Skip to main content

Device isolation

Updated

Where to find it: in the Hub (your MSP workspace at app.theonestack.com), open RMM, then use the RMM sidebar or page links below:

Overview

Device isolation cuts a managed device off from the network while keeping the RMM agent running. Technicians and the Defend security product use isolation to contain a suspected compromised device so it cannot spread malware or exfiltrate data while an investigation is underway.

What Isolation Does

When a device is isolated:

  • The agent instructs the operating system to block all inbound and outbound network traffic except the RMM management channel.
  • The device remains reachable via Remote Terminal so you can investigate and remediate without physically touching the machine.
  • No other network connections — to file shares, the internet, other devices on the LAN — are permitted during isolation.

Isolation takes effect on the device's next heartbeat after the command is dispatched. This is typically within seconds if the device is online.

Isolating a Device Manually

  1. Open the device from the Devices list.
  2. Click Isolate Device (found in the device actions menu or the security actions panel).
  3. Confirm the action. The device status updates to show it is isolated.

You can also isolate a device from inside a War Room incident using the Isolate All action, which isolates every device linked to that incident at once.

Investigating an Isolated Device

While isolated, the device is still reachable through Remote Terminal. You can:

  • Run scripts to collect forensic data.
  • Review running processes and active connections.
  • Remove malicious files or software.

If the Defend product triggered the isolation, a forensics snapshot may have been collected automatically before isolation completed.

Releasing a Device from Isolation

Only release a device after you are confident the threat has been remediated.

  1. Open the isolated device.
  2. Click Release from Isolation.
  3. Add a note explaining why the isolation ended and what was done. This note is attached to the device timeline.
  4. Confirm. Normal network traffic resumes on the device's next heartbeat.

Frequently Asked Questions

The device was isolated by Defend, not by me. How do I release it?

The release process is the same regardless of how isolation was triggered. Open the device, click Release from Isolation, add a note, and confirm.

Will isolation affect other devices on the same network?

No. Isolation only affects the specific device that is isolated. Other devices on the same subnet continue to operate normally.

Can I still run a remote terminal session on an isolated device?

Yes. The RMM management channel is preserved during isolation. Remote Terminal remains available so you can investigate and remediate.

How quickly does isolation take effect?

The isolation command is queued immediately. The device applies it on its next heartbeat, which is typically within seconds for an online device.

What if the device goes offline before picking up the isolation command?

The command stays queued. Isolation applies the next time the device comes online and heartbeats.

Related