Riccardo Bicelli

Hi Daren! My company is using it and we’re pretty satisfied.

Yes, at the time I wrote the article you needed to open outbound 443 and 4222 (nats) from agent to RMM to work. In latest releases only 443 is needed.
Agents need also to communicate with https://icanhazip.tacticalrmm.io/ to get public IP info. Unsigned agents need to access https://github.com/amidaware/rmmagent/releases/*.
Signed agents need to access https://agents.tacticalrmm.com.

You have to set the CRL distribution point in the CA certificate also, then put the CRL in your Web root of Web Enrollment.

Yes, you can keep it on the DC. You don’t need to install XCA since it’s portable. If you are running a virtual environment it is convenient to create a detachable hard drive which you can use to keep XCA and its database on it.

1) In this case settings are defined in the tool. Security is a link that unfortunately can’t be overridden. If you want the user to have calculator, notepad, etc… you’ll have to define them in composer.

2) You can avoid agent install by putting the agent folder on  an UNC path (i.e. mydomainnetlogoncomposeragent and in the GPO call the executable. But you have to call the after-installation steps of agent in computer logon scripts (i.e. mydomainnetlogoncomposeragentcomposeragent.exe -install ), which creates the DesktopComposer Local user groups and sets ACLs on Common start menu folder.

Hi Leos! Glad to be here 🙂

Installation of agent isn’t strictly required, It is just for convenience because the installer does some tasks, like setting ACL on all user’s menu and adding a user group to the system that can be done also in a machine login script GPO (by calling %agentexecutablefullpath% -install).

Start menu items defined in Composition file will replace both the common start menu and user’s start menu. At startup the agent takes a backup of initial user’s start menu, which will be restored at logoff, when agent is called with switch -decompose.

Cheers!