When a client needs safer PCs by Monday
How to lock down a client's machines in one weekend
Do four jobs for one client in a weekend. Let the agent in, rotate admin passwords, map the network, and watch one response rule in Monitor.
Browse
On this page
How to do it
On Friday, pick one client and list their security tools.
Start with one client so you learn the steps once. Note who runs their firewall, their DNS filter and their application control, and which antivirus or EDR their machines use. If you do not run those tools yourself, ask the person who does to be on call this weekend.
Let the agent past the firewall.
The agent starts every connection itself, so you need no inbound rule. Allow your portal address and the two agent addresses on port 443, outbound. Put them on the bypass list for TLS inspection. In application control, EDR and antivirus, allow the agent by its publisher or its folder. Do not use a file hash. The agent swaps its own file when it updates. The full list is in the linked article.
Check that every machine checks in.
Open RMM, then Devices, and read each machine's Last check-in. A machine shows as Offline when its last check-in is older than three check-in intervals. It never shows Offline sooner than three minutes. Fix any machine that is still blocked before you go on. Rotation only works on a machine that checks in.
Turn on the rotation in your policy.
Open RMM > Policies and open the policy the client's devices follow. Click LAPS in the tab list. Set Rotate local-admin password to On. To end a shared password such as Administrator, type that account's name in Local-admin account. Leave Rotation interval (days) blank for 30, or type 1 to 365. Press Save.
Flip the second switch on the Permissions tab.
Rotation needs two switches on purpose. Open the policy's Permissions tab, and under Armed command types tick the box that ends in laps.rotate. Use that card, not the one below it called Armed for unattended automation. Press Save.
Wait for the first rotation, then check one machine.
The schedule is checked every 4 hours. A machine never rotated is due on the next check. So its first new password shows up within about 4 hours of Save, once it is online. Open the device, click its Security tab, and find the LAPS card. It lists the Account, when it was Rotated, and the Next rotation date.
Decide which techs may reveal the passwords.
The permission is named Device LAPS Credentials. Give it under Team > Staff Roles. The Owner and Full Admin groups have it. Every other group needs it given on purpose. Press Reveal local-admin password on the LAPS card to test it. Then open System Logs, then Audit Log, to see the row that records who looked.
On Saturday, turn on the network map.
Open Settings > RMM > Network Mapping and turn on the Network mapping switch. It is one switch for the whole fleet, so every client is armed at once. If a client should stay out, open that client's RMM tab and tick Exclude from network mapping. The flip is written to the audit log.
Read the client's network map for machines with no agent.
Open RMM > Network Map and pick the client. Until the first scan arrives, the page says networks appear after the next scan. Open a network to see its gateway, its ranges, the machines with the agent and the hosts seen with no agent. A dashed pill is a host with no agent. Use the pencil to give the network a name.
Decide what to do about each host with no agent.
Each dashed pill is a host with no agent. Ask the client what each one is. The map only shows what agents reported. So a network with no agent on it does not show up.
On Sunday, build one response rule and start it in Monitor.
Open CyberSentry > Response Rules and click New Rule. A new rule opens Disabled. Set Step 1's event type to Admin role granted, a rare and strong signal. Add a Notify action and an Open ticket action. Switch Applies to to Manual and add the client. Choose Monitor, then click Save. If the client has no break-glass account, a warning lists it. A Monitor rule cannot lock anyone, so Save anyway is safe.
Test the rule against the client's history.
In the rule, pick the client, leave the window at 7 days and press Run test. The result shows how many accounts the rule would have acted on, and what the guards blocked. Nothing is locked, revoked or notified. The client needs a connected Microsoft 365 tenant for this test.
On Monday, read what Monitor recorded and stop there.
Open the rule and read Recent activity. It lists each match and what the rule would have run. Leave the rule in Monitor for now. Live is a separate choice, made on the rule form. It asks you to tick a box that says the rule will act on accounts by itself.
The pages behind each click
What you will have
- Let the GoTenix agent past the client's firewall so each PC checks in.
- Give each PC its own local admin password that changes on a plan.
- See the client's network, and spot machines that have no agent.
- Start one response rule in Monitor. You see what it would do, and it does nothing.
Why it works this way: How to lock down a client's machines in one weekend
Do the jobs in this order, because each one needs the one before it. Passwords can only rotate on a machine that checks in. The map only shows what agents report. A response rule is the last job, and it starts in Monitor.
Each job has its own full article. This guide gives you the order and the plan for the weekend. The steps link down to the details.
Three of the four jobs ship off. Rotation needs a policy setting and a second switch on the Permissions tab. Network mapping is one switch under Settings. A new response rule opens Disabled. Nothing changes on a client's machines by surprise.
If it did not work: How to lock down a client's machines in one weekend
- If a PC will not check in, go back to the firewall job. Check that the agent addresses are allowed on port 443. Check that TLS inspection is off for them.
- If no password shows up, check both switches. One is the LAPS setting in the policy. The other is the laps.rotate box on the Permissions tab. The PC must be online. Check that the PC is approved and that remote actions are on for it. Before the first rotation, the LAPS card on the Security tab is empty.
- If the Network Map is empty, give it time. The list fills after the next scan. A client you excluded does not show.
- If Test against history will not run, look at the client. It needs a Microsoft 365 tenant that is connected.
Was this helpful?