What is RMM?
An RMM platform pairs a central console, usually cloud hosted, with a small agent installed on every managed workstation and server. The agent reports health data and carries out tasks sent from the console. Managed service providers (MSPs) rely on RMM to support many client companies from one place, and internal IT departments use the same kind of tool for their own fleets.
What RMM tools do
- Monitoring and alerting: low disk space, high CPU use, a stopped service, a failed backup, outdated antivirus definitions or a device that went offline creates an alert or a ticket.
- Patch management: approve, schedule and report on Windows and third-party application updates across all devices.
- Scripting and automation: run PowerShell, batch or shell scripts on one device or thousands, for tasks such as remapping drives, installing applications, clearing temp files or restarting machines after hours.
- Remote access: remote control or screen sharing, a background command shell, file transfer and remote reboot, often without interrupting the user.
- Inventory: hardware and software details collected by each agent, which can feed asset records or a CMDB.
- Software deployment: push installers and configuration to groups of devices.
How it works
The agent runs as a service with administrative (SYSTEM or root) privileges so it can install software and change settings. It typically makes an outbound connection to the RMM server and checks in on a schedule, so managed devices don't need inbound firewall ports opened. Technicians sign in to the console, see every device grouped by client or site, and act on one device or many at once.
Security risks
An RMM is powerful by design, which makes it a high-value target: whoever controls the console or a technician's account can push code to every managed machine. In July 2021, attackers exploited vulnerabilities in Kaseya VSA, an RMM product used by MSPs, and used it to deliver ransomware to those MSPs' customers, hitting many businesses at once. Attackers also install legitimate RMM and remote access tools on victims' computers because the traffic looks like normal IT activity. Common protections:
- Multifactor authentication and least privilege for console accounts
- Keeping the RMM server and agents patched
- Audit logs and alerts for new scripts, new administrators or unexpected deployments
- Allowing only the company's approved remote tools and blocking the rest
RMM vs. similar tools
- RDP, VNC and SSH: one-to-one remote connection protocols. RMM manages many devices and includes remote access as one feature.
- MDM: enrolls phones, tablets and laptops and enforces policy on them (passcodes, apps, remote wipe). RMM centers on monitoring and maintaining workstations and servers, though some products do both.
- EDR: detects and responds to threats on endpoints. An RMM may report security status, but it is an operations tool, not a detection tool.
RMM on the CompTIA A+ exam
RMM appears in Core 2's remote access technologies, alongside RDP, VPN, VNC and SSH, with attention to the security considerations of each method. Cues:
- An MSP needs to monitor, patch and run scripts across many client PCs: RMM.
- A technician only needs to see one user's screen for a few minutes: a remote desktop or screen-sharing tool may be enough.
- The main RMM risk: compromise of the platform gives an attacker administrative access to every managed device.