensure that all defects in software corrected by updates are deployed in a timely manner.	An endpoint fails compliance if the latest update has not run in the last 24 hours or there are pending updates A Compliance check is run once every 24 hours.	Remediation consists of running the usoclient utility. It is run twice, as follows: usoclient startinteractivescan usoclient startscan
TeamViewer service check	The TeamViewer agent allows the system administrator to access and control endpoints remotely. If the service is not running, the agent will not be able to allow this functionality.	An endpoint fails compliance if the TeamViewer service is not running or not registered. A Compliance check is run once every 24 hours.	The TeamViewer service is started, and its startup mode is set to ‘Automatic’.
Microsoft System File Checker	Microsoft’s System File Checker is intended to scan for and optionally repair scenarios in which one or more system files, such as DLLs, appear to be corrupt. For more information on the SFC tool, see the link below: SFC scannow - Microsoft Community	An endpoint fails compliance if sfc /VerifyOnly reports any errors. A Compliance check is run once every 24 hours.	Remediation consists of running sfc /ScanNow. This will attempt to repair any detected corrupt files.
Chrome Cache	Corrupted or outdated Chrome cache data can cause slow performance, page-rendering problems, login failures, and inconsistent behavior in web-based tools. Regularly clearing the cache helps prevent user disruption and repetitive browser troubleshooting.	Verifies whether Google Chrome is installed on the endpoint. If Chrome is present, the endpoint is considered eligible for remediation under this insight. A Compliance check is run every four hours.	Remediation consists of: Closing any running instances of Google Chrome. Deleting the Chrome cache folder from:\Google\Chrome\User Data\Default\ Chrome automatically rebuilds the cache the next time the user starts the browser.
Intune Cache Reset	Corrupted or stale Intune cache data can cause device-management policies, application deployments, and configuration updates to fail or behave inconsistently. Possible effects include delayed policy enforcement, failed installations, and repeated remediation attempts. Clearing the cache proactively helps Intune operate reliably and reduces reactive troubleshooting.	Verifies whether the Intune Management Extension exists on the Windows endpoint. If the extension is present, the endpoint is considered eligible for remediation A Compliance check is run every four hours.	Remediation consists of: Stopping the Intune Management Extension service Clearing the Intune cache folder: \Content\Incoming Clearing the Intune staging folder: \Content\Staging Clearing the IME cache folder: C:\Windows\IMECache Clearing the logs from %Program Data%\Microsoft → Intune Management Extension → Log Restarting the Intune Management Extension service. Forcing an Intune synchronization. This removes corrupted or stale cache data and allows the endpoint to establish a clean synchronization state with Intune
Location Service	Organizations may require Windows Location Service to be enabled or disabled for security and compliance purposes. An incorrect state can cause policy violations, privacy concerns, or noncompliance with organizational or regulatory requirements. The insight enforces the desired state without requiring manual intervention.	Compares the current state of Windows Location Service with the configured policy: If the service is configured to be enabled: The endpoint is noncompliant when the service is not running. If the service is configured to be disabled: The endpoint is noncompliant when the service is running. A Compliance check is run every four hours.	The remediation process enforces the configured state: If Location Service should be enabled, the service is started. If Location Service should be disabled, the service is stopped.
Powershell Health	PowerShell is a critical dependency for endpoint management, remediation, and automation workflows. If PowerShell is missing, misconfigured, or not operating correctly, processes such as Intune operations and remediation scripts may fail. Regular validation identifies these problems and confirms that endpoints can execute management and remediation scripts	The insight tests PowerShell by executing: PSVersionTable.PSVersion.ToString() The endpoint is considered noncompliant if any of the following exist: PowerShell is not present. The command cannot run successfully. PowerShell is otherwise not functioning as expected. A Compliance check is run every four hours.	To remediate, the user must: Open Command Prompt as an administrator. Run: DISM /Online /Cleanup-Image /RestoreHealth Run: sfc /scannow Restart the computer after both processes finish.
Windows RDP	Organizations may require Windows Remote Desktop to be explicitly enabled or disabled. If Remote Desktop is enabled when it should be disabled, it can introduce an unnecessary security risk. If it is disabled when required, it can prevent legitimate remote access and support scenarios.	The check validates Windows Remote Desktop by examining the state of the Terminal Services service, TermService, against the configured policy: If Remote Desktop should be disabled: The endpoint is noncompliant when TermService is running. If Remote Desktop should be enabled: The endpoint is noncompliant when TermService is not running. A Compliance check is run every four hours.	The remediation process enforces the configured state: If Remote Desktop should be disabled: TermService is stopped. If Remote Desktop should be enabled, TermService is started.

Insight	Reasoning	Compliance Check	Remediation Process
Critical Services	Essential to core system functions such as networking, printing, updates, and system management. If any of these services are not in their expected state, whether stopped or incorrectly configured, it can lead to failed updates, broken group policies, delayed troubleshooting, or degraded user experience.	An endpoint fails compliance if one of the set of monitored services is not in the expected state Compliance check is run if any monitored service changes state (no fixed check interval).	For the BITS Service, remediation consists of setting the service startup mode to Manual and stopping the service. For all other services, remediation consists of setting the service startup mode to Automatic and starting the service.
Disk Space Management	The Disk Space Management Insight monitors free disk space on endpoints. When disk space falls below a trigger value, the insight check indicates that the endpoint is not compliant. Disk space can then be freed manually or automatically.	An endpoint fails compliance if its primary drive (OS drive) free space falls below 10 GB. Compliance check is run every 4 hours.	The Windows disk cleanup manager (cleanmgr.exe) is run with the /autoclean parameter. This removes temporary setup files and other files that should not be required on the endpoint, which may have been retained after Windows updates. User files are not affected. This includes the contents of the Recycle Bin.
Office 365 Crash	The Office 365 Crashes Insight examines the activity history of core Office 365 components to determine whether any of them have crashed within a 24-hour window.	An endpoint fails compliance if any monitored Office 365 component has crashed more than once in that period. Compliance check if Office 365 has crashed more than once in a 24-hour period.	Remediation is attempted only for the first logged-on user who is found. The Office File Cache is deleted. The Office Roaming Cache is deleted.
Operating System Crash	Operating system crashes and BSODs are serious indicators of system instability, often caused by driver issues, hardware faults, or corrupted OS files. Even a single crash can disrupt work, lead to data loss, and signal deeper reliability problems.	An endpoint fails compliance if any monitored OS component has crashed at least once in that period. Compliance check once every 4 hours.	The Windows System File Checker tool (SFC) is run with the /scannow parameter to detect and repair corrupt Windows operating system files.
Page File Configuration	The Page File Size Insight determines whether the page file on the operating system disk is sized appropriately for the device's physical memory. It allows this to be automatically adjusted to the appropriate size.	An endpoint is compliant if the page file size is considered appropriate for the amount of physical memory reported by the endpoint. Compliance check once every 48 hours.	If the endpoint reports that it has SSD-based storage, Windows will automatically manage the pagefile size. If the endpoint reports HDD-based storage, the pagefile size is set to 1.5 * the physical memory reported by the endpoint UNLESS this would result in less than 3 GB free disk space. In that event, no change is made to the page file size.
System Restore	The System Restore Insight verifies that system restore functionality has been activated on an endpoint.	An endpoint fails compliance if System Restore functionality is found to be disabled. Compliance check once every 48 hours.	Remediation consists of running the PowerShell Enable-ComputerRestore cmdlet on drive C
Teams Crash	Frequent Teams crashes can disrupt meetings, reduce user productivity, delay decision-making, and cause department frustration.	An endpoint fails compliance if any monitored Teams component crashes more than once during that period. Compliance check if Microsoft Teams has crashed more than once in a 24-hour period.	Teams cache is deleted, and required updates are being run. Remediation is attempted for all logged-on users.
Time Sync	The Time Sync Insight verifies that the endpoint local clock is correctly synchronized with the time reported by the platform switch component.	An endpoint fails compliance if the endpoint's local time differs by more than 30 seconds in either direction from the reported Platform Switch time. Compliance check once every 4 hours.	Remediation consists of running the Windows w32tm executable with the /resync parameter
Windows Fast Startup	The Windows Fast Startup Insight checks whether an endpoint is configured for Windows Fast Startup. If it is, the remediation instruction allows the feature to be turned off on the target endpoints.	An endpoint fails compliance if the Fast Startup option is enabled. Compliance check once every 48 hours	Customers may choose to configure the insight to be remediated manually (the default) or automatically. In either case, the actual remediation process is identical. The Fast Startup registry key is updated to disable Fast Startup.
WMI Repository	The WMI (Windows Management Instrumentation) repository is a core Windows component used by system tools, scripts, and management platforms to retrieve hardware and software information. If the repository becomes inconsistent or corrupted, it can cause failed inventory scans, broken automation, and inaccurate device reporting, impacting everything from software deployments to compliance audits.	An endpoint is compliant if the WMI integrity check returns success. The WMI integrity check is performed using the Microsoft WinMGMT tool. Compliance check once every 48 hours	Remediation consists of running the wmimgmt tool with the /salvagerepository option. This will attempt to repair any repository corruption.
Windows Defender Signature Age	The Windows Defender Signature Age insight determines the age of the most recent Windows Defender Signature file. It allows the file update to be manually or automatically initiated to ensure that the most recent signature file has been uploaded.	An endpoint fails compliance if the signature file is more than one day (24 hours) old. Compliance check once every 24 hours.	The PowerShell cmdlet Update-MpSignature is run as shown below: *Update-MpSignature -UpdateSource MMPC.*
OneDrive Sync	If OneDrive is not syncing correctly, the user may find that files they update locally in their OneDrive folder are not synchronized with the cloud copy or that changes they make to the local OneDrive folder, such as adding or deleting files, are not mirrored in the cloud. This can cause data loss or other productivity issues.	An endpoint fails compliance if the latest entry in the OneDrive log folder for the user is more than one day old. Compliance check once every 24 hours.	The OneDrive.exe control program is run as shown below: *OneDrive /reset*
Windows Firewall	If the Windows Firewall is not enabled, or not configured to block inbound ports, this can allow malicious software to make connections inbound to the endpoint and potentially exfiltrate information from the endpoint.	An endpoint fails compliance if the firewall status is enabled for all profiles and inbound ports are blocked. Compliance check once every 24 hours.	Remediation consists of running the PowerShell cmdlet *get-netfirewallprofile*. This is run twice, first to ensure all profiles are enabled and secondly to ensure that inbound ports are blocked and outbound ports are allowed.
ThreatDown	If an endpoint running ThreatDown is not correctly configured, essential antivirus protection might be lost, allowing an attack against the endpoint.	An endpoint fails compliance if any of the monitored services are not running or their startup mode is not Automatic. Compliance check every 5 minutes	If any monitored service is not running or not configured with a startup mode of Automatic, it is started, and the startup mode is configured to Automatic. Note that some MalwareBytes services are marked as Protected. This should mean that they cannot be changed in their state or startup mode.
Windows Update Failure	Windows Update is critically important to ensure that endpoints are fully protected from malware and to ensure that all defects in software corrected by updates are deployed in a timely manner.	An endpoint fails compliance if the latest update has not run in the last 24 hours or there are pending updates Compliance check once every 24 hours.	Remediation consists of running the usoclient utility. It is run twice, as follows: usoclient startinteractivescan usoclient startscan
TeamViewer service check	The TeamViewer agent allows the system administrator to access and control endpoints remotely. If the service is not running, the agent will not be able to allow this functionality.	An endpoint fails compliance if the TeamViewer service is not running or not registered. Compliance check once every 24 hours.	The TeamViewer service is started, and its startup mode is set to ‘Automatic’.
Microsoft System File Checker	Microsoft’s System File Checker is intended to scan for and optionally repair scenarios in which one or more system files, such as DLLs, appear to be corrupt. For more information on the SFC tool, see the link below SFC scannow - Microsoft Community	An endpoint fails compliance if sfc /VerifyOnly reports any errors. Compliance check once every 24 hours.	Remediation consists of running sfc /ScanNow. This will attempt to repair any detected corrupt files.
Chrome Cache	Corrupted or outdated Chrome cache data can cause slow performance, page-rendering problems, login failures, and inconsistent behavior in web-based tools. Regularly clearing the cache helps prevent user disruption and repetitive browser troubleshooting.	Verifies whether Google Chrome is installed on the endpoint. If Chrome is present, the endpoint is considered eligible for remediation under this insight. Compliance is typically checked every four hours.	Remediation consists of: Closing any running instances of Google Chrome. Deleting the Chrome cache folder from:\Google\Chrome\User Data\Default\ Chrome automatically rebuilds the cache the next time the user starts the browser.
Intune Cache Reset	Corrupted or stale Intune cache data can cause device-management policies, application deployments, and configuration updates to fail or behave inconsistently. Possible effects include delayed policy enforcement, failed installations, and repeated remediation attempts. Clearing the cache proactively helps Intune operate reliably and reduces reactive troubleshooting.	Verifies whether the Intune Management Extension exists on the Windows endpoint. If the extension is present, the endpoint is considered eligible for remediation Compliance is typically checked every four hours.	Remediation consists of:: Stopping the Intune Management Extension service. Clearing the Intune cache folder: \Content\Incoming Clearing the Intune staging folder: \Content\Staging Clearing the IME cache folder: C:\Windows\IMECache Clearing the logs from %Program Data%\Microsoft → Intune Management Extension → Log Restarting the Intune Management Extension service. Forcing an Intune synchronization. This removes corrupted or stale cache data and allows the endpoint to establish a clean synchronization state with Intune
Location Service	Organizations may require Windows Location Service to be enabled or disabled for security and compliance purposes. An incorrect state can cause policy violations, privacy concerns, or noncompliance with organizational or regulatory requirements. The insight enforces the desired state without requiring manual intervention.	Compares the current state of Windows Location Service with the configured policy: If the service is configured to be enabled: The endpoint is noncompliant when the service is not running. If the service is configured to be disabled: The endpoint is noncompliant when the service is running. Compliance is typically checked every four hours.	The remediation process enforces the configured state: If Location Service should be enabled, the service is started. If Location Service should be disabled, the service is stopped.
PowerShell Health	PowerShell is a critical dependency for endpoint management, remediation, and automation workflows. If PowerShell is missing, misconfigured, or not operating correctly, processes such as Intune operations and remediation scripts may fail. Regular validation identifies these problems and confirms that endpoints can execute management and remediation scripts	The insight tests PowerShell by executing: PSVersionTable.PSVersion.ToString() The endpoint is considered noncompliant if any of the following exist: PowerShell is not present. The command cannot run successfully. PowerShell is otherwise not functioning as expected. Compliance is typically checked every four hours.	To remediate, the user must: Open Command Prompt as an administrator. Run: DISM /Online /Cleanup-Image /RestoreHealth Run: sfc /scannow Restart the computer after both processes finish.
Windows RDP	Organizations may require Windows Remote Desktop to be explicitly enabled or disabled. If Remote Desktop is enabled when it should be disabled, it can introduce an unnecessary security risk. If it is disabled when required, it can prevent legitimate remote access and support scenarios.	The check validates Windows Remote Desktop by examining the state of the Terminal Services service, TermService, against the configured policy: If Remote Desktop should be disabled: The endpoint is noncompliant when TermService is running. If Remote Desktop should be enabled: The endpoint is noncompliant when TermService is not running. Compliance is typically checked every four hours.	The remediation process enforces the configured state: If Remote Desktop should be disabled: TermService is stopped. If Remote Desktop should be enabled, TermService is started.

macOS-specific Insights

Insight	Reasoning	Compliance Check	Remediation Process
Safari Cache	Over time, Safari cache data can grow significantly and may become outdated or corrupted. This can lead to degraded browsing performance, unexpected rendering issues, authentication problems, and unnecessary disk space consumption. By proactively clearing the Safari cache on a regular basis, this insight helps maintain a clean browsing environment, improves performance, and reduces the likelihood of user-reported browser issues	Verifies whether Safari is installed on the endpoint. If Safari is present, the endpoint is considered eligible for remediation under this insight. A Compliance check is run once every four hours	Remediation clears cached Safari and Webkit data while preserving essential user information (bookmarks, passwords, browser processes, etc), and consists of: Closing any running instances of Safari. Clearing the Safari cache and related data from user library folders.
macOS Version check	For security and compliance reasons, it is strongly recommended that macOS endpoints run the latest available operating system version. New macOS releases include critical security patches, bug fixes, and stability improvements that help protect devices from known vulnerabilities. Running outdated macOS versions can expose endpoints to security risks, compliance violations, and reduced platform reliability. This insight helps organizations identify devices that are not up to date so corrective action can be taken in a timely manner	Verifies whether the endpoint is running the latest available version of macOS. An endpoint is considered non-compliant if the installed macOS version is older than the latest version available for that device. A Compliance check is run once every four hours.	Manually verify from the official documentation that device is running on the latest Mac OS supported for the model. If the results are incorrect, please reach out to TeamViewer support for further investigation.
macOS Update Status check	By proactively detecting outdated macOS versions and retrying failed updates, this insight helps ensure that macOS devices remain up to date, secure, and compliant without requiring repeated manual intervention.	Verifies whether the endpoint is running the latest available version of macOS. An endpoint is considered non-compliant if the installed macOS version is older than the latest version available for that device. A Compliance check is run once every four hours.	Remediation consists of the following actions: The current product version of macOS installed on the device is retrieved. The latest available macOS version is determined by performing a request to Apple’s software update catalog. The currently installed version is compared with the latest available version If the device is not running the latest version, the following command is executed to install the latest available macOS version supported by the device: softwareupdate --fetch-full-installer --full-installer-version This process attempts to retry and complete the macOS update, ensuring the device is brought to the latest supported operating system version.
macOS Console Logs check	The macOS Console log is a centralized diagnostic tool, accessible via the Console application, that displays real-time and historical log messages, errors, and system activity from the operating system and applications. Console logs are critical for troubleshooting application issues, monitoring system performance, investigating failures, and debugging software problems. If console logs are unavailable or inaccessible, IT administrators lose essential visibility into system behavior, making effective diagnostics and incident resolution significantly more difficult.	Verifies the availability of macOS console logs on the endpoint. An endpoint is considered non-compliant if console logs cannot be accessed or retrieved, indicating that the logging subsystem is unavailable or not functioning as expected. A Compliance check is run once every four hours	Manually check the following: Check Permissions by running the following command in Terminal: sudo log collect Repair Disk Permissions by running Disk Utility → First Aid on the startup disk. Check System Integrity Protection (SIP) by running the following command in Terminal: csrutil status If disabled, logs may behave unexpectedly. Re-enable via Recovery Mode. Run the affected device in Safe Mode.

TeamViewer Remote

TeamViewer Tensor

TeamViewer DEX

TeamViewer Frontline

TeamViewer ONE Platform

Knowledge Base

Get started with TeamViewer DEX Essentials

Prerequisites

TeamViewer DEX Essentials interactive demo

TeamViewer DEX Essentials interactive demo

How to activate TeamViewer DEX Essentials

Service Administration Permission

Activate via device groups

Activate via devices

Manage activations

Deprecation of activation via TeamViewer policy

Functionality

Insights

Windows-specific Insights

macOS-specific Insights

Remediation

Automation

Validation

Parameterization