Operating system updates
Manage Windows quality and feature updates, macOS updates, and package updates for supported Linux distributions. Approve by classification, defer specific KBs, and stage rollouts through pilot, early and broad rings.
Platform
Features that cover the full endpoint lifecycle
Detect a problem, connect to the device, fix it, patch the root cause, and prove it happened — without leaving the console or paying for four separate products.
1. Monitoring and alerting
Monitoring exists to shorten the distance between a problem starting and someone competent knowing about it. Ours is policy-driven, so you configure once and inherit everywhere.
What we watch out of the box
- CPU, memory, page file and per-volume disk space with rate-of-change alerts
- Physical disk health via SMART attributes and RAID controller status where exposed
- Windows services and Linux/macOS daemons, with auto-restart options
- Windows Event Log filters, including logon failures and unexpected shutdowns
- Scheduled task and cron job failures
- Installed agent health, patch agent state and endpoint protection status
- TLS certificate and domain expiry monitoring for the URLs you list
- SNMP v2c/v3 polling for firewalls, switches, printers, UPS units and NAS devices
- Public IP change, DNS resolution failures and site-level connectivity checks
How alerts stay useful
Alert fatigue is the reason most monitoring deployments quietly stop being read. ITSupport RMM addresses it structurally:
- Thresholds with duration. An alert only fires when a condition persists for a period you define, so a 3-second CPU spike does not page anyone.
- Correlation and de-duplication. When a host goes offline, its child checks are suppressed instead of generating twenty separate notifications.
- Maintenance windows. Per-client and per-site schedules mute expected noise during patch nights.
- Escalation chains. Route by severity, tenant and time of day, then escalate if nobody acknowledges within the interval you set.
- Automatic remediation first. Many alerts can trigger a script and only reach a human if the fix fails.
2. Remote access and support tooling
Remote sessions are where technician time is actually spent, so the tooling has to be fast and predictable rather than impressive in a demo.
- Unattended access to servers and always-on workstations, with per-tenant policy controlling who may connect.
- Attended sessions with an end-user consent prompt, session recording options and a visible connection indicator.
- Background tools that fix problems without disturbing the user: remote terminal, service and process control, registry editor, event log viewer, task manager and file browser.
- File transfer in both directions with transfer logging.
- Multi-monitor support, clipboard sync, session notes and quick-connect from any alert or asset record.
- Session audit that records who connected, from which console account, for how long, and which commands were run.
End users can be given a branded support portal link that starts an attended session in one click, which is often the single largest reduction in help-desk handling time for internal IT teams.
3. Patch management
Unpatched software remains one of the most common paths into a business network. Patching therefore needs to be measurable, not aspirational.
Third-party applications
Keep common business software current — browsers, runtimes, PDF tools, communication clients, compression and media utilities, and developer runtimes. Available on Professional and Enterprise plans.
Reboot and window control
Choose forced, prompted or deferred reboots per policy, with user-facing notifications and snooze limits. Maintenance windows respect each client's business hours and time zone.
Compliance evidence
Patch compliance reports show installed versus missing updates per device, per client and per severity, with historical trend data you can attach to a monthly service review or an audit response.
Failure handling
Failed installs are retried under policy, then flagged with error codes and remediation notes so a technician can act on a short list rather than scanning thousands of devices.
Exception management
Pin a version, exclude a machine group that runs legacy line-of-business software, and document the business justification inside the platform so the exception is visible at review time.
4. Automation and scripting
Automation is how a small team manages a large fleet. ITSupport RMM treats scripts as first-class, version-controlled platform objects rather than pasted text.
- Languages: PowerShell, Windows Batch, Bash, Zsh and Python (where a runtime is present).
- Triggers: manual run, schedule, alert response, agent check-in, or API call.
- Script library with categories, parameters, expected exit codes and a change history showing who edited what.
- Approval workflow so a reviewer must sign off before a script becomes runnable at organization scope.
- Targeting by tenant, site, dynamic group, operating system, installed software or custom asset field.
- Output capture with stdout, stderr, exit code and duration retained per run for audit.
Self-healing examples our customers automate first
- Restart a stopped print spooler or SQL service, then verify it stayed up for ten minutes
- Clear temporary files and Windows Update cache when free space drops below a threshold
- Re-register an endpoint protection agent that stopped reporting
- Rotate local administrator passwords on a schedule and store the result in the credential vault
- Collect diagnostic bundles automatically before a technician even opens the ticket
5. Inventory, reporting and network visibility
Asset and software inventory
Every agent reports hardware specifications, serial numbers, manufacturer warranty data where available, BIOS and firmware versions, disks, network adapters, logged-on users and installed software with versions. Custom fields let you record what your business cares about: purchase date, cost center, assigned user, physical location, or client contract reference.
Dynamic groups keep themselves current. "All Windows 11 laptops older than four years with less than 15% free disk space" is a group definition, not a spreadsheet exercise.
Network discovery
A designated agent can scan its local subnets to surface unmanaged devices, so the printer nobody documented and the switch installed by a contractor both become visible. Discovered devices can be monitored by SNMP or flagged for agent deployment.
Reporting your clients and executives will read
- Executive summary: device health, patch compliance, incidents opened and closed, top recurring issues
- Patch compliance by client, site, severity and device
- Asset lifecycle and refresh planning, including warranty expiry
- SLA performance against the response targets in your service agreement
- Technician activity and remote session logs
- Alert volume trends, useful for proving that automation reduced ticket load
Reports can be generated on demand, scheduled by email as PDF or CSV, branded per client on Professional and Enterprise plans, and pulled programmatically through the REST API if you maintain your own reporting stack.
6. Administration, tenancy and platform support
Multi-tenant structure
Organization → client → site → device group. Policies, scripts and alert rules inherit downward with per-level overrides, and technician access is scoped so one client's data is never visible from another's context.
Access control
Predefined roles for administrator, senior technician, technician, help desk and read-only auditor, plus custom roles. Multi-factor authentication is mandatory for all console users. SSO/SAML is available on Enterprise.
Credential handling
Store per-tenant credentials in an encrypted vault, inject them into scripts and sessions without exposing plaintext to technicians, and log every retrieval.
Supported platforms
Windows 10 and 11, Windows Server 2016 through 2025, macOS 12 Monterey and later on Intel and Apple silicon, and Linux including Ubuntu LTS, Debian, RHEL, Rocky and AlmaLinux. Agent footprint is designed to stay modest on idle machines.
Network requirements
Agents communicate outbound over TCP 443 using TLS. No inbound ports, no VPN dependency, and no requirement to expose the endpoint to the internet. Proxy configurations are supported.
Agent transparency
The agent is signed, listed in installed programs, and removable through a documented uninstall command or from the console. We publish what it collects and why in the Privacy Policy.
Want to see a specific feature in your environment?
Tell us what you are trying to fix — patch compliance reporting, alert noise, migration from a legacy RMM — and we will demo that, not a generic slide deck.
+1 717 823 6666 · Info@itsupport-rmm.com