# Control when a System Insights capability runs

> How should capability enablement and prediction scheduling be changed in System Insights?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260908-033-control-when-a-system-insights-capability-runs/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-08T18:16:38+00:00
- Modified: 2026-09-08T18:17:14+00:00
- Last reviewed by DSE: 2026-09-08
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 1 minutes

## What you need to know

How should capability enablement and prediction scheduling be changed in System Insights?

## Potentially affected

Use this review when configuring an existing System Insights capability.

## DSE recommendation

Have the server owner choose the desired run window and explain any decision to disable the capability.

## Article

## Source facts

Disabling a System Insights capability prevents invocation; for nondefault capabilities it also stops their data collection. Invoking a capability runs it immediately, and Microsoft suggests scheduling predictions outside business hours to avoid conflict with critical operations. The documented PowerShell interface supports a separate custom schedule for each capability. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/manage/system-insights/managing-capabilities).

## Applicability

Use this review when configuring an existing System Insights capability. Identify whether it is a default or added capability, its present state, its schedule, and the business operation that should not be disturbed.

## DSE recommendation

Have the server owner choose the desired run window and explain any decision to disable the capability. Record the difference between an immediate test run and an ongoing schedule change. Consider the data-collection consequence for a nondefault capability before disabling it. Preserve the original state and schedule so the agreed configuration can be restored if needed.

## Verification

Inspect the capability state and schedule after the approved change. Observe a scheduled execution at the intended time and record its completion result. Check that an immediate invocation was not mistaken for proof of the recurring schedule. Retain the configuration with the owner’s review date and investigate unexpected runs before changing additional capabilities.

## Official references

[Microsoft Learn: Manage System Insights capabilities in Windows Admin Center](https://learn.microsoft.com/en-us/windows-server/manage/system-insights/managing-capabilities). Source reviewed September 8, 2026.

## Primary reference

- Name: Manage System Insights capabilities in Windows Admin Center
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/windows-server/manage/system-insights/managing-capabilities
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Control when a System Insights capability runs,” DSE Security, https://update.dsesecurity.com/updates/dse-20260908-033-control-when-a-system-insights-capability-runs/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.