25 · Admin · RMM config

Admin pages for the RMM module — building agent installers, maintaining metric thresholds, and configuring synthetic monitors and license monitors.

Agent installers

/admin/rmm/installers

An installer is an OS-agnostic token. From a single installer you get one install command per OS; running a command downloads the plain-text agent runtime, wires it up as a scheduled task / systemd timer / launchd job, and registers the device.

The page has three blocks:

• Base installer — an always-available, permanent installer. Anything that runs it lands in the Unassigned group; re-assign the device's customer afterwards from the device page.
• Uninstall the agent — token-less uninstall commands per OS, for a clean re-install when the agent can't be reached from its device page.
• Customer-scoped installers — the table of installers you have created.

+--------------------------------------------------------+
| Agent installers                       [+ New installer]|
|--------------------------------------------------------|
| Label             Customer    Site     Bundled  State  |
|--------------------------------------------------------|
| Acme HQ laptops   Acme Ltd    London   RustDesk  Active|
| Internal Linux    KW Group    —        —         Active|
| Beta macOS        Beta Co     —        Remote..  Used  |
+--------------------------------------------------------+

📷 Screenshot placeholder: screenshots/admin-installers.png

Creating an installer

1. + New installer.
2. Label — internal name, operators only.
3. Customer — a CRM company, or leave unassigned.
4. Site / area — free text, groups devices on the dashboard.
5. Options:
   • Bundle Remote Support runtime — also installs the quick-support runtime alongside the agent.
   • Install RustDesk — installs RustDesk for unattended access, sets a permanent password, and reports the RustDesk ID + password back to the device page.
   • One-shot — the installer can register only one device, then it's consumed.
6. Expires (optional) — after expiry the install link returns 410 Gone.
7. Create. The new installer's row expands so you can copy the per-OS install command.

The installer is not a signed binary. The download command pipes a script straight into the OS interpreter (iwr | iex on Windows, curl | sudo bash on Linux/macOS). The same installer token serves all three OSes.

Per-OS install behaviour

• Windows — run iwr -UseBasicParsing <url>/windows | iex from an elevated PowerShell. The agent runtime (agent.ps1) is written to %ProgramData%\KWGroup\Agent and registered as a Scheduled Task that runs every minute as SYSTEM. Re-running upgrades in place.
• Linux — run curl -fsSL <url>/linux | sudo bash. The runtime (agent.sh) is written to /opt/kwg-agent, registered as a systemd service + timer (every minute), with a cron fallback if systemd is absent.
• macOS — run curl -fsSL <url>/macos | sudo bash. The runtime is written to /usr/local/kwg-agent and registered as a launchd daemon with a 60s StartInterval.

Revoking & deleting

• Revoke marks the installer revoked — its install command can no longer register new devices. Devices already registered keep working.
• Delete removes the installer record entirely.

There is no "Rebuild" — the install command is generated on download, so a customer/site change applies to the next device that registers.

Metric thresholds

/admin/rmm/thresholds

A single per-org threshold set drives RMM alerts. For CPU, memory and disk you set a warn and a danger percentage; the set can be enabled/disabled as a whole. Defaults are CPU 80/95, memory 85/95, disk 85/95. When an agent metric push crosses a threshold an alert is raised, and it auto-resolves when the metric drops back.

Per-customer and per-device threshold overrides are planned but not yet exposed — the org default applies to every device.

Synthetic monitors

/admin/rmm/monitors

HTTP / Ping / SSL probes, run on a schedule by the monitor worker. Each monitor has a target, interval, timeout, an alert-after-failures count, and (for HTTP) expected status / body, (for SSL) a days-to-expiry warn window. Monitors raise and resolve RMM alerts and can be tied to a customer and/or device.

License monitors

/admin/rmm/licenses

Track third-party software licences / renewals tied to a customer or device.

Permissions

The RMM service requires an authenticated session for every endpoint but does not gate installer or threshold actions by role within the service. The admin RMM pages sit under /admin and follow the portal's admin-area access control.

Common workflows

Roll out to a new customer

1. Installers → + New installer. Customer = Acme. Site = London HQ.
2. Create → copy the Windows / Linux / macOS install command.
3. Send the relevant command to Acme's IT lead.
4. As devices run it they appear under RMM, scoped to Acme / London HQ.

Bundle unattended access

1. Installers → + New installer, tick Install RustDesk.
2. Run the install command on the target machine.
3. The agent reports the RustDesk ID + password to the device page, where they can be revealed, copied or rotated.

Tune alert sensitivity

1. Admin → RMM → Metric thresholds.
2. Adjust the warn / danger percentages for CPU, memory or disk.
3. Save — the new thresholds apply to every device's next metric push.

See also

• RMM — operator side
• Quick-support & remote