This is the full inventory, not a highlights reel. Every capability listed below is built and running in the platform today, across fourteen areas — from raw telemetry collection to AI-assisted operations. Where something is Windows-first, opt-in, or still maturing, it says so.
A lightweight agent reports on an interval. Everything below is read-only collection — nothing here changes state on the endpoint.
Utilisation captured as a time series and rolled up by a background aggregation job, so both the last five minutes and the last six months stay queryable. Drives can be excluded per device.
Bytes in and out per second per interface, stored alongside the other metrics so a bandwidth spike lines up on the same timeline as the CPU spike that caused it.
Top processes ranked by CPU and by memory, captured on a schedule and stored compressed. When a machine was slow at 3am, you can go back and see what was actually running.
Running and stopped status for every service, with a watched-services list per device. If a service you care about stops, that becomes an alert rather than something you find out about on Monday.
Who is logged in right now, on which session, and how long they have been idle. Useful before you reboot something at 4pm.
Connect and disconnect events read from the Windows Terminal Services event log, including decoded disconnect reason codes, so "it dropped" becomes a specific cause.
A 15-second TCP probe against the services you nominate, run from the server rather than from the endpoint, so you learn about an outage from the outside in — the same way a customer would.
How devices get in, how they are organised once they are in, and the operator-facing bookkeeping that sits alongside the automated data.
Devices join with an enrollment token that carries a maximum use count and an expiry date. Tokens are hashed at rest, so a database copy does not hand someone a working key.
Group devices by hand, or define a filter and let membership maintain itself. New machines that match a dynamic group's criteria join it automatically.
Parent/child relationships between hypervisor hosts and the guests running on them, so when a host goes dark you immediately see the twelve machines that went with it.
Every device belongs to a client organisation, which is what makes per-customer views, per-customer filtering, and per-customer reports work throughout the platform.
Display name, excluded drives, backup source toggles, login monitoring, security audit participation, and integration IDs are all set per machine. Noisy checks get turned off on the one device where they are noise, not everywhere.
A running record against each machine with open, investigating, and resolved states. The context that normally lives in someone's head or a ticket system stays attached to the device itself.
Reaching into a managed machine without RDP, SSH, or a separate remote-access product. Every action here is permission-gated and audit-logged.
A real PTY on the agent, rendered in the browser. Not a command-runner that returns text after the fact — an interactive shell, with everything that implies for tools that prompt or redraw.
Close the browser, lose your Wi-Fi, or move to another machine — the session keeps running. Reconnect by session ID and the last 500 lines of scrollback replay so you can see what happened while you were gone.
Two live sessions side by side. Watch a log tail on one machine while you run the fix on another, without juggling browser tabs.
A categorised sidebar of pre-written admin tasks — system info, disk usage, network checks, services, processes, security actions. Mark the ones you use as favourites. Common work becomes one click instead of one remembered cmdlet.
Enumerate drives, list directories, read and write files, create folders, and delete — from the console. Grabbing one config file off a server no longer requires a full remote-desktop session.
TSplus and RustDesk identifiers are stored per device, with a launcher and session view for TSplus, so existing remote-access investments stay reachable from the same console.
Built directly on the Windows Update COM API rather than scraping a UI. Deployment is always explicit — nothing reboots behind your back.
Every outstanding update with its KB number, severity, category, download size, and whether it will force a reboot. You know the cost of the maintenance window before you schedule it.
The last 200 installed updates per device with outcome. When something broke on Tuesday, you can see exactly what landed on Monday night.
Push a specific update by GUID, or bulk-install everything rated critical, with a per-update result recorded so a partial failure is visible rather than silently averaged into a green tick.
Detected two ways — through the COM API and by checking the registry sentinels Windows sets — because either one alone misses cases. Machines quietly waiting on a restart stop hiding.
Patch state is not a standalone page. It feeds the security score and the cyber-insurance readiness report directly, so patching effort shows up where the auditor actually looks.
Six sources, one status model. The distinction that matters here is between "the job reported success" and "the backup is actually restorable" — the platform tracks both separately.
| Source | How it is read | Scope |
|---|---|---|
| Arq Backup | Local JSON state files on the endpoint | Per device, auto-detected |
| Veeam B&R | PowerShell Get-VBRJob | Per device, opt-in |
| Microsoft SQL Server | sqlcmd against msdb.dbo.backupset | Per device, opt-out |
| SQLBak | SQLBak REST API | Per tenant |
| Wasabi S3 | AWS S3 SDK | Per tenant |
| Google Drive | Google Drive API v3, service account | Per tenant |
Every source normalises to the same five states — ok, stale, error, unknown, inactive — against a configurable staleness threshold that defaults to 25 hours. One console, one vocabulary, six backup products.
A scheduled sweep that goes past "did the job run." It checks that files are the size they should be, that the schedule was actually kept, and that the archive opens — because a silent shrinkage is the failure mode that ruins a restore.
Google Drive monitoring adds size-anomaly detection, retention-gap analysis, and ZIP integrity sampling — so a backup set that has been quietly getting smaller every week is caught while it still matters.
Microsoft SQL Server is read from SQL's own backup history in msdb, not from a vendor agent. Whatever tool is taking those backups, the monitoring works — no add-on to buy, nothing to install alongside it.
Retained job history per source, so you can answer "when did this last succeed" and "how long has this been broken" rather than only seeing the current state.
A documented restore rehearsal process ships with the platform, including a verification script that produces a pass/warn/fail report against a restored data set. An unverified backup is treated as no backup.
The recurring theme here is verification over assumption. A control that is configured is not the same as a control that works, and the platform is built to tell those apart.
Windows Security events 4625, 4771 and 4776 are collected and correlated, with brute-force alerting when a pattern emerges and a digest job so a sustained attack does not turn into a thousand separate emails.
A PowerShell sweep across password policy, account hygiene, endpoint hardening, and MFA status. It produces findings, not just settings dumps — each one with a description of what is wrong and why it matters.
A composite across four weighted categories — password policy, account hygiene, endpoint security, and patching. One number to trend over time, with the underlying findings one click away so the number is never a black box.
A read-only diagnostic you can run against one device or every online Windows machine. It tests the firewall profile actually in effect, the network category assigned to each adapter, whether RDP has drifted to a port your whitelist does not cover, and which sensitive services are exposed by a rule open to any source.
Four questions kept deliberately separate: what is listening locally, what the firewall allows, what is verified reachable from outside by a probe run from the server, and what is protected by an IP whitelist. The agent cannot confirm external reachability from inside the LAN, so the server does it.
Block a port from the internet, restrict it to a whitelist, or remove the rules again — applied as real Windows Firewall rules in a dedicated group with deterministic names, so undo finds exactly what was created. Private LAN ranges are preserved.
Push CIDR restrictions to a machine's RDP rules and the change reverts itself if it is not confirmed. Locking yourself out of a remote server is a real risk, and the design assumes it will happen eventually.
Dropped-packet events from the Windows Firewall are collected, and login events are geolocated. A failed login from an unexpected country reads very differently from one at the office, and the console shows the difference.
An inventory is a list. These features turn that list into decisions — what is trusted, what is new, what is exposed, and how you rebuild it all if a machine dies.
Read from the three Windows uninstall registry hives — the same source Programs & Features uses — deliberately avoiding Win32_Product, which triggers a slow and destructive MSI reconfiguration on every machine it touches.
Search by application or publisher across every managed device. When the next Log4j-shaped advisory lands, "which machines run this" is a search box, not a two-day project.
Endpoint inventory rolls up into one application catalog with signature state, signer identity, and SHA-256 hash — because a familiar product name is not proof that a binary is trustworthy. Filter to what is new, unsigned, unreviewed, high-risk, or denied by policy, then approve or deny.
Enabling App Review does not generate an alert storm for the software you already knew about. The first sweep establishes a baseline silently, so "new" genuinely means new from that point forward.
Turns a device's last-known inventory into a reinstall package — a winget import manifest, a PowerShell wrapper, and an explicit gap list of what winget cannot cover. Generated server-side, so it works even when the source machine is offline or destroyed.
Two separate things live here: using AI to do operations work, and governing the AI software that has already arrived in the estate whether IT approved it or not.
Launch Claude Code sessions inside the web terminal on any managed machine, attributed to a project. Development and operations work happens where the code and the data already are, from a browser.
Cost and token figures are extracted automatically from terminal output, then broken down per project, per device, and per day, filterable by date range. AI spend stops being a surprise line on a bill.
Open alerts are grouped into incidents with a severity, a plain-language summary, a proposed fix, and a recommended action. Forty related alerts become one incident with a starting point instead of forty things to read.
Discovers which AI applications are installed across the fleet, which are sanctioned, and where the risky ones sit — without ever collecting what anyone typed into them. The privacy boundary is enforced at the collector, the ingest endpoint, and the schema, not just in policy.
A curated library of reusable prompts for the team, plus governed retention on collected prompt data with length caps, a 90-day retention window, and an explicit purge action.
The AI provider and API key are configured per tenant through the UI, and AI features sit behind a per-tenant feature flag. Tenants that do not want AI in the loop simply do not have it.
The layer for laptops and mobile endpoints — what kind of machine it is, where it is, what you can do about it right now, and whether it has left where it is meant to be.
Desktop, laptop, tablet, phone, server or VM, resolved from chassis codes, OS edition, hypervisor signals, system type and battery presence, in a documented precedence order. Virtualisation is stored as a separate flag, so a virtualised server is still a server.
Last known position, stated together with how precise that position actually is. A Wi-Fi-derived fix and an IP-derived fix are not the same thing, and the UI never pretends otherwise.
Define where a device is supposed to be and get alerted when it leaves, with optional automated response attached to the exit event.
Lock the machine, log the user off, sound an alarm, put a notice on the lock screen, disable an account, kill remote sessions, or wipe company data. The set of things you need when a laptop goes missing on a Friday afternoon.
Purchase year and warranty expiry tracked per asset, so refresh planning and warranty claims run off the same inventory the monitoring uses rather than a separate spreadsheet that drifts.
CPU, memory modules, storage devices, network interfaces, BIOS details and serial number per machine — the record you need for a warranty claim, an insurance schedule, or a capacity conversation.
Rules that fire on real conditions, running scripts that a human approved. Automation without an approval step is how estates get broken at scale.
Metric threshold, device status change, service stopped, schedule, alert created, device enrolled, and manual. Enough coverage that most routine responses can be expressed as a rule rather than a habit.
PowerShell, Bash, Python and Batch scripts stored centrally, versioned, and reusable across the fleet rather than living in a folder on one engineer's laptop.
Scripts require approval before they can run against managed devices. Writing a script and authorising it to touch production are deliberately two separate acts by two separate permissions.
Dispatch to online devices over the agent's real-time channel, with per-execution status, output capture, and result tracking. You see what ran, where, and what it returned.
The same execution engine backs scheduled automation, one-off diagnostics from a device page, and the fleet sweeps used by security checks and speed tests. One path to audit, not four.
The hardest part of alerting is not sending the message. It is not sending the other four hundred. Debouncing, de-duplication and per-device tuning are first-class here.
Device offline, CPU, memory and disk thresholds, stopped services, backup failure and staleness, brute-force detection, security findings, port monitor failure, and patch deficiency — graded across info, warning and critical.
Delivered over your own SMTP server, with sender name and address under your control. No third-party mail relay is required for the platform to notify anyone.
Twilio-backed SMS for the alerts that genuinely need to reach someone at 2am, with per-tenant Twilio credentials so each organisation can send from its own number and account.
Browser push subscriptions for operators who want alerts on the desktop or phone without an inbox in between.
Brief blips do not page anyone, repeat conditions collapse into one alert, and sustained brute-force activity is summarised into a digest. Every check can be tuned or switched off per device.
Push events into your own ticketing, chat or SIEM tooling. Outgoing webhooks are signed, so the receiving system can verify the payload genuinely came from your RMM.
Reports built for the conversations that actually happen — with an insurer, an auditor, a client, or an ISP.
A per-client rollup of MFA, password policy, patch compliance, backup validation, encryption and RDP exposure, with an explicit pass, warn or fail per device. The questions on the renewal form, answered with evidence.
Ping, jitter and packet loss alongside download and upload throughput, plus the adapter name and link speed — the discriminator between "the line is slow" and "you are on Wi-Fi." Run per device or sweep the whole fleet.
Speed test results are charted per device against a rolling 30-day median, so a gradual degradation stands out instead of hiding behind one good reading on the day you happened to look.
Scoped rollups per client organisation, so an MSP can hand a customer their own picture without exposing anything belonging to another customer.
Hardware and software inventory as reportable output — asset registers, license positions, and the "what do we actually own" list that is normally reconstructed by hand once a year.
The governance view rendered as a report: which AI applications are present, their policy status, and how adoption is changing over time — all from application metadata, never from content.
Built multi-tenant from the schema up rather than bolted on later, which is the difference between isolation you can explain to a customer and isolation you hope holds.
Each tenant's operational data lives in its own database, with a separate control database holding tenants, users, sessions and keys. Isolation is structural, not a WHERE clause someone might forget.
Free, standard, professional and enterprise tiers with configurable device limits per tenant, so commercial arrangements are enforced by the platform rather than tracked in a spreadsheet.
Capabilities like AI features, location tracking and governance collection are switched on per tenant, default off where privacy is involved, and every change is audit-logged with before and after values.
Granular permissions attached to roles, applied consistently across the UI and the API. Viewing a device, executing a script, and deploying a patch are separate rights.
A platform operator can work across tenants where that is genuinely needed, as a distinct and explicitly separate role rather than an ordinary account with extra checkboxes.
Logins, password changes, alert actions, script executions, setting changes and device modifications are all recorded, searchable, and attributable to a specific person.
Ordinary, well-understood technology chosen on purpose. Any experienced team can read this stack, maintain it, and extend it without a ramp-up.
Agents authenticate with a unique per-device token and reach out to the server. They do not listen for connections, so there is no inbound port on a managed machine for anyone to attack.
Session-based auth for browsers, JWT access and refresh tokens for API clients, and scoped API keys for integrations — each appropriate to its context rather than one mechanism stretched across all three.
Passwords are bcrypt-hashed with a configurable cost factor, and agent tokens and API keys are stored hashed. A database copy on its own does not yield a working credential.
Global request limits with tighter limits on login and enrollment, plus a Content Security Policy, CORS rules and response compression applied as standard middleware.
Designed to sit behind a Cloudflare Tunnel with TLS in transit, so the server itself is not directly exposed to the internet and no container platform is required to deploy it.
SQLite by default with no external database server to run, or Microsoft SQL Server for larger deployments, with schema managed through versioned migrations either way.
Agents pull updates from the server, extract them, and restart their own Windows service. Rolling out a new agent version does not mean touching every machine by hand.
Everything the platform collects is read-only. Anything that changes state — restarting a service, pushing a patch, applying a firewall rule, rebooting a machine — requires an explicit permission and an explicit command.
| Layer | Technology |
|---|---|
| Server | TypeScript, Node.js, Express, EJS server-rendered UI |
| Real-time | Socket.IO for agent and dashboard channels |
| Database | SQLite by default, Microsoft SQL Server optional, Knex migrations |
| Agent | TypeScript Windows service, PowerShell collectors, node-pty terminal |
| Notifications | SMTP email, Twilio SMS, browser web push, signed webhooks |
| Cloud integrations | AWS S3 SDK for Wasabi, Google Drive API, SQLBak API |
| Auth | JWT, bcrypt, session cookies, scoped API keys, TOTP MFA schema in place |
| Logging | Winston, with a full application audit trail |
Netaxis RMM manages Windows Server, Windows desktops, macOS and Linux from one workspace. Metrics and inventory work across all four. Several capabilities are Windows-first today — patch management, installed-software inventory, the security audit, Windows event log collection, and the firewall actions — because they are built on Windows-specific APIs. Extending those to macOS and Linux is on the roadmap. The catalog above marks the platform for anything that is not universal.
Get in touch to walk through a live demo environment, or watch the videos covering these capabilities in detail.