---
sourceDocument: Australia IT Service Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/it-service-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Service Management

ft:clusterId :

    - itsm

bundleId :

    - itsm

workflow :

    - Technology


---

# Metrics monitored by DEX on Windows

# Metrics monitored by DEX on Windows {#ariaid-title1}

Release version: Australia  
Updated June 26, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 12 minutes to read  
Review the endpoint performance and compliance metrics that DEX collects from managed Windows devices, including collection intervals, and associated check definitions and policies.

## Application metrics {#metrics-monitored-by-dex-windows__section_windows_metrics}

{#metrics-monitored-by-dex-windows__table_windows_metrics__entry__8}

| Metric Name | Key | Description | Sub-metrics / Output fields | Unit | Policy: Interval (min) | Check Definition Name | Required privileges |
|-|-|-|-|-|-|-|-|
| Application version | version | Version string of the installed application. Format is vendor-defined (for example, `5.14.2.6`). | Single metric --- `version` (string) | N/A | 1,440 | os.win.check-app-version | No elevated privileges required |
| CPU usage | cpu_usage | Percentage of CPU consumed by all processes belonging to the target application. Point-in-time gauge sampled every 5 minutes. | Single metric --- `cpu_usage` (percentage, gauge) | % | 5 | os.win.check-app-cpu-usage | Local System Account |
| Crashes | crashes | Count of application crashes detected in the last 5 minutes via the Windows Event Log. | Single metric --- `crashes` (count per 5-min window, gauge) | count | 5 | os.win.check-app-crashes | No elevated privileges required |
| Domain network details (installed apps) | domain_network_details | Network quality metrics for the target application's domain or domains: round-trip latency, packet loss, and jitter. | `latency` (ms); `packet_loss` (%); `jitter` (ms) | N/A | 10 | os.win.check-app-domain-network-details | No elevated privileges required |
| Domain network details (Web apps) | domain_network_details | Network latency, packet loss, and jitter for a web application domain. Same measurement as the installed-app variant. | `latency` (ms); `packet_loss` (%); `jitter` (ms) | milliseconds | 10 | os.win.check-web-app-domain-network-details | No elevated privileges required |
| Domain network route details (installed apps) | source_details, domain_network_route_details | Complete hop-by-hop network route from the device to the application's domain(s), including per-hop latency, IP addresses, and packet loss. | `source_details` (device source IP/network info); `domain_network_route_details` (array of hops): `hop_number`, `ip_address`, `latency` (ms), `packet_loss` (%) | N/A | 30 | os.win.check-app-domain-network-route-details | No elevated privileges required |
| Domain network route details (Web apps) | source_details, domain_network_route_details | Complete hop-by-hop network route from Windows device to the web application domain. | `source_details`; `domain_network_route_details` array | milliseconds | 30 | os.win.check-web-app-domain-network-route-details | No elevated privileges required |
| Freezes | freezes | Count of application freeze (hang) events in the last 5 minutes per application process. Sources events from Windows Application Event Log: WER Event ID 1001 (AppHangTransient) and Application Hang Event ID 1002. Note: The metric collects data only from apps that report freeze events to the Windows Event Log. Apps that don't use Windows Error Reporting can't surface freeze data. | Single metric --- `freezes` (count per 5-min window) per app+version | count | 5 | os.win.check-app-freezes | No elevated privileges required |
| Incoming network bytes | incoming_network_bytes | Incoming network bytes per second for a specific application, aggregated across IPv4 and IPv6 network connections. | Single metric --- `incoming_network_bytes` (bytes/second, gauge) per application | Bps | N/A | os.win.check-app-incoming-network-bytes | Local System Account |
| Installed Apps Version | version | Fetches all the latest version of the applications. | Per installed application: application name and version; delivered as change sets (`entries_to_add`, `entries_to_remove`). | N/A | 1,440 | os.all.check-installed-apps-version | No elevated privileges required |
| IO usage (read) | io_usage_read | Bytes read per second from disk by all processes of the target application. Two-sample delta calculation. | Single metric --- `io_usage_read` (bytes/second, gauge) | Bps | 5 | os.win.check-app-io-usage-read | Local System Account |
| IO usage (write) | io_usage_write | Bytes written per second to disk by all processes of the target application. | Single metric --- `io_usage_write` (bytes/second, gauge) | Bps | 5 | os.win.check-app-io-usage-write | Local System Account |
| Is installed | is_installed | Boolean indicating whether the target application is installed on the device. | Single metric --- `is_installed` (boolean, gauge) | Boolean | N/A | os.win.check-app-is-installed | No elevated privileges required |
| Is running | is_running | Boolean indicating whether at least one process of the target application is currently running. | Single metric --- `is_running` (boolean, gauge) | Boolean | 5 | os.win.check-app-is-running | Local System Account |
| Last access time | last_access_time | Unix timestamp (milliseconds) of the last time the application process was observed running. | Single metric --- `last_access_time` (milliseconds since epoch) | milliseconds | 5 | os.win.check-app-last-access-time | Local System Account |
| Last updated | last_updated | Unix timestamp (seconds) of the most recent application update installation. | Single metric --- `last_updated` (Unix timestamp in seconds) | seconds | N/A | os.win.check-app-last-updated | No elevated privileges required |
| Listening ports | listening_ports | List of TCP and UDP port numbers on which the application is actively listening. | Single metric --- `listening_ports` (array of integers) | N/A | N/A | os.win.check-app-listening-ports | No elevated privileges required |
| Outgoing network bytes | outgoing_network_bytes | Outgoing network bytes per second for a specific application across IPv4 and IPv6 networks. | Single metric --- `outgoing_network_bytes` (bytes/second, gauge) per application | Bps | N/A | os.win.check-app-outgoing-network-bytes | Local System Account |
| RAM usage | memory_usage | Percentage of physical RAM consumed by all processes of the target application relative to total system RAM. | Single metric --- `memory_usage` (percentage, gauge) | % | 5 | os.win.check-app-memory-usage | Local System Account |
| SCCM | sccm_metrics | Application-specific metrics for Microsoft Configuration Manager (MCM), including SCCM agent status, last policy refresh, deployment status, and other SCCM-specific data. | `agent_status`; `last_policy_request`; `last_scan_time`; `deployment_status` | N/A | 1,440 | os.win.check-app-sccm | Local system account |
| Uptime | uptime | Continuous running time of each application process in milliseconds since it was last started. | Single metric --- `uptime` (milliseconds, gauge) | milliseconds | 5 | os.win.check-app-uptime | Local System Account |
| Zscaler service status | zscaler_service_status | Fetches the Zscaler service status information for the following services: ZPA, ZIA, and ZDX, with the type parameter set to "latest". Additionally, returns whether the ZPA service status is "connected" for the type set to "historical". | Per-service status for ZPA, ZIA, ZDX (latest); ZPA connected status (historical). | N/A | 5 | os.win.check-app-zscaler-service-status | No elevated privileges required |
[ ]

{#metrics-monitored-by-dex-windows__table_windows_metrics}

## Device metrics {#metrics-monitored-by-dex-windows__section_ocl_ng1_5jc}

{#metrics-monitored-by-dex-windows__table_pq1_3cj_sjc__entry__8}

| Metric Name | Key | Description | Sub-metrics / Output fields | Unit | Policy: Interval (min) | Check Definition Name | Required privileges |
|-|-|-|-|-|-|-|-|
| Admin users | admin_users | List of local user accounts with administrator-level privileges on the device. Snapshot only. | `admin_users` (array): `username` (string), `uid` (integer) | N/A | N/A | os.win.check-system-admin-users | No elevated privileges required |
| Antimalware details | antimalware_details | Antimalware software details including product name, version, enabled status, and definition update date. | `product_name`; `version`; `enabled`; `definition_date`; `am_running_mode` | N/A | 1,440 | os.win.check-system-antimalware-details | No elevated privileges required |
| Antivirus enabled | antivirus_enabled | Boolean status indicating whether an antivirus product is registered and active in Windows Security Center. | `name` (AV product); `enabled` (boolean); `up_to_date` (boolean) | N/A | 1,440 | os.win.check-system-antivirus-enabled | No elevated privileges required |
| Battery charge percentage | battery_charge_percentage | Current battery charge percentage on the Windows device as an integer. | Single metric --- `battery_charge_percentage` (integer %, gauge) with `battery_id` attribute | % | 5 | os.win.check-system-battery-charge-percentage | No elevated privileges required |
| Battery details | battery_details | Comprehensive battery health snapshot including charge percentage, estimated runtime, battery status, health condition, chemistry, cycle count, design and full-charge capacity, serial number, design voltage, and installed batteries count. | `charge_percentage`; `estimated_runtime`; `battery_status`; `condition`; `health`; `design_voltage`; `chemistry`; `cycle_count`; `serial_number`; `designed_capacity` (mWh); `full_charge_capacity` (mWh); `maximum_capacity` (%); `installed_batteries` (count) | N/A | 1,440 | os.win.check-system-battery-details | Local System Account |
| BIOS details | bios_details | BIOS firmware details for the Windows device including BIOS version, manufacturer, release date, and BIOS mode. | `bios_version`; `manufacturer`; `release_date`; `serial_number`; `bios_mode` (UEFI/Legacy) | N/A | 1,440 | os.win.check-system-bios-details | No elevated privileges required |
| Bitlocker details | bitlocker_details | BitLocker encryption status per volume including protection status, encryption method, and key protector type. | Per volume: `volume_type`; `mount_point`; `encryption_percentage`; `protection_status`; `lock_status`; `encryption_method`; `key_protector` | N/A | 1,440 | os.win.check-system-bitlocker-details | Local System Account |
| BSOD (count) \& cause | bsod_details | Count of Windows BSOD (Blue Screen of Death) events in the last 30 days from the Windows Event Log, plus per-event details: cause/error code, event ID, severity level, and timestamp. | `bsod_count` (count in last 30 days); per event: `cause`, `event_id`, `level`, `time_created` | N/A | 1,440 | os.win.check-system-bsod | No elevated privileges required |
| CPU details | cpu_details | Static CPU hardware details: processor name/model, architecture, physical core count, logical processor count, device ID, and processor ID. | `name`; `architecture`; `number_of_cores`; `number_of_logical_processors`; `device_id`; `processor_id`; `manufacturer`; `current_clock_speed` (MHz); `max_clock_speed` (MHz) | N/A | 1,440 | os.win.check-system-cpu-details | No elevated privileges required |
| CPU performance details | cpu_performance_details | CPU performance counter data including CPU user time percentage. | `cpu_user_time` (% User Time, gauge) | % | 5 | os.win.check-system-cpu-performance-details | Local System Account |
| CPU usage | cpu_usage | Overall device CPU utilization percentage across all cores. Collected via `typeperf` performance counter. | Single metric --- `cpu_usage` (percentage, gauge) | % | 5 | os.win.check-system-cpu-usage | Local System Account |
| Device crashes | device_crashes | Count of device-level crashes (BSODs, kernel events) on Windows within the 5-minute collection window. | Single metric --- `device_crashes` (count per 5-min window, gauge) | count | 5 | os.win.check-system-crashes | No elevated privileges required |
| Device details | device_details | Hardware device inventory snapshot: chassis type, description, model, serial number, and processor ID. | `chassis_type`; `description`; `model`; `serial_number`; `processor_id` | N/A | 1,440 | os.win.check-system-device-details | No elevated privileges required |
| Device events | device_events | Device-level events during a specified time interval on Windows. Captures `last_boot` (Unix timestamp if reboot occurred in interval) and `logged_in_users` (list of user logins in interval). | `last_boot` (Unix timestamp or empty); `logged_in_users` (array of user login objects) | N/A | 1,440 | os.win.check-system-device-events | Local System Account |
| Disk available | disk_available | Gets the available disk space in GB. | Single metric --- `disk_available` (available disk space in GB, number). | GB | 5 | os.win.check-system-disk-available | Local System Account |
| Disk details | disk_details | Per-disk snapshot of total, free, and used space plus disk performance counters: `disk_reads_per_sec`, `disk_writes_per_sec`, and `avg_disk_queue_length`. | `total_space` (bytes); `free_space` (bytes); `used_space` (bytes); `disk_reads_per_sec`; `disk_writes_per_sec`; `avg_disk_queue_length`; `avg_disk_sec_per_read`; `avg_disk_sec_per_write`; `avg_disk_sec_per_transfer` | N/A | 5 | os.win.check-system-disk-details | Local System Account |
| Disk IO usage (read) | io_usage_read | Device-wide disk read throughput in bytes per second across all disks. | Single metric --- `io_usage_read` (bytes/second, gauge) | Bps | 5 | os.win.check-system-disk-io-usage-read | Local System Account |
| Disk IO usage (write) | io_usage_write | Device-wide disk write throughput in bytes per second. | Single metric --- `io_usage_write` (bytes/second, gauge) | Bps | 5 | os.win.check-system-disk-io-usage-write | Local System Account |
| Disk usage\* | disk_usage | Percentage of primary disk space used. | Single metric --- `disk_usage` (percentage, gauge) | % | 5 | os.win.check-system-disk-usage | Local System Account |
| Energy consumption | energy_consumption | Energy consumed by the device over a measurement period in milliwatt-hours. Cumulative energy metric. | Single metric --- `energy_consumption` (mWh, gauge) with `battery_id` attribute | mWh | 5 | os.win.check-system-energy-consumption | Local system account |
| Firewall enabled | firewall_enabled | Boolean status of the Windows OS firewall. Returns a single state value indicating whether the firewall is enabled. | `firewall_enabled` (boolean) | N/A | 1,440 | os.win.check-system-firewall-enabled | No elevated privileges required |
| GPU Usage Details | gpu_usage,gpu_vram_usage | Checks GPU Usage percentage and GPU VRAM Usage in bytes. | `gpu_usage` (3D engine utilization %, 0--100); `gpu_vram_usage` (local adapter memory usage, bytes) | gpu_usage: percentage; gpu_vram_usage: bytes | 5 | os.win.check-system-gpu-usage-details | Local System Account |
| Hard drive status | hard_drive_status | Physical disk drive inventory and health status including disk number, name, status, description, interface type, manufacturer, media loaded, media type, model, size, serial number, partition count, and partition details. | `drive_details` (array): `disk_number`; `name`; `status`; `description`; `interface_type`; `manufacturer`; `media_loaded`; `media_type`; `model`; `size`; `serial_number`; `partitions` `partition_details` (array): `name`; `partition_number`; `drive_letter`; `partition_size`; `partition_type` | N/A | 1,440 | os.win.check-system-hard-drive-status | Local System Account |
| Incoming network bytes | incoming_bytes | Total incoming network bytes per second aggregated across all active network interfaces on the device. | Single metric --- `incoming_bytes` (bytes/second, gauge) | Bps | N/A | os.win.check-system-net-bytes-incoming | Local System Account |
| Last access time | last_access_time | Timestamp of the last time the Windows device was accessed by a user, based on lock/unlock state. Note: The check enables event capturing on first run, so initial collection may return an error. | Single metric --- `last_access_time` (timestamp of last lock/unlock) | N/A | 1,440 | os.win.check-system-last-access-time | Local System Account |
| List executables | list_executables | Inventory of all .exe executable files present on the Windows device. | Per executable: `name`; `path`; `version`; `size`; `last_modified` | N/A | 1,440 | os.win.check-system-executables | Local System Account |
| Logged-in users | logged_in | List of users currently logged into the device including username and uid. | `logged_in` (array): `user`; `uid` | N/A | 1,440 | os.win.check-system-logged-in-users | Local System Account |
| Memory details | memory_details | Comprehensive memory snapshot including physical and virtual memory totals, available, and used (bytes); memory usage percentage; virtual memory usage percentage; page file size and usage percentage; and pages/sec performance counter. | `physical_memory_total`; `physical_memory_available`; `physical_memory_usage`; `memory_usage` (%); `virtual_memory_total`; `virtual_memory_available`; `virtual_memory_usage`; `memory_pages_per_sec`; `page_file_usage` (%); `total_page_file_size` | % | 5 | os.win.check-system-memory-details | Local System Account |
| Memory modules | memory_modules | Physical RAM module details including capacity, speed, manufacturer, part number, and slot location. | Per module: `capacity`; `speed` (MHz); `manufacturer`; `part_number`; `slot`; `form_factor` | N/A | N/A | os.win.check-system-memory-modules | No elevated privileges required |
| Network adapter details | network_adapter_details | Details of all network adapters on the Windows device. On-demand collection only. | `name`; `interface_description`; `status`; `mac_address`; `link_speed` | N/A | 1,440 | os.win.check-system-network-adapter-details | No elevated privileges required |
| Network connection profiles | network_connection_profiles | Network connection profile details for the Windows device, including network type (public/private/domain), which can be used to infer VPN status. | `network_type` (Public/Private/Domain); `interface_name`; `connected` (boolean) | Boolean | 30 | os.win.check-system-network-connection-profiles | No elevated privileges required |
| Network connectivity details | network_details | Complete network adapter snapshot for both Wi-Fi and Ethernet interfaces. | Ethernet: `name`; `interface_description`; `driver_version`; `status`; `link_speed`; `mac_address`; `media_type` Wi-Fi: `ssid`; `bssid`; `radio_type`; `authentication`; `channel`; `receive_rate`; `transmit_rate`; `signal`; `profile` | N/A | 1,440 | os.win.check-system-network-details | No elevated privileges required |
| OS details | os_details | Operating system inventory snapshot including name, version, platform, architecture, install date, locale, build number, build type, service pack versions, serial number, and system directory. | `name`; `version`; `platform`; `architecture`; `install_date`; `locale`; `status`; `build_number`; `build_type`; `service_pack_major_version`; `service_pack_minor_version`; `serial_number`; `system_directory` | N/A | 1,440 | os.win.check-system-os-details | No elevated privileges required |
| OS setup details | os_setup_details | Approximate age of the Windows OS installation. Derived from OS install date compared to the current date. | `os_install_date` (timestamp); `os_age_days` (integer) | N/A | 1,440 | os.win.check-system-os-setup-details | No elevated privileges required |
| Outgoing network bytes | outgoing_bytes | Total outgoing network bytes per second aggregated across all active network interfaces on the device. | Single metric --- `outgoing_bytes` (bytes/second, gauge) | Bps | 1,440 | os.win.check-system-net-bytes-outgoing | Local System Account |
| Pending system updates | pending_updates | List of pending Windows software updates not yet installed. Includes per-update details such as KB number, title, description, support URL, mandatory flag, uninstallable flag, download size, and reboot requirement. | Per update: `kb`; `title`; `description`; `support_url`; `is_mandatory`; `is_uninstallable`; `max_download_size`; `min_download_size`; `reboot_required` | N/A | 1,440 | os.win.check-system-pending-updates | Local System Account |
| Peripheral device details | peripheral_devices_details | Inventory of connected peripheral devices (USB, HID, etc.) including device name, type, manufacturer, and connection status. | Per device: `name`; `device_id`; `type`; `status`; `manufacturer` | N/A | 1,440 | os.win.check-peripheral-devices-details | No elevated privileges required |
| Power consumption | power_consumption | Current device power consumption in milliwatts. Note: Not collected for VMs (the check skips devices where no data is available). | Single metric --- `power_consumption` (milliwatts, gauge) | mW | 5 | os.win.check-system-power-consumption | Local System Account |
| Reboot details | reboot_details | List of system startup (Event ID 6005) and shutdown (Event ID 6006) events with Unix timestamps from the Windows System Event Log. | Array of events: `id` (6005=startup or 6006=shutdown); `time_created` (Unix timestamp). `last_reboot_timestamp` is calculated from this data. | seconds | 1,440 | os.win.check-system-reboot-details | No elevated privileges required |
| System compliance | system_compliance_details | Compliance rating (percentage) for the device based on configured compliance rules across apps and device metrics. Lists non-compliant metrics and apps. | `compliance_rating`; `non_compliant_apps` (array); `non_compliant_metrics` (array) | % | 1,440 | os.win.check-system-compliance-details | No elevated privileges required |
| System time | time | Current system time as a Unix epoch timestamp in seconds (UTC). Used for time-drift detection and telemetry alignment. | Single metric --- `time` (Unix epoch seconds, gauge) | seconds | N/A | os.win.check-system-time | No elevated privileges required |
| Uptime | uptime | Continuous time in milliseconds since the last device boot. | Single metric --- `uptime` (milliseconds, gauge) | milliseconds | 5 | os.win.check-system-uptime | No elevated privileges required |
| User profiles | user_profiles | List of Windows user profiles present on the device including profile path, SID, and profile type. | Per profile: `sid`; `localpath`; `lastusetime`; `loaded` (boolean) | N/A | 1,440 | os.win.check-system-user-profiles | No elevated privileges required |
| Wi-Fi receive rate | wifi_receive_rate | Wi-Fi receive rate (downlink speed) in Mbps on Windows. Sourced from `netsh wlan show interfaces`. | Single metric --- `wifi_receive_rate` (Mbps, gauge) | Mbps | 5 | os.win.check-system-wifi-receive-rate | No elevated privileges required |
| Wi-Fi signal strength | wifi_signal_strength | Wi-Fi signal strength as a percentage (0-100%) on Windows. Parsed from `netsh wlan show interfaces` Signal field. | Single metric --- `wifi_signal_strength` (percentage 0-100, gauge) | % | 5 | os.win.check-system-wifi-signal-strength | No elevated privileges required |
| Wi-Fi transmit rate | wifi_transmit_rate | Wi-Fi transmit rate (uplink speed) in Mbps from the Windows device. | Single metric --- `wifi_transmit_rate` (Mbps, gauge) | Mbps | 5 | os.win.check-system-wifi-transmit-rate | No elevated privileges required |
| Windows power plan | power_plan | Active Windows power plan (for example, Balanced, High Performance, Power Saver) and its GUID. | `power_plan_name`; `power_plan_guid` | N/A | 1,440 | os.win.check-system-power-plan | No elevated privileges required |
| Windows registry keys | windows_registry | Windows registry key values for specified paths. Registry keys are parameterized --- the specific keys queried depend on the check definition configuration. | Configurable per key: `key`; `name`; `data`; `type` (REG_SZ, REG_DWORD, etc.) | N/A | 1,440 | os.win.check-system-windows-registry | No elevated privileges required |
| Windows stability index | stability_index | Windows Reliability Index score (1-10 scale) representing overall system stability. Higher is more stable. | Single metric ---` stability_index` (number 1--10, gauge, asDouble) | index (0-10) | 1,440 | os.win.check-system-compliance-details | No elevated privileges required |
[ ]

{#metrics-monitored-by-dex-windows__table_pq1_3cj_sjc}  
Note:  
\* The Disk Usage metric reports storage consumption. For disk I/O throughput by process, see the Disk Usage action in [Digital End-User Experience remedial actions](https://servicenow-prod.fluidtopics.net/INx3jbb_iuk6UuenECZ7SQ "ServiceNow Digital End-User Experience (DEX) provides base system remedial actions to resolve issues on DEX monitored devices.").