01The app

The mock is clickable. Sidebar items switch panels. On Command Station, toggle between an inline command and a stored script, press Run or Test Connectivity, and use the host picker above the output.

Signed in as

Not securehttps://array.corp.lab/i/7c2e94d1/Hosts

Standard users don't see Backup. With Array sign-on, Users and Sign Out are hidden since Array handles accounts.

02How the pieces fit

Close to an Ansible inventory, for Windows and PowerShell. An inventory ties a set of servers to the one account used on all of them, and every command targets an inventory.

HostOne Windows machine: display name, DNS name or address, and HTTP or HTTPS for remoting.

CredentialA Windows account and password. Set a domain such as CORP for a domain account, leave it blank for a local one.

InventoryA named group of hosts plus one credential for all of them, e.g. Production SQL with sql-ops.

ScriptSaved PowerShell. Parameters in a leading param() block become input fields.

RunOne pass of a command, script or connectivity test over an inventory. Output is kept per host.

ConsoleA live PowerShell session on one host, opened from Hosts.

Typical order

Hosts: add servers with + Add Hosts, several at a time if needed.
Credentials: save the remoting account, then press Test on a host to check it.
Inventories: group hosts and pick their credential.
Scripts (optional): save anything run often.
Command Station: pick an inventory, run Test Connectivity once, then the real command.

Remoting is WinRM, the same transport Invoke-Command and Enter-PSSession use. The Console connects over SSH instead. Enable WinRM and Enable SSH cover preparing a server for each.

03Deployment

Aperture is deployed from Nectere Array under Menu › Deploy › Nectere Aperture. Updates, restarts and logs are on the back of the tile. The sign-in mode is chosen at deploy time.

Array sign-on (recommended)No separate login. Array admins are Aperture admins, and other Array users who can see the tile come in as standard users.

Application sign-inAperture keeps its own users. The first person to open the tile creates the admin account; everyone else is added in the Users panel.

Servers must be reachable from the Array host on TCP 5985 (HTTP) or 5986 (HTTPS) for remoting, and on TCP 22 for the Console.

With Application sign-in, the first visit to a new tile shows the setup screen, which creates an admin account. Everyone signs in through Sign In after that. The buttons step through each screen and its errors.

Screen

Not securehttps://array.corp.lab/i/7c2e94d1/setupSign-in

Rule	Value
Sign-in lasts	8 hours, then back to Sign In
Minimum password at setup	4 characters
First account	Always `admin`
Sign Out	Bottom of the sidebar, ends the session immediately

No sign-in screen. Opening the tile from Array lands on Hosts, with roles mapped as in Deployment. If the Array session has expired, reopen the tile from Array.

Sidebar

Item	Who sees it
Hosts, Credentials, Inventories, Variables, Scripts, Command Station	Everyone
Users	Application sign-in only. Only admins can manage users; a standard user sees an empty list.
Backup	Admins

Footer

Notifications stack above Sign Out. Green confirmations fade after 5 seconds, rose errors after 8. Under the button are the server clock and the Aperture version.

06Hosts

The default panel. On load each host is checked for open remoting and SSH ports. The check doesn't log in, so it works before any credential exists.

Status

https://array.corp.lab/i/7c2e94d1/Hosts

1+ Add Hosts. Opens New Hosts for one host or a batch.
2Status. Whether the remoting port answered, plus a green ssh ✓ if SSH is open. After a successful Test the reported PowerShell version shows underneath.
3Console. Live PowerShell on this host. See Console.
4Test. Logs in with a chosen credential and runs Get-Host. Proves the account and remoting both work.
5Enable. Only on winrm down hosts. Tries to turn remoting on remotely.
6Edit and Delete. Delete asks Delete host "WS-FS01"? first.
7Enable WinRM — Help. Manual ways to turn on remoting when Enable can't get through.

Badge	Means
checking…	Check in progress, a few seconds per host
winrm up	The remoting port answered. That doesn't prove the account can log in; Test does.
winrm down	No answer. Remoting is off, a firewall is blocking, or the name doesn't resolve. Enable shows on these rows.
ssh ✓	SSH is open and the Console can connect
PS 5.1.20348.2849	Version reported by the last successful Test

Adding hosts

One line per host; + and × work in the mock. Blank lines are skipped. New hosts always start on HTTP port 5985, so HTTPS-only servers get switched over in Edit after saving.

New Hosts

Editing a host

Edit Host

Transport is set here. Tick Use SSL for HTTPS-only hosts and enter the port, normally 5986. The port only fills in by itself when the box is empty. Custom listener ports go here too.

Message	When
Added 3 hosts	New Hosts saved
Added 2, failed 1 — …	Partial save. Each failure's reason follows.
Add at least one host	Every line was blank
Every host needs a display name	A line has an address but no name
Host "WS-APP03" needs a hostname / IP	A line has a name but no address
Host updated	Edit Host saved
Host deleted	Delete confirmed

Test and Enable

Both open the same dialog: pick a credential (listed with its account, e.g. CORP\svc-aperture) and press the button. Test logs in over remoting and runs Get-Host. On success the host flips to winrm up and its PowerShell version is saved.

Enable is for hosts with remoting switched off. It starts Enable-PSRemoting on the server through Windows remote management and needs an account that is a local administrator on the target.

Dialog

Host action

Sidebar notification

After a successful Enable the host is re-checked automatically in about 20 seconds. Press Test after that. Return value 2 almost always means the account isn't an administrator on that server.

An authentication error on Test means the account or password is wrong for that server. For domain accounts, check the credential has its domain set.

Enable WinRM help

If Enable can't reach a server, usually because a firewall blocks remote management, remoting has to be turned on by hand. Enable WinRM — Help at the top of the panel shows the two usual methods.

Enabling WinRM / PSRemoting

Nectere Aperture reaches hosts over WinRM. When a host shows winrm down and the per-host Enable WinRM button can't reach it (DCOM/WMI blocked by firewall, etc.), enable it manually with one of the methods below.

1 · Run locally on the target

Elevated PowerShell on the Windows host. Identical on every machine — no hostname or IP is baked in.

Set-NetConnectionProfile -NetworkCategory Private -ErrorAction SilentlyContinue
Enable-PSRemoting -Force -SkipNetworkProfileCheck
Test-WSMan

2 · Push via Group Policy

Configure these settings in a GPO, then scope it to the target OU.

Listener — Computer Configuration → Policies → Administrative Templates → Windows Components → Windows Remote Management (WinRM) → WinRM Service → Allow remote server management through WinRM = Enabled, IPv4/IPv6 filter *
Service auto-start — Computer Configuration → Policies → Windows Settings → Security Settings → System Services → Windows Remote Management (WS-Management) = Automatic
Firewall — Computer Configuration → Policies → Windows Settings → Security Settings → Windows Defender Firewall with Advanced Security → Inbound Rules → new rule from the predefined group Windows Remote Management (allows TCP 5985; HTTPS-In = 5986)
Optional — … → Windows Components → Windows Remote Shell → Allow Remote Shell Access = Enabled

Note: on older OS the listener policy is named "Allow automatic configuration of listeners". HTTP/5985 traffic is already message-encrypted under Negotiate/NTLM, so HTTPS/5986 is optional.

07Credentials

A Windows account and password. Inventories, Test, Enable and the Console all pick one. Account shows exactly what Aperture logs in as: DOMAIN\user, or the bare username for a local account. Domain reads local when none is set.

https://array.corp.lab/i/7c2e94d1/Credentials

New Credential

There is no Edit. To change a password, save a new credential under the same name. It replaces the old one for every inventory using it.

Message	When
Credential 'sql-ops' created	New name
Credential 'sql-ops' updated	Name already existed
Credential name is required	Name left blank
Username is required	Username left blank
Password is required	Password left blank, updates included
Credential deleted	After `Delete credential "sql-ops"?`

Deleting a credentialNothing stops you deleting one an inventory still uses. Runs against that inventory then fail with Error: Inventory credential not found until it gets another credential.

08Inventories

The target for every run: a list of hosts and the one credential used on all of them. A host can be in any number of inventories, so a broad All Servers next to per-role groups is normal.

https://array.corp.lab/i/7c2e94d1/Inventories

New and Edit Inventory

New Inventory

The filter matches name, address and description; click it in the mock to cycle searches. Ticked hosts stay ticked while filtered out.

Edit opens the same dialog with the current hosts ticked.

Message	When
Inventory 'Production SQL' created	Saved
Inventory updated	Edit saved
Inventory name is required	Name left blank
Select at least one host	Nothing ticked
Select a credential	No credential picked
No hosts defined - add hosts first	In the host list when Hosts is empty
Inventory deleted	After `Delete inventory "Lab"?`

Deleting a host leaves it in its inventories. Runs skip it, but the Hosts column may show a short code in its place until the inventory is edited and saved.

09Variables

Named tables of keys and values, such as share paths, version pins or a maintenance window. Commands and scripts don't read these tables yet, so values still go into the command or script parameters directly.

https://array.corp.lab/i/7c2e94d1/Variables

Delete asks Delete variable table "Patch Window"? first.

Creating a table

New Variable Table

+ New Table, a name, then one + Add Variable per key. Rows with an empty key are dropped on save. A table with no rows shows No variables yet.

Message	When
Variable table 'Build Variables' created	New table saved
Variable table updated	Edit saved
Table name is required	Name left blank
Variable table deleted	Delete confirmed

10Scripts

Saved PowerShell for Command Station. A param() block is parsed on every save and each parameter becomes a field, with defaults, required markers and dropdowns.

https://array.corp.lab/i/7c2e94d1/Scripts

The script editor

The line under the editor lists parameters spotted while typing. It's a quick guess; the real parse happens on Save Script. For an existing script it shows the result of the last save.

Editor

Script editor

Message	When
Script 'Restart-ServiceSafe' saved	New or edited script saved
Name is required	Name left blank
Script content is required	Editor left empty
Script 9a41c07e deleted	After `Delete script "Get-DiskReport"?`. Shows the script's short code, not its name.

Parameters to fields

In your param() block	On Command Station
[Parameter(Mandatory)][string]$ServiceName	Text box with an orange `*` and the hint `required`. Run is blocked until it's filled.
[int]$TimeoutSec = 30	Number box prefilled with `30`. Same for `[long]` and `[double]`.
[ValidateSet('Normal','Force')][string]$Mode = 'Normal'	Dropdown of the allowed values, default selected. Optional ones also offer `(default)`.
[switch]$SkipDependents	Checkbox labelled `Enable`
[string]$Note	Text box with the hint `(uses script default)`. Left empty, the script's own default applies.

Each field shows its type next to the name. A script with no param() block runs as-is and Command Station shows This script has no parameters.

11Command Station

Hosts are worked through one at a time and output is kept per host. The mock is live, host picker included.

https://array.corp.lab/i/7c2e94d1/Command Station

Running a command

Pick an Inventory. Each shows its host count, e.g. File and Web (3 hosts).
Leave Source on Inline Command and type into PowerShell Command. Multiple lines run together as one script per host.
Press Run. Both buttons stay disabled until every host finishes.

The command runs as the inventory's credential, the same as inside Invoke-Command. Output comes back as text, so Format-List or Format-Table -AutoSize help readability.

Running a stored script

Set Source to Stored Script and pick a Script. Its parameters show as fields, per the parameters table. Fields marked * are required and a missing one gets named, e.g. Missing required: ServiceName. Empty optional fields fall back to the script's default.

Reading the output

Pick a host in the picker to see its output. The line above the box shows its address, status and duration. Failed hosts show red output with the error after an [errors] line.

Badge	Means
idle	Nothing run since the panel opened
running	Hosts still in progress
completed	Every host finished without errors
completed (errors)	Finished, but at least one host failed
error	The run couldn't start. Reason is in the output box.

Host status in the picker	Means
queued / pending	Waiting. Output box reads `(queued)`.
running	In progress on this host. Output box reads `(running...)`.
completed	Finished cleanly
failed	Couldn't connect or log in, or the command wrote errors

Test Connectivity

Logs in to every host and returns its computer name and Windows edition, e.g. WS-FS01 (Microsoft Windows Server 2022 Standard). Worth running before anything that changes servers. Shows in Recent Runs as connectivity test.

Recent Runs

The last 50 runs, newest first. Click one to load its results back into the output box and picker. A pulsing amber dot means still running. Green only means finished, so open the run to check each host.

Message	When
Select an inventory	Run or Test Connectivity with no inventory picked
Enter a PowerShell command	Inline command box empty
Select a script	Stored Script with nothing chosen
Missing required: ServiceName	A required parameter is empty
Error: Inventory credential not found	The inventory's credential was deleted. Edit the inventory.
Error: No valid hosts in inventory	Every host in the inventory was deleted

12Console

Console on a Hosts row opens interactive PowerShell on that server in a dialog. Tab completion, colour, history and Read-Host prompts all work. Pick a credential and press Open Console.

State

Console

Disconnect, × and Cancel all end the session, and anything still running in it stops.
Console activity isn't recorded in Recent Runs.
A tile allows 10 open consoles across all users. The eleventh gets No free console slots (max 10). Disconnect one first.

Enable SSH on host

Windows Server doesn't enable SSH by default. If the console shows Connection refused, reopen it and press Enable SSH on host. Aperture logs in over remoting with the selected credential and sets up the server, which takes a minute or two. Once Hosts shows ssh ✓ the console is ready. On the server it:

installs the OpenSSH Server feature if missing (may need Windows Update or a feature source)
sets sshd to start automatically and starts it
allows TCP 22 inbound with a firewall rule named OpenSSH Server (sshd) [NexusAperture]
makes Windows PowerShell the default SSH shell

The host has to be winrm up first.

13Users and roles

Application sign-in only. Both roles do all the day-to-day work; admins also manage users and Backup.

https://array.corp.lab/i/7c2e94d1/Users

Edit User

Role	Can
admin	Everything, Users and Backup included
user	Everything except Users and Backup. Listed as `standard user`.

Message	When
User 'jlee' created	+ Add User saved. Role defaults to `User`.
User already exists	Username taken
Password is required for new users	New user with no password
User 'jlee' updated	Edit saved. A blank password keeps the current one.
User 'jlee' deleted	After `Delete user "jlee"? This will revoke their sessions.` The user is signed out at once.
Cannot delete yourself	Tried to delete the signed-in account

With Array sign-on the panel is hidden. If reached anyway it reads User accounts are managed in Nectere Array.

14Backup and restore

Backup & Restore

Export or import all configuration under /conf

Export downloads everything under /conf as one .zip. Import overwrites all current configuration with an uploaded backup (no merge). This app stores no encrypted secrets, so a backup restores cleanly on any deployment.

After importing, restart the app container to apply.

Exports are named like nectereaperture-conf-20261026-143207.zip and hold hosts, credentials, inventories, scripts, variable tables and Aperture's own users.
Credential passwords in it are readable by anyone who opens it. Store exports like a password list.
Nothing in it is tied to one tile, so it restores on any Aperture. Useful for copying a setup.
Import asks This OVERWRITES all current configuration with the uploaded backup. Continue?, then shows Import complete. Restart the app container to apply. Restart from the Array tile with State › Restart.
Recent Runs aren't included.

15Activity log

Host checks, tests, enables, console sessions and backups each get a line. Read it from the tile's Logs button in Array. Start there when Test or Enable misbehaves.

NA-TRACE [2026-10-26T14:02:11.4410215+00:00] [INFO] [PROBE] WS-FS01 (ws-fs01.corp.lab) winrm=True ssh=True
NA-TRACE [2026-10-26T14:02:11.9021173+00:00] [INFO] [PROBE] WS-APP03 (ws-app03.corp.lab) winrm=False ssh=False
NA-TRACE [2026-10-26T14:03:40.1180962+00:00] [INFO] [TEST] Get-Host -> WS-FS01 (ws-fs01.corp.lab:5985, ssl=False) as CORP\svc-aperture
NA-TRACE [2026-10-26T14:03:42.6627310+00:00] [INFO] [TEST] WS-FS01: OK - WS-FS01 PS 5.1.20348.2849 (Microsoft Windows Server 2022 Standard)
NA-TRACE [2026-10-26T14:05:02.0042871+00:00] [INFO] [ENABLE] DCOM Enable-PSRemoting dispatch -> WS-APP03 (ws-app03.corp.lab) as CORP\svc-aperture
NA-TRACE [2026-10-26T14:05:04.3310455+00:00] [WARN] [ENABLE] WS-APP03: failed - Win32_Process.Create returned 2 (non-zero = failure)
NA-TRACE [2026-10-26T14:11:27.5508830+00:00] [INFO] [SSH-ENABLE] Enabling OpenSSH on WS-FS01 (ws-fs01.corp.lab) via WinRM
NA-TRACE [2026-10-26T14:30:15.7702214+00:00] [INFO] [Backup] Config exported by admin

Tags are PROBE, TEST, ENABLE, SSH-ENABLE, CONSOLE and Backup. Read WARN and ERROR lines first. Command Station runs aren't logged here; their results are in Recent Runs.

16Things to know

Hosts run one at a time. An offline host holds up the rest for about 30 seconds before it's marked failed. Keep dead hosts out of big inventories.
Recent Runs don't survive a restart. Restarting or updating the tile clears them. Copy out anything worth keeping.
One credential per inventory. Servers that need a different account need their own inventory.
The list search boxes don't filter yet. The host filter in the inventory dialog does.
Enable SSH changes the server. Check your server standards first.
Dialogs only close from their buttons. Clicking the dimmed backdrop does nothing.

17Troubleshooting

You see	Do this
Host shows `winrm down`	Check WinRM is on, TCP 5985 (5986 for HTTPS) is open and the name resolves. Then try Enable with an admin account, or Enable WinRM — Help.
Enable says `Win32_Process.Create returned 2`	The account isn't a local administrator there.
Enable can't reach the host at all	A firewall blocks remote management. Turn remoting on locally or by Group Policy, per the help card.
Test fails with `InvalidCredentialsError`	Wrong username or password, or no domain. Save the credential again under the same name.
`winrm up` but Test times out	Probably HTTPS-only. Edit the host, tick Use SSL, set port `5986`.
One host in a run is `failed` with a long error	Read the first line under `[errors]`. A timeout means unreachable; an authentication error means the inventory's credential doesn't work on that host.
Run stops with `Error: Inventory credential not found`	The credential was deleted. Edit the inventory and pick another.
Console shows `Connection refused`	SSH isn't running. Use Enable SSH on host, wait for `ssh ✓` in Hosts, then reopen the console.
Enable SSH fails or never finishes	The server likely can't download the OpenSSH feature. Install OpenSSH Server by hand or from a local feature source, then retry.
Console asks for a password or drops straight away	The account can't log in over SSH. Check its sign-in rights on that server and that the stored password is current.
`No free console slots (max 10)`	Ten consoles are already open on this tile. One has to be disconnected.
Backup menu item is missing	Standard user. Ask an admin.
Recent Runs is empty after a restart	Expected. The list resets on restart.

01The app

02How the pieces fit

Typical order

03Deployment

04Sign-in and setup

Array sign-on

05Sidebar and notifications

Footer

06Hosts

Adding hosts

New Hosts

Editing a host

Edit Host

Test and Enable

Sidebar notification

Enable WinRM help

Enabling WinRM / PSRemoting

07Credentials

New Credential

New Credential

08Inventories

New and Edit Inventory

New Inventory

09Variables

Creating a table

New Variable Table

10Scripts

The script editor

Edit Script

Parameters to fields

11Command Station

Running a command

Running a stored script

Reading the output

Test Connectivity

Recent Runs

12Console

Enable SSH on host

13Users and roles

Edit User

14Backup and restore

Backup & Restore

15Activity log

16Things to know

17Troubleshooting