Software validation
Every installer downloaded, hash-checked and scanned by your own antivirus on a validation host before any endpoint receives it.
Software validation makes sure that no installer reaches your endpoints before your own antivirus has scanned it. A validation host — one of your Windows endpoints, usually a server — downloads every installer, checks it, and keeps it in a local repository. Endpoints then install only the copy that passed.
What is checked
Every installer goes through the same steps, whatever its source:
- Download from the vendor's site, or from the console for an installer you uploaded.
- Hash: the file must match the SHA-256 its source publishes (the winget manifest, the version in your Software Repository). A file that does not match is blocked.
- Publisher signature: the Authenticode signer is recorded and shown. You can require a valid signature; an unsigned installer is then blocked.
- Antivirus: Sophos or Microsoft Defender on the validation host. A detected file is blocked, with the name of the detection.
A file that passes is approved: it is kept on the validation host and copied to the console.
What is covered
| Covered | Not covered |
|---|---|
| Deploy Software (Software Repository packages, built-in packages) | Windows updates, which come from Windows Update on each endpoint |
| Deploy Updates for third-party applications | Microsoft 365 Apps, which update through their own channel |
| Provisioning (bundles and profile software) |
When validation is on, endpoints no longer use winget to download anything: a winget package is replaced by the installer its manifest declares, validated like any other.
How endpoints receive a validated file
- Endpoints on your network copy it from the validation host's share (
\\<host>\IdolbeRepo$, read-only). - Endpoints that cannot reach the share — another site, no VPN — download the console's copy over HTTPS.
- Either way, the endpoint checks the file's SHA-256 before running it.
What you see
Configuration › Validated Files lists every installer with its status:
| Status | Meaning |
|---|---|
| Queued | waiting for the validation host |
| Scanning | being downloaded and checked |
| Approved | passed every check; endpoints may receive it |
| Blocked | refused, with the reason: the antivirus' detection, a hash that does not match, a missing signature, or an administrator's decision |
| Failed | the check could not finish (download error, antivirus missing, validation host offline); it is tried again after an hour |
A deployment that needs a file not judged yet waits for its verdict: its History entry stays pending, then runs. A deployment that needs a blocked file is cancelled with the reason. A provisioning job shows "waiting for software validation" on its software line.
Files are validated ahead of time too: when you approve an update in Update Approval, and when you add or change a package in the Software Repository.
Every night
Approved files are scanned again with the antivirus' signatures of the day. A file that is detected now is blocked, and the deployments waiting for it are cancelled. The Audit Trail records every approval and every block.
Setting it up
One validation host serves every organization of the console: each installer is scanned once, and its verdict and copy serve them all. Only a platform operator sets it up, in Configuration › Validated Files:
- Choose the validation host: a Windows endpoint, in any organization, with outbound HTTPS to the vendors' sites and your antivirus installed and running.
- Choose the repository folder on that host, for example
D:\IdolbeRepo. - Choose the antivirus, and turn validation on.
Other administrators see which host validates their files and the list of files, not the settings. An installer uploaded to an organization's Software Repository is listed in that organization only.
The validation host creates the share itself, read-only for authenticated users (domain computers included). Allow SMB (TCP 445) from your endpoints to the validation host for them to use it.
Buttons
The buttons are offered to a platform operator and to the administrators of the validation host's organization:
- Scan again: a new verdict for one file, with the antivirus' signatures of today.
- Block: refuse a file yourself. It is never handed out again, and the deployments waiting for it are cancelled. A blocked file is never unblocked by hand: only a new clean scan makes it usable again.