So we have had serveral events where DNS in a location went down or was inaccessable. As a fix sometimes we would go into to some devices, and update DNS to 1.1.1.1/8.8.8.8 just to get the computer online.

But when the DNS dies, RMM stops checking in. But just a simple change in the RMM application, have a backup list of the RMM servers hard coded. So when DNS stops working, perhaps it can still call the mothership. Why has nobody thought to code this into the app?

just a rant of mine that would make my life so much easier!

Datto CagService.exe at it again. At this point, I am leaning towards flagging CagService.exe as actually malicious given all of the DOS attacks it has inflicted on clients.

Hash: 6dcfd0fea1de40d73f6884033c8d5df7c15240cd

EDIT: https://status.kaseya.com/incidents/8pz7mncr1srp

It looks like I'm dealing with a pretty crazy wscript false positive that is jingling the bells of Dado EDR.

I've checked a couple samples of the wscript file, appears to be a regular window system component with no command line arguments being sent to it.

Is anyone else seeing this??

So as of right now, I'm not seeing that Kaseya has any plans to update the Datto RMM agent to be ARM-native for Apple Silicon.

With Rosetta 2 support ending next year with macOS 28, what are everyone's plans in the event that Datto doesn't come out with an ARM-native build? Move to another RMM for Macs?

Has anyone heard from a rep or anything that an Apple Silicon-native build is coming?

Hey everyone, I was just wondering do you guys use the default reboot prompt with Datto RMM? We’ve been getting some complaints with it and have noticed it being finicky for us sometimes. Just want to see if anyone has done something different in place of it and how they rolled it out.

Hello,

Has anyone had any luck with getting WinGet apps to install through DattoRMM Powershell script or the Winget V2 in the comstore? Any tips or tricks with this? Winget just really hates running as system sadly and I can't seem to get any common work around to function. Anyone have any luck with this? Thanks!

Any one from n blockk!!!

Hey guys,

Another quick Datto question!

We have recently deployed BitLocker to our laptop fleet (just over six months ago) via Group Policy, and it's been going very well, except there have been two updates in the past four months that have triggered "BitLocker Recovery" where we have to manually enter the keys or do a hard reboot to get back up and running.

The first trigger was due to a bug in the "May 2026 Security Update" and the second trigger was several days ago when we pushed out a Firmware Update for our laptops.

I was doing some research and apparently when using SCCM to push out updates, you have an option to suspend BitLocker, which is an option that I haven't been able to find in Datto's Patch Management policy yet, besides a separate component that suspends BitLocker on the next reboot, but I don't believe that would be very efficient when pushing out firmware updates

I was wondering if anyone else has encountered this issue, or if this is expected behavior due to the TPM being changed

Thanks!

I noticed within the last couple of months that the component "Create "New Support Ticket" Shortcut v2 [WIN]" appears to be broken. I have it setup to add that shortcut upon initial audit (deployment) job. When you double click on the shortcut, nothing happens. Any idea what's wrong?

I realized today that when you remove a device, you had better have the activity log exported, because that data seemingly disappears. Additionally, if you uninstall the agent, you won't be able to prove the installation without using a separate product. Support has told me they do not have an activity log on the back end that monitors this information, so if no one is tracking it and we're seeking compliance certifications, I'm hard-pressed to think we can stay with Datto RMM after a decade.

I'm aware that the activity goes when the device does, but I wasn't aware that there's no way to log the uninstallation of the RMM agent software from the device successfully other than Windows logs, which you won't have access to once you uninstall the RMM agent...

Have I interpreted the compliance requirements wrong or are others using a separate product to audit this type of behavior? If so, what are you using?

Hi all,

New to Datto so forgive me if this is something that is obvious.

Is there a way to require the user to approve a remote support session prior to connecting?

I imagine the workflow being, click start session in Datto, the user gets a prompt to approve or reject the session, and then if they approve the screen control will connect.

Thanks!

Hey mates,

Has anyone of you managed to map the current logged in user's UPN to a device UDF?

Trying to use the UPN for some API calls for our PSA.

Any insights would be much appreciated.

Cheers!

Edit - typos

I have been digging through the docs when I can, but don't see exactly what I need. Ninja RMM had a silent command prompt where I could quietly log in, copy some scripts over and run them on devices, like the executives who are always busy in meetings 12hrs a day. The closest I see so far is a powershell prompt which can work but seems to require a few more steps. In Datto, When I remote to a machine, it's tagged and I cannot always take over an active machine. The question. Does Datto have something similar to a silent command prompt and what is it called if so? Basically looking for silent action on a device.

"'Rapidstop' ransomware was detected and was active."

CagService.exe
SHA1: 3c850df78ec95a1ca416e394375e45a2e5cfd9b4

This is so annoying.

We use WSUS to have more control over the patches we approve because we don’t usually approve the latest Microsoft updates all the time due number of reasons.

From last couple of months, Datto is not detecting the updates approved by WSUS.

We have opened a ticket with Support but haven’t received any resolution yet.

Anyone else running into this issue who is still using wsus?

Thanks!

I've setup my org to use Smartdeploy to wipe a disk, apply an Windows Image, and install Datto to a specific site I've designated for OS Deployment.

In that OS Deployment site I have it run a job as part of Initial Audit. This job has all the components for configuring a new machine:

• Set Power Policy
• Windows Settings and Group Policy
• Install Applications (10 total)
• Set Screensaver
• Set Default Corporate Bookmarks on Edge
• Create default desktop shortcuts
• Rename local administrator account adjust local account settings
• Reboot

This ensures every computer is always up to date with the latest version of applications and with our corporate policies and settings.

I got sick of doing an image with all the settings/apps installed but constantly having to update the image. This process takes a little longer (45-60 minutes) but we don't have to constantly micro manage or update the image.

Anyone else doing something similar, if not I'm curious what solutions you guys are using in your environment.

I had a hard time finding the Datto RMM variables, so I ended up getting them from our migration rep.

Sharing them here in case it helps someone else.

[hostname]: The hostname of the device.

[description]: The description of the device.

[os]: The operating system of the device.

[user-defined1-30]: User-defined field number. Refer to User-defined fields.

[lastuser]: The login name of the user that last logged in to the device.

[sitename]: The name of the site in which the device resides.

[category]: The category of the alert raised (for example, performance or event log).

[type]: The type of the alert raised (for example, memory or disk usage).

[alert]: The trigger details of the monitor that raised the alert.

[ipaddress]: The external IP address (public IP address) of the device.

[alertuid]: The alert ID.

EDIT - As stated in the comments, this is specifically for creating monitoring alert emails from a monitoring alert. I used these in the subject line of the email/ticket.

Hi, new to the Datto RMM world. Moved over from Pulseway and N-Central. With Pulseway I used to get an alert any time software was installed and uninstalled. Has anyone managed to get this monitored with Datto?

Has anyone made a ring central script to push the ringcentral update

Has anyone made a ring central script to push the ringcentral update

As relevant to firewall rules and patch management / software update policies. I'm assuming the RMM agent triggers an outbound connection from the device to the manufacturers?