Windows - Tray Notification - Set Tooltip Text

What the agent tray tooltip setter does

This Automox Worklet™ writes a custom tooltip string to the Automox agent system tray icon on Windows endpoints. The tooltip is what a user sees when they hover the cursor over the small Automox icon in the notification area at the bottom right of the taskbar. By default it reads simply "Automox," which gives the end user no signal that the agent is sanctioned by their own IT or security team.

The Worklet reads a tooltip value from the policy variable TooltipText, then calls amagent.exe notifications set_tray_tooltip --text "<value>" against the installed agent. It also writes a row keyed tooltipText into a state file at C:\Program Files (x86)\Automox\tray_branding_text_state.csv so the next evaluation phase can confirm the endpoint still matches the configured value. The state file is shared with the sibling tray-branding Worklets (titlebar text, reset variants), so each row belongs to a single branding key and the policies do not collide.

This Worklet is the configure path. The companion Worklet that reverts the tooltip to the stock "Automox" default lives at a separate slug and is the one to schedule when you stop enforcing a custom value. Run the two on a single endpoint and the more recently scheduled policy wins. The agent itself does not need a service restart for the tooltip change to take effect – amagent.exe applies the update directly to the running tray UI.

Why enforce a custom agent tray tooltip

The Automox tray icon is the most visible piece of your endpoint management stack from an end user's perspective. A generic "Automox" tooltip leaves the user guessing whether the icon belongs to a sanctioned IT tool, a third-party install they should report to security, or something installed by a previous admin. Renaming the tooltip to read "Acme IT – Endpoint Management" or "Helpdesk: x4000" turns the icon into a clear ownership signal and a quiet self-service nudge. It also cuts the helpdesk tickets that start with "there is a thing in my system tray I do not recognize."

Tray branding drifts in ways that are obvious to end users and easy for platform teams to miss. An admin sets the tooltip during a hardware refresh and the value is wiped when the next reimage runs, an agent reinstall during a hardware swap clears the TrayTooltip registry value, a new endpoint comes online from a stale provisioning template without the policy. The Worklet reads the agent's TrayTooltip value on every cycle, compares it to the $TooltipText variable, and calls amagent.exe notifications set_tooltip when the strings diverge, so a misbranded endpoint is corrected before the next audit screenshot.

How tray tooltip enforcement works

1. Evaluation phase: The Worklet first reads HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall to confirm Automox Agent 2.5.0 or later is installed; older agent builds lack the set_tray_tooltip subcommand and the Worklet exits 2 with a version message. It then checks for tray_branding_text_state.csv in the Automox install directory. If the file is missing, it exits 2 (non-compliant). If the file exists, it imports the CSV and looks for the row where Key equals tooltipText. The endpoint is compliant only when that row's Value exactly matches the configured TooltipText parameter; otherwise the Worklet exits 2 and schedules remediation.

2. Remediation phase: The remediation script validates that TooltipText is not empty, then resolves amagent.exe under ${env:ProgramFiles(x86)}\Automox\amagent.exe (falling back to %ProgramFiles%\Automox\amagent.exe for 32-bit installs). It runs amagent.exe notifications set_tray_tooltip --text "<TooltipText>" and checks $LASTEXITCODE. On exit code 0, it writes (or updates) the tooltipText row in tray_branding_text_state.csv using a shared Write-TextBrandingState helper that preserves any other rows the sibling tray Worklets have written. On any non-zero exit code, it surfaces stderr to the Automox activity log and exits 2 so the failure is visible rather than silent.

Tray tooltip configuration requirements

• Windows 10, Windows 11, or Windows Server 2016 or later with the Automox agent installed

• Automox Agent version 2.5.0 or higher (older builds do not expose the set_tray_tooltip subcommand)

• PowerShell 5.1 or later available to the Automox agent execution context

• amagent.exe present at %ProgramFiles(x86)%\Automox\amagent.exe or %ProgramFiles%\Automox\amagent.exe

• Set the TooltipText policy variable in evaluation.ps1 and remediation.ps1 to the same non-empty string (for example, "Acme IT – Endpoint Management")

• Write access to C:\Program Files (x86)\Automox\tray_branding_text_state.csv (the Automox agent runs as SYSTEM by default and meets this)

• RunNow capability enabled in the policy so the Worklet is FixNow compatible

Expected state after tooltip enforcement

After the Worklet completes successfully, hovering over the Automox icon in the Windows notification area shows the custom string you configured in TooltipText. The change is immediate and visible to the currently logged-in user without requiring a sign-out, agent restart, or endpoint reboot. The tray_branding_text_state.csv file contains a row with Key=tooltipText and Value=<your string>, alongside any rows written by the sibling titlebar branding Worklets. Exit code 0 in the Automox activity log confirms both the amagent command and the state file update succeeded.

Subsequent policy runs report the endpoint as compliant without re-applying the tooltip, because the evaluation phase finds the CSV row already matches the configured value. If a user (or a competing branding policy) overwrites the tooltip, the next evaluation detects the drift on the CSV row, exits 2, and remediation re-applies the configured string. To validate manually, hover over the tray icon and confirm the new text, then open tray_branding_text_state.csv in Notepad and confirm the tooltipText row matches what the policy expects.