Skip to content
Go to k12panel.com
  • There are no suggestions because the search field is empty.

AI Search: What You Can Search For

AI Search is pretty flexible, but it helps to know what fields it understands so you can write better queries and troubleshoot when results aren't what you expected. This page is your reference for everything AI Search knows about.

Hardware fields and software inventory are only available for devices that have checked in with the k12panel Windows or ChromeOS agent. If a field shows no results, the device may not have reported that data yet.

These fields work the same way in Cross Org Search as on the single-org Assets screen, with one exception noted under Classification & Location.

Device Identity

These fields are populated for all assets, regardless of whether an agent is installed.

What you can search Example queries
Device name show devices named RW-LIB-TEACH1
Serial number find serial number 3BZ8T13
Manufacturer show all Dell devices / HP laptops
Model OptiPlex 5070 computers
Internal ID (asset tag) internal ID LAP-00442
Notes devices with notes containing warranty
Description devices described as loaner

Classification & Location

AI Search understands your organization's category and site hierarchy. A search for a parent category or site automatically includes all of its children.

What you can search Example queries
Device category (asset class) show all laptops / Chromebooks / desktop computers
Site / location devices at Lincoln Elementary / all assets at the district office
Org unit devices in the Special Education org unit
Tags devices tagged needs-repair / tagged loaner
Groups devices in the Summer Deployment group

Tip: On the single-org Assets screen, site and category searches are hierarchy-aware. Searching for "Middle School" will also return results from any subsites under it (e.g., "Middle School — Library", "Middle School — Lab 2").

Cross Org Search difference: in cross-org mode, category and site searches match by name only — they do not automatically include child categories or sites.

Hardware Fields

Hardware fields are populated when a Windows or ChromeOS agent checks in. Fields will be blank or missing for devices that have never reported hardware inventory, or for non-agent-managed assets (e.g., manually entered records).

Operating System
What you can search Example queries
OS name Windows 10 devices / Windows 11 laptops / Chromebooks / Macs
OS version / build devices on build 25H2

The system understands common shorthand. "Chromebook," "Windows PC," "Mac," and "iPad" all resolve to the correct OS filter automatically.

Memory & Storage
What you can search Example queries
RAM devices with less than 4GB RAM / laptops with 8GB or more RAM
Storage devices with less than 128GB storage / computers with 256GB or more

RAM is stored in megabytes internally. You can use natural language like "4GB," "8 gig," or "16GB" and the system converts automatically.

Processor
What you can search Example queries
CPU model devices with an i5 processor / Celeron laptops
Battery
What you can search Example queries
Battery health % Chromebooks with battery health below 50% / laptops with battery under 80

Battery health is only available for devices whose agents report it. Desktops and devices without batteries will not have this field.

Hostname & Identity
What you can search Example queries
Computer hostname find hostname RW-LIB-TEACH1
BIOS version devices on BIOS version 1.35.0
Display resolution devices with 1920x1080 resolution
Network / MAC Addresses
What you can search Example queries
Any MAC address (WiFi or Ethernet) find MAC address C8:F7:50:F4:78:41
WiFi MAC specifically WiFi MAC C8:F7:50:F4:78:41
Ethernet MAC specifically Ethernet MAC C8:F7:50:F4:78:41
Local IP address devices with IP 10.8.3.109
WAN / agent IP devices connecting from 72.14.100.1

By default, a MAC address search checks both WiFi and Ethernet adapters. Specify "WiFi MAC" or "Ethernet MAC" if you need to target one interface.

The combined "any MAC" search is available on the single-org Assets screen only. In Cross Org Search, target the WiFi or Ethernet MAC specifically.

Active Directory Domain
What you can search Example queries
Domain-joined (any domain) show computers attached to active directory / domain joined devices / computers on AD
Not domain-joined computers not on a domain / workgroup computers / no AD
Specific domain devices on domain circleschools.k12.mt.us / computers on the district domain

Domain data is reported by the Windows agent. ChromeOS devices and manually-entered records will not have a domain value. A device with no domain data is different from a device confirmed to be on a workgroup — the query "not domain joined" only returns devices whose agents have reported that they are not on a domain, not devices that have never reported.

Last Logged-In User
What you can search Example queries
Last user devices last used by jsmith / computers where last user is administrator

This reflects the most recent user profile reported by the Windows agent at the time of the last hardware checkin. It is not a real-time login indicator.

Windows Update Status

Windows Update fields are populated when the Windows Update SpecialWorker has run on a Windows asset. They are not available on ChromeOS, Mac, or manually-entered assets. A null value means "no data yet" (worker hasn't run, or asset is not Windows) — not "compliant."

What you can search Example queries
Reboot pending windows devices that need a reboot / machines waiting to restart
Pending critical updates assets with pending critical updates / windows machines behind on security patches
Pending updates (any) windows devices that need updates
Failed updates (last 30 days) assets with failed windows updates / machines with stuck updates
Broken Windows Update agent machines with broken windows update / WU agent not responding
Haven't checked recently windows machines that haven't checked for updates in 30 days
Never reported WU data windows assets with no patch inventory

The pending count excludes driver and Defender definition updates by default (they're noisy and admins often skip them). Driver count is tracked separately as hw_wu_pending_driver_count.

Antivirus & Defender

Antivirus and Microsoft Defender fields are populated when a Windows device reports antivirus inventory. They are not available on ChromeOS, Mac, or manually-entered assets. A blank value means "no data yet" — not "unprotected."

What you can search Example queries
Real-time antivirus product devices running Defender as real-time / machines protected by Webroot
No real-time antivirus windows devices with no real-time antivirus / unprotected computers
AV definitions status devices with out-of-date antivirus definitions
Defender running mode computers where Defender is passive / Defender not actively scanning
Defender posture machines where Defender is absent
Defender monitoring enabled devices with Defender monitoring enabled / monitoring disabled
"False confidence" mismatch devices monitored but Defender is passive
Uncontained threats devices with active threats / infected devices / machines with more than 2 uncontained threats

Uncontained threats counts active Microsoft Defender detections that were allowed or whose remediation failed and that haven't been acknowledged — the same number shown by the Threats column on the Assets list and on the device's Defender tab. 0 means no active threats (or no data). Contained/remediated and acknowledged threats are not counted. See the Microsoft Defender Monitoring article for how this data is collected.

Software Inventory

Software search finds devices based on what is installed. Software inventory is populated from the Windows agent's software report and is only available for Windows devices. ChromeOS, Mac, and manually-entered assets do not have software inventory.

What you can search Example queries
Has an app installed devices with Chrome installed / show computers that have Zoom
Does not have an app Windows devices without antivirus / computers without Office
Combination devices that have Firefox but not Chrome

When software search doesn't work:

  • The device has never reported a software inventory (agent not installed, or agent is ChromeOS-only)
  • The software inventory is stale — the agent reports software on a scheduled cycle, not in real time
  • The app name is listed under a different name in the Windows registry (e.g., "Microsoft Office 365" vs "Microsoft 365")

If you get no results for a known-installed app, try a partial name: Microsoft 365 instead of Microsoft Office 365 ProPlus.

Checkout & Assignment

What you can search Example queries
Checked out to a person (name) devices checked out to Kristi Smith / assigned to John
Checked out to an email devices checked out to jsmith@school.org
Unassigned devices unassigned laptops / Chromebooks not checked out
Any assigned device devices that are checked out

Dates

What you can search Example queries
Manufacture date Chromebooks older than 3 years / devices manufactured before 2020
Expiration / end-of-life date devices expiring this year / assets with expiration before June 2026
Last seen (last agent checkin) devices not seen in 30 days / assets inactive for 60 days

"Last seen" reflects the last time the device record was updated by an agent checkin. Manually-entered assets that have never had an agent installed will show their record creation date.

Device State

By default, AI Search returns Active and Inactive devices. You can explicitly ask for other states:

State Example queries
Active show only active devices
Inactive show inactive laptops
Archived archived Chromebooks
Trashed trashed devices
On-ramp devices in on-ramp

When you ask for "all devices" without specifying a state, Active and Inactive are returned — archived and trashed are excluded unless you ask for them.

Agent Information

What you can search Example queries
Agent version devices running agent version 4.2 / agents older than 4.0

Organization (Cross Org Search only)

In Cross Org Search you can scope a query to specific organizations by name.

What you can search Example queries
At a specific org Windows 11 laptops at Riverside
Excluding an org devices with active threats except at Sunnydale

Combining Conditions

You can combine any of the above in a single query. The system applies all conditions together (AND logic).

Examples:

  • Dell Windows 11 laptops with more than 8GB RAM at Lincoln Elementary
  • Chromebooks older than 4 years with battery health below 60%
  • Unassigned Windows 10 devices not seen in 90 days
  • Domain-joined computers without antivirus installed
  • Devices tagged loaner that are currently checked out
  • Windows devices with active threats running Defender as real-time

What AI Search Cannot Do

  • Cannot search activity logs, audit records, or financial data. Use the reporting section for those.
  • Cannot search across organizations unless you are using the Cross Org Search screen and have been granted cross-org access.
  • Cannot search ChromeOS software. Installed app inventory is Windows-only.
  • Results are bounded by your permissions. AI Search does not grant access to assets outside your organization.
  • Hardware fields require agent data. If an agent has never checked in, hardware fields will be empty and those filters will return no results for that device.