Skip to main content

CMDB user guide

Updated

Overview

CMDB (Configuration Management Database) is where you keep the authoritative record of everything your clients own and everything you need to know to support it. Assets, configurations, passwords, network subnets, knowledge-base articles, runbooks, software licenses, warranties, and attachments all live here.

Use CMDB when you want one place to answer "what do they have, who owns it, what is it connected to, what passwords are on it, and how do we fix it when it breaks."

CMDB is client-scoped. When you open CMDB you first land on the client picker (Pick a Client). Everything after that — config items, passwords, knowledge base, network, topology — is scoped to the client you selected, and the URL carries the client (/cmdb/c/<client>/…). Use Switch Client in the sidebar to change clients without losing your place. This keeps one client's data from ever bleeding into another's.

Key Features

  • Asset inventory — every physical and virtual asset with manufacturer, model, serial, IP, MAC, OS, location, assignment, purchase date, warranty, and custom fields.
  • Configuration items (CIs) — richer records for servers, applications, and services with relationships, criticality, environment, and business owner.
  • Flexible assets — define your own asset types (e.g. LOB apps, vendor accounts) with the fields you care about.
  • Password vault — AES-256-GCM-encrypted credentials with check-out, rotation, and per-password audit history.
  • Have-I-Been-Pwned checks — passwords are checked against the Pwned Passwords feed to flag breached ones.
  • Knowledge base — wiki articles, KB articles, and step-by-step runbooks searchable from any page.
  • Runbooks — numbered step lists you keep as documentation and link to the config items they apply to; authoring and execution live in RMM → Runbooks.
  • Network IPAM — subnets, VLANs, and address lists with a scan button to find what is live.
  • Discovery — auto-matched devices from RMM pushes and scheduled subnet scans.
  • Topology map — visual diagram of how CIs relate to each other.
  • Impact analysis — pick a CI and see the blast radius if it goes down.
  • Software licenses — seats, assignments, cost, renewal date, and expiration tracking.
  • Warranties — per-CI warranty tracking with expiration notifications.
  • Change requests — propose a change to a CI, review the diff, approve or reject.
  • Attachments — upload screenshots, diagrams, or invoices and link them to a CI, asset, or article.
  • Browser extension — one-click copy of a saved password into any login form.
  • Client portal — shared passwords, wiki pages, and warranty views for client-facing staff.
  • Full-text search — unified search across assets, configurations, wiki, and KB.
  • QR labels — printable QR codes you can stick on a device for fast lookup.
  • Audit log — every view, edit, delete, and check-out.

How To: Add a Config Item

  1. Open CMDB and pick a client (or use Switch Client if one is already selected).
  2. In the sidebar under Asset Management, open Config Items.
  3. Click New (top-right).
  4. Pick the CI type (workstation, server, network device, application, service, mobile, etc.).
  5. Fill in the name, manufacturer, model, serial number, IP/MAC, OS, and location.
  6. Set criticality, environment, and the business owner if you track them.
  7. Add purchase date, warranty expiry, and any custom fields you have defined.
  8. Save. The config item is now searchable within this client and can be linked to other CIs, passwords, documents, warranties, and licenses.

For asset types that don't fit the standard CI shape (line-of-business apps, vendor accounts, SSL certs), use Flexible Assets instead — you define the fields once and reuse the template.

How To: Save a Password

  1. With a client selected, open Password Vault under Security in the sidebar.
  2. Click New Password.
  3. Enter a title, category, username, password, URL, and optional notes.
  4. Link it to an asset, a CI, or a client so it shows up on those detail pages.
  5. Set a rotation policy in days if the credential should expire and be rotated.
  6. Save. The password is encrypted at rest; only users with the right role can view it.

How To: Check Out a Password

  1. Open the password entry.
  2. Click Check Out. Set the length of time you need it for.
  3. The entry becomes visible and is marked as checked out to you.
  4. When you are done, click Check In. The entry is locked again and the event is recorded in the audit log.

How To: Rotate a Password

  1. Open the password entry.
  2. Click Rotate. Either paste a new password or click Generate to create a strong one.
  3. The old value is replaced, the rotation date is stamped, and the next rotation date is scheduled based on the policy.
  4. If the password is linked to an asset, tell the asset owner or update the credential in the target system yourself.

How To: Inject a Password Into an RMM Session

  1. Start a remote terminal from RMM.
  2. Click Inject Credential.
  3. Pick the password from the list of credentials linked to this device or its client.
  4. Confirm. The agent types the username and password into the active window. The staged credential expires after sixty seconds.

How To: Write a KB Article

  1. With a client selected, open Knowledge Base under Documentation and click New.
  2. Enter a title, summary, and the full content.
  3. Pick a category and add tags so people can find it later.
  4. Optionally link it to the assets or CIs it applies to.
  5. Set visibility — Internal, MSP-wide, or Client Portal.
  6. Click Publish. The article becomes searchable and appears in the KB index.

How To: Document a Procedure (Runbooks)

Step-by-step operational runbooks are authored and executed in RMM → Runbooks (and surfaced from a device's detail page via the floating Runbook picker). In CMDB you capture the supporting reference material — a how-to as a Knowledge Base article, or a process write-up as a Document — and link it to the config items it applies to so technicians find it from the asset. Use the KB article flow above for narrative procedures; use RMM runbooks when you need numbered, executable steps tied to a device.

How To: Scan a Network

  1. With a client selected, open Network/IPAM under Network and open the subnet you want to scan.
  2. Click Scan Now. A TCP probe sweep runs against the range.
  3. When it finishes, the subnet shows how many addresses are live and what hostnames and MACs were found.
  4. Scheduled scans run every six hours; enable the schedule on the subnet detail page.

How To: Review Discovery Results

  1. With a client selected, open Discovery under Security.
  2. Anything RMM discovered or a network scan found appears in the Pending list.
  3. For each result, click Match to link it to an existing CI, or Create CI to make a new one.
  4. Configure Auto-Create if you want the system to add new CIs automatically.

How To: Link a Password, KB Article, or Warranty to a CI

  1. Open the CI.
  2. Scroll to the Related panel.
  3. Click Add Password / Add Article / Add Warranty and pick from the list.
  4. Save. The link is two-way — the password, article, or warranty shows the CI under its own Linked section.

How To: Analyze the Blast Radius of a CI

  1. Open the CI.
  2. Click Impact Analysis.
  3. The graph walks through the relationships table and shows everything that depends on the selected CI, directly or indirectly.
  4. Use it before making a change to see who else is affected.

Frequently Asked Questions

What is the difference between an Asset and a CI? An asset is a thing (a laptop, a switch, a monitor). A CI is something you actively manage as a service — a server, a database, an application — with relationships and owners. You can link an asset to a CI.

Can my client see passwords? Only passwords you explicitly share via the portal share mechanism. By default, passwords are visible to MSP staff only.

How are passwords protected? Passwords are encrypted at rest. Every reveal requires checkout and is recorded in the vault's audit trail.

Does the search index contain passwords? No. Passwords are deliberately excluded from the search index.

What happens when a warranty is about to expire? The system emails the recipients you configured in notification settings and flags the CI on the dashboard. You can also export warranty reports.

Can I import assets in bulk? Yes. Use Export to download a CSV template, fill it in, and use the bulk import feature. For Chromebook fleets the Google Workspace sync populates assets automatically.

Are changes to CIs logged? Yes. Every edit is captured in the audit log with the user, timestamp, and a diff of what changed.

Do pending passwords notify me when they are about to expire? Yes. The rotation due date triggers a reminder in the dashboard and, if enabled, an email.

Troubleshooting

I cannot see a password I created. Confirm your role. Viewers can see metadata but not decrypt passwords. Ask an admin to check the audit log — the entry will show whether your view attempt was blocked.

Password checkout says "already checked out." Another user has it checked out. Open the password and use the audit log to see who, then coordinate with them or ask an admin to force a check-in.

HIBP check shows a password as breached. Rotate it immediately. The breach flag means the password has been seen in a known public dump, not that your specific account was breached.

Discovery result will not match. If the existing CI does not show up in the match picker, confirm both records are in the same client. Rename or add an alias so the system can tie them together.

Browser extension will not log in. Refresh your extension token from Settings → Integrations → Browser Extension. Tokens expire after a set period.

Search is not returning a document I just saved. The search indexer runs every five minutes. New items show up on the next cycle.

Network scan found nothing. Confirm the subnet definition matches the actual network, and that the scan runs from a location that can reach the range. Scan runs write an error to the scan history if they time out.