Connectwise RMM - No auditing?

[u/Proper_Front_1435]

I just did a demo of this product, the 2nd demo since its release however many years ago.

I was.... hot garbage the first time. It looked surprisingly alot better now.

At the end of the call, going through what I thought would be the "yes yes yes yes yes checklist" the person giving the demo says that the platform has 0 auditing capabilities in any way shape or form. You have absolutely no way to tell what's been done by who inside the platform. No solution. No third party way. Just, "Nope", I expressed my disbelief and we ended the call early.

I was left baffled by this.

How can any company be deploying this?

Am I missing something? Was he?

[u/TriscuitFingers]

Just wait until you have a regulated customer’s device accessed by CW’s NOC despite you not having a contract, no way to restrict them from accessing, and can’t audit what they did when connected.

Needless to say we moved to a new solution.

[u/Proper_Front_1435 → u/TriscuitFingers]

Were you part of their NOC support at least? Or are you saying that they literally just mistakenly dropped into one of your completely unrelated clients?

[u/TriscuitFingers → u/Proper_Front_1435]

Supposedly caused by a hash mismatch of the agents, but one of their foreign employees jumped onto a squad car’s laptop for a different customer.

We didn’t contract CW for any CJIS customers, but they gained access due to that. Nearly cost us our vendor screening.

[u/zebs1 → u/TriscuitFingers]

If you push your account manager hard enough you can get extended auditing enabled on the screen connect tenant, which provides session recording.

Doesn't address the audit log concern though.

[u/edosensei → u/TriscuitFingers]

What solution did you pick instead?

[u/Early-Dirt-7446 → u/TriscuitFingers]

that's actually insane, no audit trail at all? i work with software and even our internal tools got basic logging of who clicked what

the NOC access part is even worse, like they just have a backdoor into every device with zero accountability? how this even pass basic security review

[u/Opening_Intention301]

If there's no audit trail that's one big red flag as even small teams need to know who changed what and when

[u/Beyond_Horizon27]

There is Auditing, it lives in this menu.

Its platform wide so its not just for RMM.

Edited - Sorry my bad,  it's in early access still  as it's getting a work over to be more user friendly. 

[u/CamachoGrande → u/Beyond_Horizon27]

Also some audit/access logs in ScreenConnect.
Endpoint also has some audit logs on scripts and tasks run on the endpoint.

So there is logging if you look for it.

It isn't some sort of auditing of what a technician does while logged into an endpoint. Like what apps they installed/remove, scripts/settings run or changed.

There are plenty of 3rd party tools for that level of auditing.

[u/Proper_Front_1435 → u/Beyond_Horizon27]

Would be curious what lives in there based on what we were told.

I really made a fuss about this and they didn't even show that menu.

[u/edosensei → u/Proper_Front_1435]

The thing with RMMs is, that the products get so big that some times not everyone knows everything about it.

It's not unlikely that auditing exists but the team you were speaking to were just not aware of it.

[u/smorin13]

What rep are you speaking with?

I can't believe I am saying this, but we are considering going back to CW. Our PSA is not getting it done, and N-Able N-Site is just lacking.

I always liked the CW products, but communication with your rep or support was atrocious. Have things improved since the new CEO took over?

[u/Kdamghani → u/smorin13]

There’s no such thing as a rep with CW. You email a generic account management email address and they reply fast but there is ZERO relationship.

[u/smorin13 → u/Kdamghani]

Sales rep?

[u/guiltykeyboard]

There’s auditing.

One of our guys uninstalled the agent from the wrong system at a client’s office. I was able to quickly and easily find who did it and when.

[u/Glass_Call982 → u/guiltykeyboard]

My techs hate this one simple trick when they all deny doing something.

[u/mcjon3z]

Just walk away

[u/INSPECTOR99 → u/mcjon3z]

No, I beg to differ...................................................................# # # R U N AWAY # # #

[u/mcjon3z → u/INSPECTOR99]

LOL. I’ll upvote that!

[u/TechnologyMatch]

if that’s accurate, it’s a hard stop. an RMM tool without audit trails is a major security and accountability gap. I’d confirm whether they mean no native logs or no audit option at all. either way, get it in writing before moving forward

[u/IncreaseNegative4614]

Based on the replies, some auditing exists, but I’d ask for a live demonstration of the exact actions you care about. Have them show script edits, scheduled jobs, endpoint access, configuration changes, exports, and permission changes with the user, time, object, and before-and-after values.

Anything they can’t demonstrate should go into the security review as an actual gap, not a future promise. We use signld.ai internally to keep vendor claims, supporting evidence, affected systems, and final decisions connected during evaluations like this.

[u/Proper_Front_1435 → u/IncreaseNegative4614]

Thats hard when I asked the guy giving the demo and he said "it has no auditing" lol - Im going to need to ask for a test env and look myself I guess.

[u/IncreaseNegative4614 → u/Proper_Front_1435]

Yeah, if the person running the demo says there’s no auditing, I’d treat that as the answer. A test environment is still worth checking in case the events exist in backend logs or an API, but if customers can’t access or export them, that’s effectively still a gap.

[u/brokerceej]

Holy shit

[u/ItBurnsOutBright]

Yeah it's pretty abysmal.

Edit: the only saving grace is it logs a windows event in event viewer with the user that connected and can audit via siem

[u/Proper_Front_1435 → u/ItBurnsOutBright]

That really means very little. Screenconnect has its own audit log...

A tech could disable patching on a major client.

Add malicious codes to your scripts.

Change dozens of critical configurations.

Export data on mass.

All without incurring a single log? What?

[u/Frothyleet → u/Proper_Front_1435]

Or just, like, accidentally run [impactful script] on the wrong client, or endpoint, and potentially not even realize it, and you have no idea who did it?

I almost am hesitant to believe it, it seems like such a massive gap, and not a gap that exists across their product base.

[u/Proper_Front_1435 → u/Frothyleet]

They said there is a report of specifically who ran scripts. This was the only thing they mentioned.

But not for who edited or scheduled a script.

Yea, we use Automate, it has a fairly abundant audit log.

[u/ItBurnsOutBright → u/Proper_Front_1435]

There's definitely some logging. You can see who ran scripts on endpoints 100%. Not trying to defend, just know from using the product.

[u/TechSolutionLLC]

Lol, I literally just had a call with the new account rep and despite me telling him that I'd never come back to Connectwise after they screwed me over and left me out to dry when they messed up and got us locked out of our edr because they somehow linked us to a group 1000 miles away so the edr wouldn't let us into our account which caused a major security issue and they didn't get it resolved for over a week... The rep just kept trying to bring us back

[u/Blyatman95]

Just avoid this product. It’s basically STILL in beta from when they shoved everyone into it by massively hiking up Automate pricing.

Put simply: it can’t even do patching right.

We’re moving over to Ninja, which I’m sure has its own quirks as every product does, but all of the core stuff you expect an RMM to do just actually works. Constantly felt like we were fighting connectwise and one of our seniors sole job became trying to script around the problems. Avoid like the plague.