Documentation

Software Advisories

This page is also in the Groundskeeper wiki: https://github.com/rsjsoftwareltd/groundskeeper/wiki/Software-Advisories

Groundskeeper already knows which programs are installed on your computers. Software Advisories compares that list with a short, dated list that RSJ keeps of published security fixes and of products the maker no longer fixes, and tells you which computers are affected and what to update to.

Groundskeeper is not antivirus. It compares the software your machines report with public security advisories, so you know what to update. It never changes anything on your machines.

It works in three ways:

• Advisories -- "this version of this program has a published security fix; the fixed version is X".
• End of support -- "the maker no longer fixes this product". The same list feeds the Cyber Essentials findings, so the two never disagree.
• Versions in use -- "your school has six versions of this program". This needs no list: it is arithmetic on what your computers report.

Every edition has it, Community included. There is no new page: it lives where you already look.

Where it shows #

• Reports page -- a Software Advisories card, in the same pop-out as the other reports. It has three counts (machines with an advisory, machines running software that is no longer supported, programs with many versions), a Fix these first list, each advisory with the machines it affects (the exact name and version each one reported, the fixed version, and a link to the official advisory), End of support, Versions in use, and a line saying how many computers it checked.
• Devices page -- a software advisory chip that shows only the computers with an advisory, and lines in a computer's drawer.
• Dashboard -- a small card when at least one computer has an advisory. It is hidden when there are none.
• Feed -- one entry for each advisory, covering all the computers it affects, and one more when it is resolved.
• Weekly digest -- one line when there are new advisories.

When no advisory matches the software your computers have reported, the card says so: "No advisories match the software your machines have reported." That is not a statement that nothing is wrong. It only says nothing on the list matches what was reported.

What a finding means #

A match is a name and a version compared with a published advisory. It does not say the flaw can be reached on that computer. Each advisory carries a sentence about who it matters to -- for example, PHP matters most on computers that run websites, and much less on a desktop that has it only for testing. Every finding shows the exact name and version the computer reported, so a wrong match is easy to see and report.

An advisory is a warning. It is critical only when RSJ has marked the flaw as being used in attacks and the computer is a server. A version Groundskeeper cannot read is never reported as affected.

What it cannot see #

Groundskeeper reads the list of installed programs that Windows keeps. So it cannot see software that was copied into a folder rather than installed (PHP unzipped into C:\php, for example), portable programs, programs installed for one user only, or computers that are not running Windows. The card says this every time.

A product that carries another product inside it, such as XAMPP, which includes PHP, is shown as May include PHP: check the version, because the version of the bundle is not the version of the product inside it.

What's covered #

Where this comes from #

Each entry is added by hand by RSJ from the maker's own announcement and the CVE record, and carries its links so you can read the source yourself. The list is signed, and Groundskeeper downloads the newest list once a day (switch this off in Settings -> Updates, Check for newer advisory lists). It is a short, checked list, not a complete vulnerability database, and more entries are added as they matter to schools.

The list #

The list is signed by RSJ. A copy comes with every release, so it works with no internet access. Once a day Groundskeeper can also download a newer one: one plain download of a public file, with nothing about your school sent. A list that fails its signature check, or is older than the one in use, is ignored and the last good one is kept. If the list is more than 30 days old, the card says so.

Switch the daily download off in Settings -> Updates -> Check for newer advisory lists.

Computers without the RSJ Agent #

By default only computers that run the RSJ Agent are covered. In Settings -> Updates, Also read the installed programs of computers without the RSJ Agent makes Groundskeeper read the same list from the registry of each domain computer that has no agent, once a week (Sunday at 03:40). It only reads and never changes anything. It needs Remote Registry running on those computers and an account with administrator rights on them. It is off until you switch it on.

Where a computer has an agent, the agent's own report is used. A computer that cannot be read keeps its last list, and a computer that could only be read in part never has a finding closed because of it. If Active Directory cannot be read, or none of the computers can be read, Groundskeeper says so once on the feed and again when it works.

Last updated: 2026-10-28 (v0.193.9)