What the device page shows

1. 1

   Troubleshoot with Elise

   The top card in the narrow column on the right of Overview. It stays one small row with a Troubleshoot button until you press it. Troubleshoot opens a chat about this device: Elise pulls a fresh read from the machine, then answers your questions about it. The card says plainly Read only: Elise reads this device and never runs anything on it. A device that is still waiting to be approved shows a line saying it cannot be read yet.

2. 2

   The tabs

   Overview, Inventory, Security, Monitoring, Activity, Policy, Tickets, Integrations, Files and Alerts, in that order. Files is only there for someone who has been granted the file browser permission.

3. 3

   Live Vitals

   CPU, Memory and Network, plus Disk when the device reports one, from the agent's latest sample. The tiles open on the last hour. Click any tile to pick Last hour, Last 6h, Last 24h or Last 7d, and all the tiles switch together. The same pop-up has an Open Monitoring link for the full history on the Monitoring tab.

4. 4

   Health issues

   What has been flagged about the machine, in one read-only list. It reads No health issues. when nothing is wrong. Click the title or the arrow to fold the card; a folded card still shows how many issues there are, and the portal remembers your choice in this browser.

5. 5

   Device Information

   Hostname, Operating System, Processor, Device Type, Location, Assigned To, Role, Serial Number, Manufacturer, Model, Purchase Date, Warranty Expires, Last Seen, Backup Schedule and Agent version, with View more to open the rest. A warranty line shows what Dell, Lenovo or HP say about the machine, or says that warranty lookup is not connected. The Remote control row reads On with a Disable button, Disabled with an Enable button, or Off (device not approved).

6. 6

   Owner

   Who the machine belongs to. Under the person, Devices they own lists everything they own and marks this one This device. Set owner or Change owner picks the person, Remove owner clears it, and Confirm owner appears when the portal only suggested someone and you agree. A small label says how the owner was found: Unconfirmed, Owner via RMM login, Set manually or Confirmed. A Shared device (no owner) switch is there for a machine that has no single owner.

7. 7

   Notes, tags, lifecycle and files

   A collapsed section at the bottom of Overview. It holds Running actions, the read-only history of remote actions queued against the machine, the lifecycle controls for moving, replacing, merging or removing the record, Notes, Tags, Linked Assets and attachments.

8. 8

   The Security tab

   Encryption, LAPS, security baseline and device isolation for this device. Drives lists each volume with how full it is, the filesystem, whether it is encrypted, and the recovery key when there is one to show. Below it sit the LAPS card and the baseline card. A device with no enrolled agent says that encryption, LAPS and baseline have not been reported yet.

9. 9

   Isolation & trust

   The Quarantine row reads Not quarantined with a Quarantine button, or says the agent is refused on its next check-in with a Release button. The Telemetry row says whether CPU, memory and disk are being collected and has a Turn on or Turn off button. The Approval row says Pending approval, Approved, Automatic with a confidence percentage, or Approved by the person who did it.

10. 10

    Monitoring

    Pick 24 hours, 7 days or 30 days and every chart on the tab follows. CPU & Memory Trend, Disk Trend and Network Trend show the history behind the Live Vitals. Agent & Enrollment shows the agent version, the Update ring (Canary, Early or Stable), the Approval state, when the machine was Enrolled and its Last check-in.

11. 11

    Activity

    The story of this device, newest first. It mixes what people did to the device in the portal with what the agent and your other tools reported about it, and a badge on each event names its source: Portal, Agent, Sync or System. Search, or filter by type, severity, actor, source and date range. Press an event that has details to open them. Export CSV saves what your filters show. A page holds 50 events by default, and when the history is very long the tab shows the most recent events and says so, so narrow the date range to reach older ones. Below the list, a card shows this device's script runs, and recorded terminal sessions appear there too for someone who may view them.

12. 12

    The Policy tab

    Every RMM setting this device receives, and where each value comes from. The line at the top points you to RMM > Policies to change one. Each setting shows the value the device is running and a chip naming where it came from, so a setting that looks wrong can be traced to what set it. Default is the shipped default, and a chip naming a policy links into that policy's editor.

13. 13

    Hardware

    On the Inventory tab, Hardware is the first section on the left side bar and opens first: Secure Boot, graphics cards, memory modules and the monitors plugged in. Battery appears only where the agent reports a battery, so a desktop shows none.

14. 14

    Installed Software, Local Accounts and Patches / Hotfixes

    Each is a section on the Inventory tab's left side bar, with a count beside it, and the address keeps the section you picked. Installed Software lists the applications the agent found. Local Accounts lists the accounts on the machine. Patches / Hotfixes lists the Windows updates the agent found installed.

15. 15

    Third-Party Patching

    This section is on the same side bar and is only there for staff. Check for updates scans this machine for updates to managed applications. You can also search the catalog, pick an application and install it, with nobody at the desk. Only an entry that is turned on in the catalog can be installed.

16. 16

    Files

    Browse the machine's own folders, with controls to go up a level, refresh and Upload here. Every browse, download and upload is recorded in the audit log.

17. 17

    Alerts

    The monitoring alerts raised on this machine, filtered by status: Open, Acknowledged or Resolved. Each shows its severity, the condition that tripped, the value seen against the threshold and how long it has been open.

18. 18

    LAPS in a policy

    In a policy's LAPS section, Rotate local-admin password is Off, On or the shipped default. Turned on, and with the LAPS rotate command armed on the policy's Permissions tab, the account named in Local-admin account is rotated to a fresh random password on the schedule set by Rotation interval (days), and the account is created if it does not already exist. Rotation follows that schedule only.

19. 19

    Security Baseline in a policy

    A policy's baseline section watches and reports on a machine's real state without changing anything. It covers the screen-lock timeout with the longest timeout you will accept, the host firewall, real-time antivirus, the account lockout threshold with its maximum, and more. A device that does not match shows as drift.

20. 20

    The tray menu: scope

    The menu your managed devices show in the system-tray agent is set up under RMM, then Tray Menu. Its scope is the default for all devices, a company, a tag or a single device, and a device uses the most specific menu that applies to it: device, then tag, then company, then default.

21. 21

    Support door wording

    Support door name replaces Get Support on the desktop shortcut, the tray row and the installer checkbox for every device the menu covers. Form heading replaces the question at the top of the support form those devices open.

22. 22

    The About entry

    Its label, its icon and the panel's own text, with two rows of tokens you can drop in. Insert a placeholder token is filled in by the device itself. Insert a server token is filled in by the portal from your company's brand and support details when it delivers the menu.

23. 23

    Support email, phone and logo

    Left blank, the portal fills the company name, support email and support phone from your company settings and your helpdesk mailbox before the menu is delivered, and sends your logo with it. Fill them in here and the menu uses those instead.

24. 24

    Add item

    The menu can run a script, open an app, open a link, send an email, hold a submenu, show a text label or a divider, create a ticket, show About this device, or exit. Add one here once and every device the menu covers renders it.

25. 25

    Antivirus and EDR (Integrations tab)

    The first card on the Integrations tab, Antivirus and EDR, lists each security product installed on the device by name. Each row shows Status (On, Off or Unknown), Definitions (Up to date, Out of date or Unknown) and when it was last seen. The card shows what was already stored, so nothing is checked when you open the tab. It reads the products Windows reports, plus any antivirus tool connected to the portal for that device. An installed product that is off stays on the card with the words Installed, not running. Microsoft Defender is listed only when the device has no other antivirus installed, which is the same rule that stops the Defender alert for that device. A product Windows lists without a name the portal can show appears as Unnamed security product, and Windows Security on the device tells you which one it is. When nothing is listed, the card reads No antivirus reported yet - arrives with agent 1.8.3 for an agent before 1.8.3, no agent, or a version the portal cannot read. With agent 1.8.3 or later it reads No antivirus reported, because the agent did report and found none. ThreatLocker is application control, not antivirus, so it is never a row here and keeps its own card further down the tab.

Why it works this way: What the device page shows

Questions this page answers

Keep digging

• How to read the Network Map
• How to rotate local admin passwords automatically
• How to find the machines that need a person
• How to manage RMM policies beyond the basics