Skip to main content

RMM user guide

Updated

Overview

RMM (Remote Monitoring and Management) is the platform you use to keep every client device healthy, patched, and under control. It inventories every workstation, laptop, and server your agent is installed on, streams live performance metrics, delivers remote commands, schedules patching and automation, and gives technicians a browser-based remote terminal for hands-on fixes.

RMM is the tool to reach for when you need to see what a device is doing right now, push a change to many devices at once, or investigate why something went wrong.

Key Features

  • Device inventory — every enrolled device with its hardware, OS, installed software, current user, location, and live-seen timestamp.
  • Agent heartbeat telemetry — CPU, RAM, disk, network, battery, uptime, and running processes refreshed on a short interval.
  • Patch management — pending, approved, and deployed patches per device, with approval workflows and post-deployment review notes.
  • Scripting and automation — run PowerShell, Bash, or library scripts on one device, a group, or the whole fleet. Scheduled, threshold-triggered, and event-triggered automations.
  • Remote terminal — browser-based shell to any enrolled device with credential injection from the CMDB password vault.
  • Remote sessions — full remote-control sessions with recording.
  • Alerting — built-in thresholds, custom alert rules, templates, and a maintenance-window suppressor.
  • Incidents — incident cards appear on Alert Triage, where you can open, acknowledge, and resolve them. RMM has no alert-correlation engine: alerts are never grouped automatically into an incident, and a card is not a machine-derived root cause — it reflects an incident record that was raised manually. Major-incident command (the War Room) is the PSA product's surface, at /psa/war-room.
  • Software deployment — push approved software packages to selected devices.
  • Vulnerability management — detected CVEs per device with triage and remediation tracking.
  • Bandwidth monitoring — per-device, per-site, and fleet-wide bandwidth with alert rules.
  • Hardware lifecycle — purchase date, warranty, age, and disposition candidates.
  • Discovery — network sweeps that find unmanaged devices on a client network.
  • Bulk onboarding — import many clients and devices at once.
  • Executive reports — client-ready summaries of device health, patching, and risk.
  • Chromebook / K-12 education management is not RMM's — districts, schools, students, Chromebook assignments, damage logs, repairs, RMAs, and shipping are managed in CMDB (staff surface: CMDB → Education, /cmdb/edu). The school-facing surface where school staff request repairs and report damage is the Hub client portal (Chromebooks, /portal/chromebooks), which is backed by CMDB; the client-portal knowledge base carries the school-facing guide.
  • Natural-language search — ask for devices in plain English (e.g. "Windows 11 laptops with less than 20% disk free").

How To: Enroll a Device

Agents for RMM, Defend, CMDB, and Backups are all installed from one place: Endpoints → Install. RMM doesn't have its own "Add Device" button; the Onboarding wizard and Install Agent buttons on device lists take you there. Which products the agent turns on comes from your organization's license.

  1. Open Endpoints → Install.
  2. Click Generate Installer Token and pick the customer the device belongs to.
  3. Optional: set Max uses and Expires. Left blank, the token works for 25 installs or 30 days, whichever comes first.
  4. Click Generate Token. Copy the token from the Installer ready dialog; it's shown only once.
  5. Choose the operating system and copy the install command, or download the package (.msi, .pkg, .deb, or .rpm).
  6. Run the command on the device as an administrator.
  7. The device appears in RMM → Devices with a green Online badge within about a minute.

To stop a token from adding more devices, click Revoke next to it under Active Tokens on the same page. Generate a new token whenever you need one.

For silent installs from Intune, Group Policy, an MDM, or scripts, pass the token as THEONE_TOKEN (for example, msiexec /i TheOneAgent.msi /qn THEONE_TOKEN=<token> on Windows). See Install the RMM agent on a device for Linux commands. On macOS (agent 1.1.118 or later), don't use THEONE_TOKEN. Write the token to /var/root/theoneagent-enrollment.token before you run the installer; the agent enrolls with no setup window and deletes the file. That article has the macOS command too.

How To: Run a Script on a Device

  1. Open the device you want to run the script against.
  2. Click Run Script.
  3. Pick a script from your library, or paste an ad-hoc script.
  4. Review the parameters the script asks for and fill them in.
  5. Click Run. The command is queued; you will see it change from Pending to Dispatched to Complete as the agent picks it up and reports back.
  6. Click the run to see stdout, stderr, exit code, and duration.

To run the same script on many devices, go to Scripts, select the script, click Run, and choose Target Multiple Devices. You can pick by client, tag, operating system, or a saved smart group.

How To: Open a Remote Terminal

  1. Open the device.
  2. Click Remote Terminal.
  3. A browser-based shell opens and connects through a relay session. The agent starts a shell on the device and pipes it to your browser.
  4. To paste in a saved credential without it ever touching your clipboard, click Inject Credential, pick the entry from CMDB, and confirm. The agent types the username and password into the active window; the staged credential expires after sixty seconds.
  5. Close the tab to end the session. Sessions that sit idle for five minutes are closed automatically.

How To: Approve and Deploy a Patch

  1. Go to Patches.
  2. Filter by client, severity, or device.
  3. Review the pending list. Click a patch to see the devices it applies to and the vendor notes.
  4. Click Approve. The patch moves to the approved queue.
  5. Click Deploy and pick the rollout window (now, next maintenance window, or a specific time).
  6. Deployment status updates live. When it completes, click Add Post-mortem to record what happened.

How To: Create a Maintenance Window

  1. Go to Maintenance.
  2. Click New Window.
  3. Pick the devices or client.
  4. Set the start and end times and the recurrence if you want a weekly or monthly window.
  5. Choose whether to suppress alerts, pause automation, or both.
  6. Save. During the window, matching alerts are suppressed and shown in the suppression rollup on the alerts page.

How To: Build an Automation

  1. Go to Automation.
  2. Click New Automation.
  3. Give it a name and pick a trigger:
    • Schedule (e.g. every day at 2 AM).
    • Threshold (e.g. disk free below 10 percent).
    • Event (e.g. device offline, patch failed).
  4. Pick the devices the automation applies to.
  5. Add actions: run a script, send a notification, create an alert, or raise a PSA ticket.
  6. Save. Use Run Now to test it once before enabling.
  7. Toggle Enabled when you are ready.

How To: Restore Control of an Isolated Device

If an incident isolated a device (either manually or from Defend):

  1. Open the device.
  2. Click Release from Isolation. The agent allows normal network traffic again on the next heartbeat.
  3. Add a note explaining why the isolation ended.

Frequently Asked Questions

How often does the agent check in? The agent heartbeats on a short interval. Devices are considered offline if no heartbeat lands for five minutes.

What happens when a device goes offline? After five minutes without a heartbeat the device flips to Offline, an Agent Offline alert fires, and any automations you configured for the offline event run.

Can I see what a device looked like last week? Yes. Open the device, click Metrics, and select a time range. Detailed per-minute data is kept for fourteen days, fifteen-minute rollups for ninety days, and hourly rollups for a year.

Does the agent update itself? Not today. Automatic (over-the-air) agent updates aren't available yet; The One Stack staff roll out agent updates. If a device shows an update-available banner, it means a newer version exists, not that the device has installed it.

To update a device now, re-run the install command from Endpoints → Install on it. It upgrades the agent in place. If your earlier token has expired or been revoked, generate a new one first.

What is the difference between a script and an automation? A script is the code that runs on the device. An automation is the rule that decides when to run it, on which devices, and what to do with the result.

Can I run a script on devices that are offline? Yes. The command is queued and delivered the next time each device heartbeats. You will see it sit in Pending until the device comes online.

How do I stop alerts during a known outage? Create a maintenance window covering the affected devices and the outage time. Matching alerts will be suppressed and recorded on the suppression rollup.

How do I give my client visibility? Use the client portal views and the executive report. You can schedule the report to be emailed monthly.

Troubleshooting

Device stays Offline after install. Confirm the installer finished without error. Check that the device can reach the agent URL on port 443. Restart the RMM agent service. If the device was cloned from another, the hardware fingerprint may collide — delete the old record and let the new one enroll fresh.

Script runs but returns no output. Open the run detail. If stdout is empty but exit code is 0, the script ran but wrote nothing. If the run sits in Pending for more than a few minutes, the device is likely offline.

Remote terminal disconnects after a few seconds. Usually a network interruption on your side. Close the tab and reopen it. If it keeps happening to a single device, check the device for high CPU or agent-health errors on the device detail page.

Credential injection did not type the password. The staged credential expires after sixty seconds. Open the session and click Inject again. If it still fails, confirm the password in CMDB has both a username and password saved.

Heartbeat batch is being rate-limited. The heartbeat endpoint caps at a high rate per device. If you see rate-limit warnings in agent logs, check for an agent stuck in a reconnect loop; restart the agent service.

Too many alerts from a single noisy rule. Go to Alert Tuning. The system highlights rules producing high volumes and offers a suppression or threshold suggestion. Apply it or edit the rule directly.

A patch approval will not deploy. Confirm the target devices are Online and the maintenance window has not blocked execution. Check the patch detail for vendor-side errors. Retry the deploy after any prerequisite patches finish.

Automation is not firing on a threshold. Open the automation, click Dry Run, and review the evaluator output. Threshold automations evaluate every five minutes — allow one cycle before assuming it is broken.