ET Ducky changelog, October 24, 2026

These changes cover configuration export and import with AI drafts from other RMM tools, new automation triggers and real schedules, the remote control Keys menu and secure desktop, software catalog installs, and lighter event capture during live sessions. Items marked with a version reach a machine when it runs that release or a later one. The Windows agent release is 2.8.4.5 and the desktop app release is 2.8.3.

New

• Organization admins and owners can export alert rules, automations and saved Data Explorer views as one file, and import that file into the same or another organization. Imported rules start disabled and imported views start private (see Configuration Export and Import).
• Import from another tool drafts a configuration file with AI from another RMM tool's screenshots, PDFs, export files or text. The card lists what it could not map and the fields it left blank, then previews the draft before anything is imported. Drafting is part of every paid plan. The documentation has a step-by-step guide for moving a setup from another tool.
• The automation editor has a Describe it box. Describe a rule in your own words and Draft with AI fills in the form (see Automations).
• The Data Condition trigger starts an automation when a Smart Reports data source has rows that match your filters, for example a ticket for each agent that stops reporting. Organization admins, owners and technicians on a paid plan can save these rules.
• The desktop remote control toolbar has a Keys menu with Ctrl+Alt+Del, Win+R, Alt+Tab and other combinations, and Ctrl+Alt+End on the remote screen sends Ctrl+Alt+Del. Ctrl+Alt+Del is sent only when the agent reports that it is allowed, and the menu says why when it is not (see Remote Desktop).
• When the Windows sign-in or lock screen is up and cannot be shown, the paused view in remote control names the reason. This needs agent 2.8.4.4.

Improved

• Opening a remote control session no longer starts event collection on the device. Collection starts when you open Ask Ducky in the session, or when you click the event collection button, and stops when the session ends.
• Scheduled automations use standard 5-field cron expressions and run in UTC. A run missed by more than an hour is skipped and opens one ticket for the rule, and later misses are added to that ticket as notes.
• Changes to Allow Ctrl+Alt+Del and Allow viewing and control of the secure desktop reach the agent within a minute and before each remote control session, without restarting the agent service. This needs agent 2.8.4.4.
• Run Now refuses a disabled automation and says how to enable it.
• Automation webhook URLs, headers and body templates are shown only to organization admins and owners. Run History records only the scheme and host of a webhook a rule called.
• The Agent Telemetry Directive is applied by agents from 2.8.4.4. Agents keep each value for 24 heartbeats after the last heartbeat that carried it (see Configuration).
• A batch of events the cloud refuses is kept on the agent and retried once an hour instead of being sent again in a loop. This needs agent 2.8.4.4 (see Recovery).

Fixed

• A live session, including remote control before this release, made .NET applications and file-heavy work on the device run much slower while it was open. Live sessions now capture a smaller set of events at the Information level, and agent 2.8.4.5 and desktop app 2.8.3 enable every event source at an explicit level.
• Software catalog deploys of installers that install only for one user, such as Spotify, reported success while the app was installed only for the system account. The agent now runs such an installer again for the signed-in user and checks where the app was registered. With nobody signed in, the job fails and says so. This needs agent 2.8.4.4 (see Patch Management).
• A catalog deploy failed its hash check when the vendor replaced the file behind an unversioned download link. At deploy time ET Ducky now reads the current hash from the winget manifest for the same link.
• When the agent refuses Ctrl+Alt+Del, it no longer types a plain Delete on the remote machine. This needs agent 2.8.4.4.
• Scheduled automations run under their own organization. Before this release they could fail with "Automation rule not found".