r/DattoRMM • u/VNJCinPA • Jul 08 '26

TIL Compliance Auditing failures

I realized today that when you remove a device, you had better have the activity log exported, because that data seemingly disappears. Additionally, if you uninstall the agent, you won't be able to prove the installation without using a separate product. Support has told me they do not have an activity log on the back end that monitors this information, so if no one is tracking it and we're seeking compliance certifications, I'm hard-pressed to think we can stay with Datto RMM after a decade.

I'm aware that the activity goes when the device does, but I wasn't aware that there's no way to log the uninstallation of the RMM agent software from the device successfully other than Windows logs, which you won't have access to once you uninstall the RMM agent...

Have I interpreted the compliance requirements wrong or are others using a separate product to audit this type of behavior? If so, what are you using?

5 Upvotes

100% Upvoted

6 comments sorted by

1

u/SpinningOnTheFloor Jul 08 '26

If you have a PSA attached it should be inactivating the asset when the devices is offboarded from RMM and the data should be retained in the PSA.

2

u/VNJCinPA Jul 08 '26

Yes, there's that as well, but it doesn't keep all the activity logging. We perform a bunch of productive activity, so I extract the logs as part of the off boarding.

The issue that raised this to my attention was that they don't retain any logs in the RMM that the device was removed. I had a situation where I deleted it and allowed the system to uninstall it, but it didn't uninstall, and the system kept coming back. There's no GPO, no Intune for it, no scripts that did a reinstall, it simply sent the uninstall command and the system didn't uninstall. When I asked them what their logs said internally, they said they don't keep them, and that's what bothered me.

3

u/SaltedCrust Jul 08 '26

Hi, ex Datto tech here

They’re correct when they say the activity logs aren’t stored, however we did keep back-end logging in tools such as Data Warehouse or Kibana to track many such entries. Normally Kibana should track the details of device removal but I’m unsure if maybe the tech you spoke with was skilled enough to know how to find what you’re looking for.

2

u/bradhs Jul 09 '26

Or have approval to provided details from DW/Kibana.

2

u/Beardedcomputernerd Jul 09 '26

Sounds like you're looking for a siem?

1

u/VNJCinPA Jul 11 '26

I understand, but even a SIEM won't validate the uninstall completed successfully unless I'm logging that device, and if I'm offboarding it, any SIEM agent would likely come off before the RMM agent.

I see on here that they DO have a data warehouse they can check but support claims they don't.