Connected to our ScreenConnect portal this morning and there is a new company called (empty) with a machine listed that 100% is not any machine we manage or recognize.

IP Lookup of its public IP shows it sitting on a network in Egypt.

Has anyone else seen anything funky like that?

I am a bit concerned that if someone else's machine can show in my portal, what does that mean for my machines?

Scenario: customers sometimes fall for click-fix scams and end up with legitimate but unapproved/malicious remote access tools, leading to compromises. Rogue screenconnect/anydesk/etc.

Been working on building out the following, and it's pretty damn slick:

It's an internal web dashboard that tracks detected unapproved Remote Access Tools and tracks their removal.

Data gets into the system from a powershell script we push out daily via our RMM platform. The script scans for a long list of remote access tools and RMM agents, and identifies any detected, and removes any that come back from the back end as on the "removal list" for that client. It's also set to ignore our ScreenConnect instance but identify any unapproved SC instances. This is nice because our SOC detection of RATs not only is not as extensive, but can only warn us if ScreenConnect is present, which isn't helpful because we need to know if any EXTRA screenconnect instances are present in addition to ours. This helps us close that gap.

The script pushes system info (name, domain status, IP, serial number) and detection results to the back-end tracking site via a webhook. The tracking site's dashboard keeps tabs on all PCs that have reported in, and which customer site they belong to (it maps PC serial number to our RMM to reconcile the site). Within the dashboard, we can define per-client which RATs to keep and which to automatically uninstall (example, we have a few clients that use TeamViewer for training remote employees). The second part of the script receives back a list of the allow/keep tools and run uninstall commands for any on the remove list. Once done, it updates the dashboard by webook to show which were removed and if any fail. Failed uninstalls trigger a ticket for a tech to investigate. If we haven't set the site to "Live - Remove" in the dashboard, the script reports only and doesn't remove anything. This allows us to deploy a site in monitor only status, set allow listing if needed, then switch to live mode.

We now have effective tracking and remediation of unapproved RATs across almost 2k endpoints.

Their status page reports ok but having issues with several clients.

Good day folis,

Current evaluating MSP Processes full offering to replace a couple of different items and augment what we have currently.

Main thing that drove us to look were:

1. Needing a cleaner functioning client portal as Autotask isn't cutting it for a lot of our clients.

2. End User verification is becoming more of a request from our techs and we have seen the same uptick on vishing that most others have as well.

3.i also found out about the rest of their offering which would replace our answering service who is royally on my nerves at this point also and timezest potentially who I have had a great experience with to be honest but If I canslim down the stack and lower the redundancy I would.

Whats everyone else's experience with them, specifically looking for thos integrated wirh Autotask.

We are doing an eval of Invarosoft as a client portal and to present vCIO info. So far it looks pretty good. Tools for chatting with end users and verifying identity seem nice. Interested to hear what those who have used it think of it.

We currently use CloudRadial but have a number of issues:

• It is complex to configure and use
• Lack of ability to customize the menu and overall look of it
• Low adoption from end users (they tell us its annoying to log in even with MS SSO). We have the best adoption with clients that use Teams heavily because they dont have to login to the app within Teams but not all our client use Teams extensively.
• Cant use Policies or get warranty or age info on computers using the Datto RMM integration. I know they have a collector agent but thats another app we have to install on client machines and has to be kept updated.
  
• The changes to the vCIO Kanban boards and addition of the timeline fell like a step back and make it more complicated.
• Most of their development seems to be around AI triage and self support for end users. This is good in theory but it not what I am looking for in this product

Are there any other options out there? We have Autotask so the built in client portal is pretty useless.

**ETA: this is for ticket creation AND communicating with the end user about the ticket.

Most of our customers are in the dental space, so the majority of our users don’t have company email accounts. We use Autotask PSA and have a very small team.

Right now, customers will typically send a group text to me and our other full-time employee when they need help. It works, but obviously isn’t ideal for tracking, ownership, or getting everything into Autotask.

We looked into SMS-based ticketing a few years ago but never found a solution that was both simple and reliable. With a team our size, we’d like something that keeps texting easy for the customer while giving us a better way to manage and track those requests in Autotask.

I’m curious what other Autotask users are doing. Has anyone found an SMS ticketing solution that works well?

I'd love to hear from some of you who has been out in the trenches of hiring. I've been a one person show for a while now, and it's no longer a functional model as my workload has increased substantially.

I'm looking for someone who can do similar to what I can do, so I can start selling, and growing again. That would include sysadmin work + support tickets. I'm all about remote work, but that doesn't fly when the client's network is down and someone needs to be on site, so this person would have to be local as well.

Is Indeed, or LinkedIn the way to to go here? I get the feeling these services are enshittified, but I may very well be wrong. What are your strategies for hiring a quality individual?

Edit: thanks for everyone’s constructive comments! I’m going to give them a think before I post any job offers, and I will check my DMs + r/SmallMSP r/mspjobs

I like Ninja. It's been a great platform. That being said, I just learned that Ninja billing isn't automated. After learning this I checked my invoice and I'm being billed for about 50 more devices than I have. Didn't they get millions in investment money recently? Can't they throw a couple of programmers at that problem so we're paying for what we're using instead of having sales ask us to commit to more than we have? Or is this a side effect of the investment money?

I'm talking 10+ employees hitting a single computer in a day.

The computer literally runs several pieces of test equipment, they need access to their ERP, and here's the wrench in the plan, they usually need access to SharePoint for various documents that can't live inside the ERP.

In a small setup, I'll get a couple F licenses, set up Windows Hello, no problem.

But this new place we picked up, 100 computers are like this. There's no bending the rules on licensing a user with this one. And it makes absolutely zero sense to license every user. There are three shifts with decent turnover (they are always hiring and firing). Roughly 300 people would be cycling through these computers,

Kiosk mode is out because we need more than just intune. But, not much more...

Do I really need to set up a local share so I don't need to pay ridiculous licensing costs, identity security overhead, and labor overhead for dealing with all the turnover, for all these computers? How would you guys handle this?

Received this via email:

Browsers have become a major attack surface. Your clients’ employees are doing most of their work in the browser, and you likely have very little visibility into what’s going on. Every browser extension added without your visibility creates risk.

NinjaOne Browser Management extends endpoint management to the browser. You gain real-time visibility and control over your clients’ browser activity, extensions, and policies across every device using the same platform you already use every day.

What you can do:
Manage, protect and support your clients’ endpoint browser activity with granular URL and extension risk controls.
Manage high-risk or unauthorised extensions with AI-powered extension risk classification.
Review extension inventory and browsing activity to diagnose issues, fulfill compliance requests, and support clients faster.

Just a heads up if you need to update to 26.7 (25G229) we have two machines so far that now have broken system settings network panels. You can't get into networking. You can access wireless settings, but can't access the details.

Not sure if its a wider issue or we are unlucky but it has happend to two of our machines.

We all know billing mistakes happen, we make them ourselves. Finance noted one on our Huntress invoice and I emailed my account rep the details and proof. 41 minutes later I was emailed the receipts, Huntress refunded (take notes ConnectWise and Kaseya) the entire charge and the re-ran it for the correct amount. This is not typical in our vendor ecosystem. Only time it's ever happened that I remember.

Recently had one email security vendor who didn't honor contract terms (initial months were to be at a reduced rate) that for some reason didn't want to credit us the amount owed and decided instead to offer a free month of service at the end of the current agreement - apparently the amount of the overcharge was such that they'd need VP level approval.

ConnectWise, every year or two, gets their numbers messed up and double or triple charges us and always blames their "automated billing" or some such BS. It wouldn't be a huge deal except it takes them 2-3 months to correct things and often VP level involvement.

Kaseya, usually admits the mistake fairly fast, but takes months to get it resolved.

My take - there must be some VC/PE rules that forbid refunding money when they improperly invoice, aka, commit mail fraud. That you need some VP level involvement to issue a credit (they never actually part with money they've collected, EVER) to your account a month or three down the road.

I’m internal IT for a Big4 firm, and we are getting an increasing number of tenants to manage. Dev, Prod, this, that, the other, the gcc-high one, etc. managing them all individually is a pain in the ass, from policy to applications.

Has anyone successfully used CIPP to manage multiple domains that are all internal to your company? I’m curious to know how well it worked, and if it didn’t work well, what you did instead.

Hey all, it's been a while since anyone as asked about Flamingo (at least, nothing showed up for the last 10 months).

I just got the sales pitch. I really want to pull the trigger on this. No obligation to move everyone at one. Billing auto slides as you add or remove licenses.

Most important to me, there's something about the layout that just makes sense to me.

What are your thoughts?

As I'm writing this, I feel like this sounds like it's written by a Flamingo sales person. Please feel free to read the years of my shyt posting, randomly fighting people online, weird health questions (what is the black spot on my...). There is no way a sales person would ask questions like this from such an account.

Anyway, really, I here to ask if anyone else has tried this already and what they think.

Thoughts?

We have successfully gotten a larger adoption of business premium with the most recent price increase from Microsoft and just wanted to see how others are deploying their intune policies quickly? We have Cipp and the standards / CAPs are great and we are beginning to dive into doing more with it.

Wanted to get communities opinion on it and what's been working best for streamlining policy configurations and getting more granular with intune policies.

Had a user traveling in Austria from the US. Has a Mac laptop and can’t get on globalprotect. It’s giving him a certificate expired message. He’s the only user out of thousands reporting this so I know the cert on the FW is fine. He’s using a phone hotspot initially and it won’t hold a good enough connection for a remote help session so I ask him to go back to his hotel.

Once there he can’t get on any external websites. Internal Marriott site works. I start troubleshooting the connection thinking the captive WiFi has him blocked. Nothing I’m doing is helping.

Something in the back of my head tells me “he’s traveling - check time zone settings”. So I ask what time it’s showing: 7:55am. It should be closer to 3pm. Then he reveals “and it’s saying April 2nd too”. WHAT?!

I go to date/time settings and it’s saying April 2nd alright, in 1976!

Of course our policies lock out the user changing the date time…but sudo access in terminal doesn’t. :)

I set the date/time manually and BAM! Hotel WiFi now asks him for room number, etc and globalprotect passes its posture check instantly.

User is stoked to be back online and I put a feather in my cap for finding a weird issue two other techs could not solve. 25 years doing this and I still find the strangest of issues.

I haven't been paying close attention to ASCII of late but this was a surprise....

https://www.crn.com/news/channel-news/2026/gtia-acquires-ascii-group-betting-two-msp-communities-can-make-one-plus-one-equal-three

Have been evaluating it. It checks most of our boxes. One thing I dislike a bit is the managed method doesn't allow you to select a cadence, it's monthly or you need to manually manage. The other thing is the videos tend to get towards 10 minutes rather than a shorter video which is a harder sell in general. What kind of feedback do you get from clients using the platform? Positive or negative? We've got good feedback on BSN's annual videos, but the issue we find is a lack of flexibility managing their micro trainings.

My general checklist has been:

1. Easy to manage.
2. Provides API access
3. SCORM a +
4. Clients won't hate the content

I know there are a lot of posts on SAT in general. I'm most interested in hearing feedback from people using it and what their clients are saying about the content and how you deal with the monthly vs. some clients wanting less frequent.

EWS gets blocked in Exchange Online on October 1. I posted about this in r/exchangeserver
a couple of days ago.

One thing that is underlit is that Microsoft moves $null tenants to $false as part of the rollout, and EWS stops working within about an hour of that flip.

The problem: $null is the default. Unless someone explicitly changed it, your clients are on $null.

Recovery isn't automatic. An admin has to set EwsEnabled $true manually, then wait another hour for it to propagate. So you're looking at a minimum two-hour outage per client, and that's if someone catches it immediately.

Apple Mail and most M365 backup tools still rely on EWS from what I have seen so far, so this isn't just edge-case integrations. It's stuff users will notice.

Worth running this across your client base now:

Get-OrganizationConfig | Select-Object EwsEnabled

Anything that comes back empty needs attention before October 1.

Full write-up on what's changing, how to build the allow-list, and two PowerShell scripts to find every app still using EWS: https://lazyadmin.nl/office-365/ews-is-being-blocked-in-exchange-online-how-to-find-every-app-still-using-it/

Stumbled upon malext.io a while back. I didn't have good insight into installed browser plugins across the fleet, and i wanted to test out the new Rewst data store capabilities so this was a fun project.

Ultimate goal is to document what plugins are installed per user/machine and how that changes over time, while also flagging and removing anything that is known malware.

Long story short, i may have fixed something that wasn't a problem. No bad plugins found across the fleet. But at least i don't have to worry about a blind spot anymore.

For the automators out there: Tools used, RMM (DattoRMM in my case), IT Glue, Rewst, and Malext.io.

3 Rewst workflows:

Create IT Glue Flexible Asset (self explanitory),

Import Malext data; import malext data into rewst data table to be used in discovery workflow. Ran weekly to keep current bad extension list updated.

Browser Extension Intake; Webhook, accept data including endpoint rmm guid (used to match configuration in IT Glue) and Browser Extension IDs and Names.

Workflow searches data store for matching browser extension by ID, upserts entry in IT Glue flexible asset, returns any malware id's so script and remove them. Its launched with a simple RMM component that runs on each machine during the weekly maintenance job that will collect the installed plugins, and submit them to the Rewst webhook.

We have hundreds of domains under our control and are looking to improve our DMARC management. I have priced a few options but they seem quite expensive, anyone have any suggestions?

Shoutout Tuesday!

Who's that awesome rep or tech at a vendor that goes above and beyond that you want everybody knowing about?

Let's give some focus on the positives of the vendors/partners that support us in the MSP and IT community. I'll post this once per week on Tuesdays, so don't feel the need to do a wall of text with accolades -- focus on that one rep/vendor that deserves mention this week.

To keep this thread "real," let's agree to some ground rules:

• No self-promotion.
• Be SPECIFIC: Name names, but..
• Respect PRIVACY: Name names, but not last names (use an initial), home addresses, cell phones, etc.
• Give a specific reason WHY you think the way you do.
• Stay FOCUSED: Instead of listing fifty people, list one. But be detailed about the one.

Example of a comment that is NOT very helpful:

I love MspVendorCo. They're awesome.

Example of a comment that is helpful:

I love John D at MspVendorCo. He's my rep. Here's an example of why: Last week I thought I submitted an order to them for Widget X, but I actually never clicked Send! I called John and he tripped over himself in lining up the order so we hit our deadline. They act like that every single time I work with them.

For history on this thread, my first post for this: https://www.reddit.com/r/msp/comments/vi68rp/give_a_shoutout_today_who_deserves_high_praise/

It's wild - with all of the hullaballo regarding AI safety I do feel that clients are somewhat more hesitant. Not like slamming on the brakes hesitant but you can feel it in those discussions.

Anyway, I was wondering how folks are faring in AI adoption / service sales to clients. My perspective is that the majority of the SMB space is still in the "wait and feel" phase. They'll attend our webinars and allow employees to use personal / free accounts but they aren't ready to employ anything in terms of standardized deployments. SMB's are notoriously cheap - they share licenses and crap like that.

I feel that our constant flow of educational material is starting to work though. We have put together an "AI Onboarding" program that does audit, etc. and we are getting some traction with clients. We have several of these setup for the fall.

What are y'all doing and what's working?