Devices that have stopped reporting to RMM
An RMM-managed endpoint that has stopped checking in is either offline, broken, or has fallen out of management — none of which a runbook should silently assume is fine.
Interpret the result in context
A missed check-in can reflect a powered-off device, a connectivity problem or a failed agent. The finding calls for investigation rather than assuming a security incident.
Configure the expectation.
Use this baseline as a starting point. You can also build your own controls and standards from integration data, with client-specific requirements and documented exceptions.
Must check in within (days)
How recently a managed endpoint must have checked in to RMM for it to count as active and monitored.
Review. Remediate. Verify.
Use one-click remediation where the integration and action support it, or the evidence to guide the technician’s next step.
- 01
Confirm the device owner, expected usage and last check-in.
- 02
Restore connectivity or repair the management agent as appropriate.
- 03
Verify a new check-in, or record the device’s retirement or approved exclusion.
A completed action is only part of the record. Refresh the supporting evidence to establish whether the finding has cleared.
Make your baseline part of every client review.
Connect checks, findings and remediation to the same client record.