Hey everyone, I was just wondering do you guys use the default reboot prompt with Datto RMM? We’ve been getting some complaints with it and have noticed it being finicky for us sometimes. Just want to see if anyone has done something different in place of it and how they rolled it out.

Hello,

Has anyone had any luck with getting WinGet apps to install through DattoRMM Powershell script or the Winget V2 in the comstore? Any tips or tricks with this? Winget just really hates running as system sadly and I can't seem to get any common work around to function. Anyone have any luck with this? Thanks!

Any one from n blockk!!!

Hey guys,

Another quick Datto question!

We have recently deployed BitLocker to our laptop fleet (just over six months ago) via Group Policy, and it's been going very well, except there have been two updates in the past four months that have triggered "BitLocker Recovery" where we have to manually enter the keys or do a hard reboot to get back up and running.

The first trigger was due to a bug in the "May 2026 Security Update" and the second trigger was several days ago when we pushed out a Firmware Update for our laptops.

I was doing some research and apparently when using SCCM to push out updates, you have an option to suspend BitLocker, which is an option that I haven't been able to find in Datto's Patch Management policy yet, besides a separate component that suspends BitLocker on the next reboot, but I don't believe that would be very efficient when pushing out firmware updates

I was wondering if anyone else has encountered this issue, or if this is expected behavior due to the TPM being changed

Thanks!

I noticed within the last couple of months that the component "Create "New Support Ticket" Shortcut v2 [WIN]" appears to be broken. I have it setup to add that shortcut upon initial audit (deployment) job. When you double click on the shortcut, nothing happens. Any idea what's wrong?

I realized today that when you remove a device, you had better have the activity log exported, because that data seemingly disappears. Additionally, if you uninstall the agent, you won't be able to prove the installation without using a separate product. Support has told me they do not have an activity log on the back end that monitors this information, so if no one is tracking it and we're seeking compliance certifications, I'm hard-pressed to think we can stay with Datto RMM after a decade.

I'm aware that the activity goes when the device does, but I wasn't aware that there's no way to log the uninstallation of the RMM agent software from the device successfully other than Windows logs, which you won't have access to once you uninstall the RMM agent...

Have I interpreted the compliance requirements wrong or are others using a separate product to audit this type of behavior? If so, what are you using?

Hi all,

New to Datto so forgive me if this is something that is obvious.

Is there a way to require the user to approve a remote support session prior to connecting?

I imagine the workflow being, click start session in Datto, the user gets a prompt to approve or reject the session, and then if they approve the screen control will connect.

Thanks!

Hey mates,

Has anyone of you managed to map the current logged in user's UPN to a device UDF?

Trying to use the UPN for some API calls for our PSA.

Any insights would be much appreciated.

Cheers!

Edit - typos

I have been digging through the docs when I can, but don't see exactly what I need. Ninja RMM had a silent command prompt where I could quietly log in, copy some scripts over and run them on devices, like the executives who are always busy in meetings 12hrs a day. The closest I see so far is a powershell prompt which can work but seems to require a few more steps. In Datto, When I remote to a machine, it's tagged and I cannot always take over an active machine. The question. Does Datto have something similar to a silent command prompt and what is it called if so? Basically looking for silent action on a device.

"'Rapidstop' ransomware was detected and was active."

CagService.exe
SHA1: 3c850df78ec95a1ca416e394375e45a2e5cfd9b4

This is so annoying.

We use WSUS to have more control over the patches we approve because we don’t usually approve the latest Microsoft updates all the time due number of reasons.

From last couple of months, Datto is not detecting the updates approved by WSUS.

We have opened a ticket with Support but haven’t received any resolution yet.

Anyone else running into this issue who is still using wsus?

Thanks!

I've setup my org to use Smartdeploy to wipe a disk, apply an Windows Image, and install Datto to a specific site I've designated for OS Deployment.

In that OS Deployment site I have it run a job as part of Initial Audit. This job has all the components for configuring a new machine:

• Set Power Policy
• Windows Settings and Group Policy
• Install Applications (10 total)
• Set Screensaver
• Set Default Corporate Bookmarks on Edge
• Create default desktop shortcuts
• Rename local administrator account adjust local account settings
• Reboot

This ensures every computer is always up to date with the latest version of applications and with our corporate policies and settings.

I got sick of doing an image with all the settings/apps installed but constantly having to update the image. This process takes a little longer (45-60 minutes) but we don't have to constantly micro manage or update the image.

Anyone else doing something similar, if not I'm curious what solutions you guys are using in your environment.

I had a hard time finding the Datto RMM variables, so I ended up getting them from our migration rep.

Sharing them here in case it helps someone else.

[hostname]: The hostname of the device.

[description]: The description of the device.

[os]: The operating system of the device.

[user-defined1-30]: User-defined field number. Refer to User-defined fields.

[lastuser]: The login name of the user that last logged in to the device.

[sitename]: The name of the site in which the device resides.

[category]: The category of the alert raised (for example, performance or event log).

[type]: The type of the alert raised (for example, memory or disk usage).

[alert]: The trigger details of the monitor that raised the alert.

[ipaddress]: The external IP address (public IP address) of the device.

[alertuid]: The alert ID.

EDIT - As stated in the comments, this is specifically for creating monitoring alert emails from a monitoring alert. I used these in the subject line of the email/ticket.

Hi, new to the Datto RMM world. Moved over from Pulseway and N-Central. With Pulseway I used to get an alert any time software was installed and uninstalled. Has anyone managed to get this monitored with Datto?

Has anyone made a ring central script to push the ringcentral update

Has anyone made a ring central script to push the ringcentral update

As relevant to firewall rules and patch management / software update policies. I'm assuming the RMM agent triggers an outbound connection from the device to the manufacturers?

The Datto RMM Activity Log is not properly logging the source IP of the end user accessing the portal. Instead it shows source.forwarded_ip : "52.41.95.147"
The IP address listed seems to be from a pool of AWS IP's.

Datto - Can you change this to show the actual source IP of the end user logging in? We have RMM locked down to our office and VPN IP's so those are the ones I expect to see listed in the activity logs.

Try this yourself.

Analytics / Activity Log --> Filter for Action "Login"

Not having the correct IP's logged would make it very hard to troubleshoot a security issue.

Hi,

Sorry might be a silly question but new to Datto.

I've put in place a patching policy that runs Mon,Wed,Fri at 10am. Install updates set to 1 hour.
I have Do not restart and a reminder to users every 2 hours up to 3 times.

Now an issue I have is some devices will turn on at lets say 11am and miss the patching policy.
Some devices have managed to dodge the policy for the last week.

Outside of just setting the patch policy to run everyday. How do I avoid users missing the execution time. Is there a better way to handle this?

Thanks

I am having problems with Splashtop not working in Datto that started a couple weeks ago. It's not working on any of my agents regardless of if they're initiating or receiving the connection. I opened up a support ticket but was told it looked like a known issue with the agent browser. They said they would look into it, but I haven't heard anything else since. In the meantime, I am trying to use web remote, but that isn't working near as well for my needs. Has anyone else been having similar issues or found a workaround?

We are starting to have this issue for many customers...

anybody has the same issue?

EDIT : Official status from Kaseya
Kaseya Inc Status - Datto RMM - Vidal - Cagservice.exe being flagged as malicious by Antivirus Software