Fleet management for Windows
Portrait is a free, self-hosted platform for managing a fleet of Windows machines - inventory, patch governance, remote scripting, monitoring, compliance reporting and RBAC. There is no per-seat license.
Why Portrait exists
Managing a Windows fleet today means choosing between tools that are expensive, enterprise-shaped, or hollowed out. For Ubuntu, the tool you actually want exists and is good: Canonical Landscape, with a small agent, an outbound-only message exchange, an activity queue, profiles and access groups. That model transfers to Windows cleanly. Portrait ports the product, not the code.
| Option | The problem |
|---|---|
| Intune / Entra | Cloud-only, per-seat cost, needs Entra ID, weak for servers and non-domain hosts |
| SCCM / MECM | Enormous and expensive; needs Active Directory, SQL Server and a specialist |
| WSUS | Deprecated by Microsoft; patch-only; no inventory, scripting or compliance |
| Tanium / Automox / NinjaOne / Action1 | Commercial SaaS, per-endpoint pricing, closed |
| Ansible / Salt / DSC | Excellent primitives, but no fleet product: no inventory UI, no patch orchestration, no RBAC |
There is no free, self-hosted, API-first fleet manager for Windows. That is the gap Portrait fills.
Who it is for
Small fleets that are still fleets. Too big to manage by hand, too small or too poor for Intune, and uninterested in standing up a domain just to get patch management. Anyone who can afford to run Active Directory can afford Intune; Portrait is for everyone else. It is usable by a homelab with six machines and by a business with two thousand.
Design commitments
| Server | PostgreSQL 16 + Python/FastAPI, behind a reverse proxy of your choice |
| Agent | Windows service, .NET, self-contained, executes PowerShell in-process |
| Transport | Agent-initiated outbound HTTPS only. A managed host never opens a listening port |
| Identity | Per-agent keypair, TPM-bound where available; hostname-only self-registration into an admin-approved hold zone |
| API | REST, OpenAPI-first. The web UI is a client of the same public API, with no privileged back door |
| Scale | 1 to ~5,000 hosts on a single node; app and data tiers separable from the first commit |
| Software sources | Upstream only. Portrait governs when and whether updates apply; it hosts nothing |
| Directory | OIDC and local accounts. No AD, no LDAP, no GPO |
Principles
- Outbound-only agents. A managed host never opens a port. This is what makes the model work through NAT, on laptops, across VLANs.
- Everything is an activity. Every mutation is queued, auditable, attributable, cancellable and observable. Nothing is fire-and-forget.
- Authorization from day one. RBAC and access groups are in the first migration, not bolted on later.
- Don’t invent data. If Windows does not expose a load average or a third-party package severity, Portrait says so rather than synthesizing a plausible number.
- Boring, self-hostable dependencies. PostgreSQL and Redis, and a very good reason for anything more.
- Honest gaps. A documented “we cannot do this” beats a perpetual roadmap item.
API documentation
Portrait is API-first. The web UI is just a client of the same public REST API, and everything it can do is available to your own scripts and agents.
Placeholder A generated OpenAPI reference and a machine-readable schema will live here once the API is stable. This section is written to be readable by both people and the coding agents that will build against Portrait.
- One versioned REST API under
/api/v1/. No legacy or private side-channel. - OpenAPI 3.1 document served at
/api/v1/openapi.json; a generated client ships with the CLI. - Token auth, RBAC-scoped identically to the UI. Every mutation returns an activity you can poll.
- Until the generated reference is published, the design intent is on the API reference page.
Start here
How Portrait works →
The architecture, the outbound-only message exchange, and why everything is an activity.
Enrolling hosts →
Install the agent, approve a pending host, and place it in an access group.
Patching & profiles →
Upgrade, package and reboot profiles, and maintenance windows.
Roadmap →
Where Portrait is today, and what is still ahead.