eLLA · AI system administration for Linux and Windows · part of eLLM

Describe the problem in plain English. eLLA finds it, explains it and fixes it, only with your approval.

eLLA is an AI administration partner that lives in your terminal on Ubuntu and Windows. It investigates with read-only checks, explains what it found, proposes the exact fix with a second AI's review, and only with your approval applies it, verifies it and records how to undo it. If a change cannot be undone, eLLA tells you before you approve. It talks only to your own eLLM endpoint. New: ask "would this machine pass Cyber Essentials?" and get a readiness report against six security standards.

Ask for a demonstration Certification readiness

Linux and Windowsbash-native on Ubuntu, PowerShell-native on Windows 10/11 and Server 2019–2025

Nothing changes unseenevery change previewed, reviewed by a second AI and approved by you

Undo, honestlyreversible changes are recorded with their undo, and eLLA warns you before any change that has none; ella undo rolls back

46 expert skills31 for Linux, 15 for Windows: proven playbooks eLLA reads before acting

Who it is for

A careful second pair of hands for the whole estate

eLLA brings the specialist knowledge and asks the right questions, so a small team can look after Linux and Windows with the same confidence.

IT teams and MSPs

Looking after mixed Linux and Windows estates with too few people. One assistant, one way of working, one audit trail across both.

Generalists

Not a specialist in every platform? eLLA knows the commands, follows proven playbooks, and asks when a decision is yours: which OU, which option, when to reboot.

Experienced admins

A fast, careful second pair of hands that does the digging, documents everything it does, and never runs a change you have not seen.

why did the server reboot last night?create Jo Bloggs in Sales with the same groups as Samstop the sales team using USB stickswhy does this account keep locking?is the disk on this server healthy?

NewCertification readiness

"Would this machine pass Cyber Essentials?" Now you can just ask.

eLLA checks a device against the security standard you are working towards and produces a client-ready report in seconds: every control, what it found, why it fails and exactly how to fix it. Then it helps you fix it.

$ ella assess cyber-essentials # or simply ask eLLA

Six standards built in, from Cyber Essentials and IASME to the Defence Cyber Certification, ISO 27001, the Essential Eight and PCI DSS. Know where every machine stands before the assessor does.

Cyber Essentials v3.3 · readinessFIN-PC-14 · Windows 11 Pro · read-only scan, 6 s

31Pass

3Fail

2Evidence needed

1Advisory

FAIL

Security updates · 14-day windowTwo high-severity updates released 19 days ago are not installed.Fix: install KB pending updates, then reboot out of hours. eLLA can do this with your approval.

FAIL

User access · admin separationThe daily user account "jsmith" is a member of local Administrators.Fix: create a separate admin account and remove jsmith from Administrators.

EVIDENCE

Boundary firewallA device cannot prove the office firewall configuration.Answered once for the organisation, reused for every machine.

PASS

Malware protectionDefender real-time protection on, definitions updated today.

Verdicts are scored by code, not by the AI. Certification is awarded to the organisation by an accredited certification body.

Cyber Essentials

v3.3 "Danzell", 2026

Every technical question: firewalls, secure configuration, security updates, user access and malware protection, plus the Cyber Essentials Plus audit tests.

CECE+

Defence Cyber Certification

Def Stan 05-138 · Applicant Guide v2.2

All 148 controls. Around 55 are checked on the machine itself; the rest are listed as the evidence items you will need to produce.

L0L1L2L3

ISO/IEC 27001:2022

Annex A

The technological controls in A.8, plus endpoint evidence that supports the people and physical controls.

Annex A

ASD Essential Eight

November 2023

All eight mitigation strategies, from application control and patching to macro settings, admin privileges, MFA and backups.

ML1ML2ML3

PCI DSS

v4.0.1

The requirements that apply to a workstation or server in or connected to the cardholder data environment.

Endpoint

IASME Cyber Assurance

Levels 1 and 2

The Cyber Essentials prerequisite plus the IASME additions, for organisations going a step beyond CE.

L1L2

Checks the machine itself

Firewall, updates and the 14-day patch window, supported OS and software, accounts and admin separation, password and lockout policy, screen lock, anti-malware and web protection, allow-listing, encryption, logging, backup, TLS and more. Read-only, in seconds.

Asks what a device cannot prove

Boundary firewalls, MFA on cloud services, account processes. Answered once per organisation, then reused for every machine you assess.

Clear, client-ready results

PASS, FAIL, EVIDENCE NEEDED or ADVISORY for every control, with what was found, why it fails and exactly how to fix it. Markdown and JSON reports.

Fix it with eLLA

"Help me fix the Cyber Essentials failures" walks through each one, with the usual review, your approval and an undo wherever one is possible.

Deterministic and honest. The pass or fail verdict comes from code, not from the AI, so the same machine gets the same answer every time. And every report says plainly that certification is awarded to the organisation by an accredited body: eLLA gets you ready, it does not certify you.

How it works

Ask, investigate, explain, propose, approve, verify

Each session starts with a snapshot of the machine, so eLLA is grounded in what is actually there rather than guessing.

1

Ask

Type a question or task in plain English, or a quick /command.

2

Investigate

Read-only diagnostics run automatically: logs, services, disks, network, event logs, AD health.

3

Explain

A plain-English diagnosis: what is wrong, why, and what it recommends.

4

Propose

The exact command or file change, the reason, a second-AI review verdict and the undo, or a clear warning that there is none. Multi-step work arrives as a numbered plan.

5

Approve

Yes, no, or "always for this session". Nothing changes until you say so.

6

Verify and record

eLLA checks the change worked, logs it, records the undo where there is one and can write an incident report.

eLLA · bash · ubuntu-web-01

you › why did the server reboot last night?
  read  journalctl -b -1 · dmesg · systemctl --failed · free -h
eLLA › The kernel's out-of-memory killer fired at 02:14 and the
  watchdog rebooted the box. php-fpm had 48 workers at ~180 MB
  each on a 8 GB server during the nightly Moodle cron.
  Proposed  /etc/php/8.3/fpm/pool.d/www.conf
            pm.max_children 48 → 24, then reload php-fpm
  Review    second AI: safe, reversible, matches the diagnosis
  Undo      backup saved · restore with ella undo
  Apply? [y/N] y
  ✔ php-fpm reloaded · 24 workers · memory headroom 2.1 GB · logged

eLLA · PowerShell · DC01 (elevated)

you › create Jo Bloggs in Sales with the same groups as Sam
  read  domain OU layout · username pattern · UPN suffix · Sam's groups
eLLA › Your pattern is first initial + surname, so: jbloggs,
  jo.bloggs@contoso.local, in OU=Users,OU=Sales. Sam is in 6 groups.
  Plan:
   1. New-ADUser jbloggs in OU=Users,OU=Sales
   2. Add to the same 6 groups as Sam
   3. Require a password change at first sign-in
  Review    second AI: matches request and naming convention
  Undo      remove user and group memberships
  Initial password: (hidden prompt, never seen by the AI)
  Approve plan? [y/N] y
  ✔ 3/3 steps verified · logged to Windows Event Log

Safe by design

An AI that can change servers needs brakes it cannot talk its way past

eLLA's safety does not depend on the model behaving. The rules are deterministic, the review is independent, and everything is recorded.

A classifier, not a judgement call

Read-only commands run instantly; anything that changes state is gated. The AI is never asked to judge safety. On Windows it uses PowerShell's own parser to know exactly what a command will do.

Second-AI review

Every proposed change is reviewed by a second model before it reaches you, and the verdict is shown alongside the command.

Type the machine's name

Domain controller promotion, certificate authorities, disk wipes, firewall shutdown and Default Domain Policy edits need the computer's name typed, even in auto-approve mode.

Undo where it exists, a warning where it does not

Reversible changes are recorded with their undo, and eLLA backs up files, Group Policy objects and registry keys before touching them, so ella undo is an exact restore. Some actions cannot be reversed; eLLA tells you so before you approve, never after.

Never sees your passwords

Passwords go into a hidden prompt and straight to the command. Neither the AI model nor the logs ever see them.

Fully audited

Every action, automatic or approved, goes to an append-only JSONL log plus syslog on Linux or the Windows Event Log.

Private and local-first

eLLA talks only to your own eLLM endpoint. No cloud service is required: run a local model, or route heavier work to a model you choose through eLLM.

You set the pace

--paranoid asks before everything; --yolo auto-approves but still logs every action and still stops for high-impact changes.

On both platforms

Diagnose, audit, plan and build, in one conversation

Health report and audits

One command for security, updates, logs, services, disk, performance, network and time, or focused audits such as /security, /updates, /disk and /net. Clear PASS, WARN and FAIL checklists with prioritised recommendations.

Log watcher

"Watch this service and tell me what happens." eLLA monitors in the background and gives you a full report when you stop it.

Plan-first provisioning

"Turn this server into …" becomes a numbered plan. Approve once, watch it execute with progress, verify each step, and get a written report.

Knowledge that grows

Bundled skills, scripts plus expert playbooks, load automatically when relevant. eLLA can save useful scripts and lessons as new skills, and skills can be shared between installations.

Reports, Git and GitLab

Markdown incident reports with findings, actions, undo references and verification. Git reads run automatically, writes need approval, and eLLA can raise GitLab issues.

Small model by default

Everyday tasks run on small local models such as qwen3-4b. An optional heavy tier, routed through eLLM, is used automatically for plans, policy building and change review.

Two native clients

Bash on Ubuntu. PowerShell on Windows.

eLLA runs the same commands an experienced administrator would, on each platform's own terms.

Linux

Ubuntu 22.04 and 24.04 LTS, desktop and server

Highlights

bash-native, with sudo only where needed
Throwaway test containers in Docker to reproduce an issue or trial a configuration before touching the host
Remote hosts over SSH: named inventory, key-based access setup, file transfer, approval-gated remote changes and per-host audit
Config drift baselines to spot unexpected changes

31 bundled skills

First responseLog triagesystemd servicesProcess triageKernel and bootHealth report StorageDisk, SMART, RAID/LVMBackup check Network and securityNetwork triageFirewall auditSecurity auditUser and access auditTLS expiry Web and appsnginx / ApachePHP-FPMMySQL / MariaDB / PostgreSQLPostfix / Exim OperationsPatching and EOLTime syncCron and timersConfig driftGit workflow ContainersDocker debuggingImage audit SpecialistMoodle debug, performance, upgrades, pluginsGL Server debug, cluster health, provisioning

Windows

Windows 10 and 11, Server 2019, 2022 and 2025 including Server Core

Highlights

PowerShell-native, with a safety classifier built on PowerShell's own parser
Automatic backups before change: Group Policy objects and registry keys captured first, so undo is exact
Works on modern terminals and the classic console, including Server Core
An MSI that can itself be deployed by Group Policy or Intune

What it checks

Event logs	Unexpected restarts, blue screens with stop codes, crashes and hangs, disk and NTFS errors, Group Policy failures, failed logons and lockouts
Windows Update	End-of-support status, last patch, pending reboot, WSUS and Update for Business, failures with error-code guidance
Services	Stopped automatic services, crash loops, start timeouts, service-account logon failures
Storage	Free space, disk health and wear, Storage Spaces, VSS writers, space hogs
Network	IP, DHCP, DNS, DC discovery, "trust relationship failed", proxy, firewall profiles, listening ports
Performance	CPU, top processes, memory and commit, paging, disk latency, handle leaks
Security	Defender, SMBv1 and signing, RDP/NLA, admins, UAC, LSA, Credential Guard, BitLocker, Secure Boot, LAPS
Time	Domain hierarchy, PDC emulator, offset against Kerberos limits

15 bundled skills

Event triageUpdate triageService triageDisk triageNetwork triagePerformance auditSecurity auditTime syncHealth reportAD healthAD users and groupsGPO builderGPO triageDNS serverDHCP server

Active Directory and Group Policy

Directory and policy work in plain English, for teams that are not Windows specialists

AD health (/ad): domain controllers and their support status, FSMO roles, replication, dcdiag, SYSVOL, DC DNS records, functional levels, Recycle Bin, krbtgt age, privileged groups and stale accounts.
Starters and leavers from a sentence: new users copying a colleague's groups, reversible leavers, password resets, unlocks, and finding why an account keeps locking.
Follows your conventions: learns your OU layout, username pattern and UPN suffix before creating anything, and asks when it is not sure.
Policy from a catalogue of 60+ vetted settings: removable storage, screen lock, banners, WSUS and update rings, Defender, firewall, RDP, BitLocker, LAPS, SMB/NTLM/LSA hardening, PowerShell logging, browsers, OneDrive, Office macros, power and time.
Respects the dangerous bits: never edits the Default Domain Policy without a typed confirmation, and steers password and lockout rules to Fine-Grained Password Policies.
GPO troubleshooting (/gpo), plus DNS (/dns) zones, scavenging and forwarders, and DHCP (/dhcp) authorisation, scope exhaustion and failover.

lock the screen after 10 minutes for all PCsComputer-scope GPO, linked to the right OU, backed up, verified with gpresult

block USB storage for SalesRemovable-storage policy scoped to the Sales OU, with the scope explained first

point PCs at our WSUS serverWindows Update settings from the vetted catalogue, reachability checked

why does Sam's account keep locking?Lockout source traced through DC event logs, then a proposed fix

Jo has left, sort out her accountDisable, move and remove groups, reversibly, with the undo recorded

At a glance

Linux and Windows, side by side

Capability	Linux	Windows
Conversational diagnosis and fixes	✓	✓
Approval gate and second-AI review	✓	✓
High-impact typed confirmation	—	✓
Transactional undo, with a warning when none exists	✓	✓
Automatic pre-change backups	files	files, GPOs, registry
Hidden password prompts, never seen by the AI	✓	✓
Audit log	JSONL + syslog	JSONL + Event Log
Health report and focused audits	✓	✓
Log watcher	journal + logs	Event Log + IIS logs
Plan-first provisioning	✓	✓
Bundled skills (save and share your own)	31	15
Local and heavy AI model tiers	✓	✓
Remote hosts	SSH	—
Test containers	Docker	—
Active Directory, Group Policy, DNS, DHCP	—	✓
Installer	.deb, offline	.msi, GPO / Intune

Platforms and requirements

Where eLLA runs today

Available · alpha

Ubuntu Linux

22.04 LTS and 24.04 LTS, desktop and server.

Self-contained .deb package, installs offline.

Preview

Windows desktop

Windows 11, and Windows 10 (supported, flagged as out of Microsoft support since October 2025).

.msi installer, deployable via Group Policy or Intune.

Preview

Windows Server

2019, 2022 and 2025, Desktop Experience and Server Core.

.msi installer.

Requirements: an eLLM endpoint (any OpenAI-compatible API with tool calling), with a recommended model context of 32K tokens. Linux: sudo rights. Windows: an elevated terminal for changes, built-in Windows PowerShell 5.1, and RSAT or role tools for Active Directory, Group Policy, DNS and DHCP features.

See eLLA on your own servers

We will connect eLLA to an eLLM endpoint and walk through a real diagnosis on a Linux or Windows machine of your choosing, or try the preview.

Book a demonstration About the eLLM platform