OpenUEM: Self-Hosted Open-Source Unified Endpoint Management

TL;DR

• OpenUEM is a self-hosted, open-source Unified Endpoint Manager: one web console to inventory, monitor and operate your Windows and Linux endpoints through lightweight agents.
• It is an independent open-source project (Apache 2.0) created and maintained by the OpenUEM project, not by Navanem. This is a community spotlight; the code lives at github.com/open-uem and the docs at openuem.eu.
• The console can admit agents, browse hardware and software inventory, deploy and remove packages with WinGet, run remote assistance over VNC, push profiles, and power-manage machines with Wake-on-LAN.
• Built in Go, messaging over NATS, certificate-secured end to end. Latest at the time of writing: Console v0.12.0, Agent v0.11.0.

What is OpenUEM?

OpenUEM is a self-hosted Unified Endpoint Manager that lets you manage your IT assets from a single web interface. You run it on your own infrastructure, install an agent on each endpoint, and operate the whole fleet from the console. The project describes itself as designed from the ground up to be easy to install, with a clean and concise interface.

It is released under the Apache 2.0 license. The source code is on GitHub at github.com/open-uem and the documentation lives at openuem.eu.

A note on this page: OpenUEM is an independent project created and maintained by the OpenUEM project and its contributors, not by Navanem. We feature it here as part of our open-source spotlight because it solves a real problem for sysadmins. All credit for the software goes to its authors. Please star and support the project on GitHub.

What can the OpenUEM console do?

The console is OpenUEM's web user interface for managing endpoints. According to the project, it lets you:

• Admit, enable or disable an agent that contacts the OpenUEM agent workers
• Browse the information an agent gathered about an endpoint
• Start a VNC remote-assistance session
• Browse the files on an endpoint's logical disks
• Deploy a package to an endpoint with WinGet, and uninstall packages that OpenUEM deployed
• Create profiles that automate tasks: deploy software and manage settings such as the registry, local users and local groups
• Wake-on-LAN, power off and reboot endpoints
• Get statistics and check the status of the different OpenUEM components

How does the agent work?

You install the OpenUEM agent on each endpoint. The agent gathers and reports information about the machine, and it also runs an SFTP server and a VNC proxy for file access and remote assistance. Reports travel to the agent workers as NATS messages, and the workers store the data in the database that the console reads from.

A newly installed agent stays in a "Waiting for admission" state until an administrator approves it from the console. On admission, the agent receives a digital certificate so it can secure its services. An agent can be disabled later if you no longer want its reports. For package and setting management, the agent uses WinGet.

OpenUEM currently ships agents for Windows and Debian/Ubuntu Linux, with more platforms planned.

How is OpenUEM secured?

Security is certificate-based throughout. Each agent uses several certificates and private keys: one to authenticate to the NATS servers when sending reports, one to secure its SFTP and VNC/RDP communications, one to authenticate SFTP connections coming from the console, and the CA certificate to validate everything signed by OpenUEM's own Certificate Authority. The suite includes an OCSP responder and a certificate-manager component to issue and check these certificates.

What are the components?

OpenUEM is a suite of small Go services rather than a single binary. The main pieces are:

• Console - the web UI you manage everything from (v0.12.0 at the time of writing)
• Agent - runs on each endpoint, gathers data, and hosts SFTP plus a VNC proxy (v0.11.0)
• Workers - receive agent reports over NATS and persist them, alongside notification and cert-manager workers
• NATS service - the message exchange between agents and workers
• OCSP responder and cert-manager - the PKI that secures agent-to-server communication
• Server-updater and messenger - keep server components current and surface messages to users

How do you deploy it?

The project provides an openuem-docker repository with a Docker Compose setup, and the images are published on Docker Hub. You can run all components on a single machine with Docker or Podman: clone the repository, copy the provided .env-example to .env, adjust the variables (the example boots a working demo on the openuem.example domain), and bring the stack up with compose. The documentation also covers a production setup behind a Caddy reverse proxy, and there is an APT repository for Debian and Ubuntu. Full instructions are in the OpenUEM documentation.

The project recommends changing the default 32-character JWT key and making sure the console and NATS hostnames resolve through DNS (or hosts entries) before going to production.

Why feature OpenUEM?

Commercial endpoint-management suites are expensive and rarely self-hostable. OpenUEM puts inventory, software deployment, remote assistance and power management for mixed Windows and Linux fleets into one open-source console you control. It was recognized with a SourceForge Rising Star award in January 2026, and it is under active development with regular releases. If you run a small or mid-sized fleet and want to keep your management plane in-house, it is worth a look.

FAQ

Is OpenUEM made by Navanem?

No. OpenUEM is an independent open-source project created and maintained by the OpenUEM project and its contributors. We are spotlighting it here; all credit belongs to its authors. The source is at github.com/open-uem under the Apache 2.0 license.

Which endpoints can it manage?

OpenUEM currently provides agents for Windows and Debian/Ubuntu Linux, with more platforms planned. The agent reports inventory, enables remote assistance, and handles package and setting management on those systems.

Is it really free and self-hosted?

Yes. OpenUEM is open source under Apache 2.0 and runs entirely on your own infrastructure. The project also offers an optional "Fund a Feature" program and commercial support for organizations that want them, but the software itself is free.

How is it installed?

The simplest path is the official Docker Compose setup from the openuem-docker repository, with images on Docker Hub; it can run every component on one machine. A Debian and Ubuntu APT repository is also available. See the documentation at openuem.eu for production guidance.

Where do I get it?

The code, releases and issue tracker are on GitHub at github.com/open-uem, and the documentation and community links are at openuem.eu.