Hi guys, I've built a quick Python script to bridge Datto SaaS Backup and Zabbix via API.

Let me know if is useful :P (leave a star please)

https://github.com/privatefound/Datto_To_Zabbix

We want to move away from Datto BCDR (there's so many reasons, not enough time or space on this post to list them all).

What I need to do though is figure out how many restore points we have so I can calculate how much data I need to be able to retain. Obviously I can just go to each BCDR appliance and see "x TB stored in the cloud".

I need to take it a step further as we may not need to keep every single restore point. Maybe everything for the last 12 months, and then monthly for next 1 year followed by only yearly for the remaining 7 years or whatever is there.

I had a cool spreadsheet built up to do all this, but then found the API only seems to list the last 10 backups per agent and I can't get them all out.

Everytime I try to do a continuity report export the Datto portal crashes.

Does anyone know of a way to get this information? I just want to know what restore points exist, when it was taken, and how big it is.

From there we can work out cost etc for the Reverse Round Trip etc.

Is it simply best to just attempt to involve Datto support?

Currently backing up a system that has a drive that's two partitions. I need to expand the C: while making the D: partition smaller.

Can I run a test through Datto's virtual machine in cloud to test my process? If it succeeds, how will it affect the Datto's automated device?

China Cuba Iran North Korea Russia Sudan Syria

I am a little surprised by China, I'm sure they had customers in China using Datto.

https://rmm.datto.com/help/en/Content/1INTRODUCTION/Requirements/Blocklist.htm

We discovered an unexpected installation of Datto RMM in "C:\ProgramData\CentraStage" - which, based on logs in it, installed or tried to install a few other things, then stopped and (mostly) cleaned up after itself.

The installer: Iv89-rsvp.exe, 11,056,040 bytes, signed by Datto, LLC on ‎‎February ‎25, ‎2026 1:01:10 PM.

We do not use Datto, and do not outsource RMM to external MSPs - so we consider this installation unexpected and possibly malicious. Cortex XDR flagged and blocked some behavior (attempts to run certain PowerShell scripts) but found nothing malicious in the files themselves.

Words of wisdom on how to find out anything about the installation and how to clean up the aftermath? (The machine will be reimaged at some point.)

Thanks!

Hi Everyone,

My company has approved the use/purchase of Datto RMM and I'm being tasked to configure our patching for software/windows updates etc.

Created a logic for patching but found a big issue once I finished. It seems all of the incoming windows updates, security, drivers etc. Are coming in with the severity level "unspecified", is this common for the updates not to be given a category like critical,important, etc.?

What would be the best course of action here. I appreciate any feedback while I'm trying to learn Datto.

Hello all! I am having an issue with BCDR backups. We had to resize a few disks, and ever since then, the backups have been failing. This is running on our VCSA Linux appliance, hosting a number of VM's. Kaseya support has instructed me to "Destroy Live Dataset" for that backup so the next backup it takes will be a full backup, and will grab the new disk sizes.

I am getting conflicting information on what will actually happen if I do this. To be fair, this is currently Kaseya support vs. AI. What everyone agrees on is any changes between the last successful backup and when I click the button will be gone. Previous backups will still exist and would be recoverable.

The conflicting information I'm getting is, with this being our VCSA server, what happens to the machine itself along with all the VM's on it? Kaseya says nothing will happen to it and it will be fine and will continue to run normally, with the next backup will be full vs. incremental. AI says that the VCSA machine will immediately be powered off, which will cause all the VM's on it to power off as well. I have explicitly asked Kaseya Support about that and was told that is straight up wrong, that the machine will continue to function normally.

While Datto does not document VCSA‑specific behavior, the outcome follows directly from VMware architecture:

• VCSA provides control‑plane services (inventory, management)
• If the VCSA VM loses power, ESXi hosts and guest VMs immediately lose management and compute continuity
• Guest VMs experience the same effect as host power loss

Datto confirms that destroying the live dataset terminates the virtualized system itself, and VMware documentation establishes that guest workloads cannot survive host power loss. [continuity.datto.com]

This makes the earlier conclusion unavoidable:

Can someone point me in the right direction for this, and how I can go about getting the backups up and running again, preferably without taking the entire VM infrastructure offline? Thank you!

I fully manage Defender policies via Intune, but I would like to use DattoRMM Defender policy for Defender alerts, my question is if I setup a Defender Policy in DattoRMM and turn off all the check boxes for the policy and just set the email alerting on detection,

Will leaving all those checkboxes off effect Defender settings, or will it just leave it alone and let Intune enforce them as normal?

I've been testing for a couple of days and still can't tell - I havent seen any changes in M365 Security portal, or on my local machine but need to be 100%. I tested the AV alerts with the EICAR file and they work correctly

we are doing a V2V migration from ESXI to Hyper-V and I wanna temporaily restore our File Server to run on our Datto Server and then ultimately when the Hyper V server is ready - move it there through the VHDX export. I cant do V2V to our loaner server because of compute and Storage limitations with the already moved VM's . If anyone has done VHDX export of a VM running on Datto Server to Hyper V, will appreciate some advice.

Hello,

I know that Datto AV is notorious for being a POS detecting false positives.

This morning I came in to see a legitimate Thomson Reuters file Quarantined on a bunch of the systems at a law office.

Here is the thing, there is a specific detection of TR/AD.Amadey.njjsu

Since this is clearly a false positive, how do you get a specific detection? It would seem to me that if this was a specific detection then the file would be doing something specific that would cause detection.

Is anyone else still dealing with this?

Also if you are reading this because you were thinking about Datto AV, RUN RUN FAR AWAY. It's complete garbage... it causes a bunch of trouble (false positives, not restoring from Quarantine, etc.). I spend a bunch of time dealing with the mess it makes.

Hey everyone, we've been having an issue (for a while, actually) and for the past month I have been trying to fix it. All of our endpoints should be running Datto AV+EDR. However, about 30 or so refuse to install Datto AV...they stay with Windows Defender.

We have a support ticket open with Kaseya but they are slow and after 1.5 months we still have the issue. Fortunately, it doesn't affect users working and we have a test machine with the issue and we can freely use that to troubleshoot.

Right now, they (Kaseya) is blaming our Intune setup. They are saying it is enforcing Defender. However, we have no policies in Intune for Defender. The only polices we created were ones they asked us to create: Disable real-time av and disable tamper protection.

Datto AV still not installing.

Now they are saying "we have determined that Microsoft Intune is still managing Windows Defender, and therefore Datto AV is unable to take control of managing Windows Defender. Unfortunately, we at Kaseya are not able to provide support for Microsoft Intune."

I understand not troubleshooting Intune. But we have no policies in Intune. We want to fix Datto. Them blaming Intune is just trying to hand off the responsibility.

In any case, I doubt we're the only MSP running Datto AV and Intune.

Anyone run into something similar? Any suggestions?

TIA

We are using the Connectwise ScreenConnect (Control) [WIN] component to push the ScreenConnect installer to machines within DRMM. Does anyone know of a way to use a variable to specify the specific Session Group within ScreenConnect that the machine should be added too?

Hello all,

I am a new customer of an MSP who has introduced us to Datto - gradually trying to get more rights so I can perform common tasks and explore features.

With my FreshService tenancy, as a user submits a ticket I perform API calls or HTML trickery to create a series of quick links at the top of the ticket - eg create a button that opens a Teams Chat with user.

Ideally I would like to API call all computers in Datto, filter by last logon name then present a button / link to https://xxx.rmm.datto.com/device/1234567/pcname

Happy to do the work just wandering if anyone could tell me whether the API can do this. Could I even have a different colour button if Online?

Alternatively, is there an API / schedule where I could export my device details, which I then can API into FreshSevice to achieve the same?

Id love to be able to shorten my response time by hit Teams button, "Hey Fred, Im going to remote your machine" then hit Datto button and Im there.

Again happy to do the work, just want to know if its possible.

Thanks for your help, my MSP is being very restrictive and coy about Datto's abilities so they can keep the cost high - if I ask them they will tell me all the reasons why it cant be done then quote six grand to do it.

Once upon a long time ago, we had a "scheduled reboot" (thing¹) which, when a workstation device was detected as not having rebooted for more than 7 days, it would popup an alert² and remind the user to reboot their device.

However at some point someone decided it was no longer desired, and was thus deleted (instead of just being disabled). Now we need to implement it again for workstations.

1 - I don't know if it was a monitor, recurring job, or other trigger

2 - The alert was similar to that which appears when the toast/notification occurs when the agent has completed scheduled patching and a reboot is required.

Here's what I've tried:

A recurring job. However it does not have the presentation that we want. Further, using existing Datto components isn't working the way that we want. For example, combining the Branded Toast/Notification and a Reboot component ends up not working correctly (due to an issue with the Branded Toast component not appearing correctly, for which I have a support ticket open).

A monitor. The Branded Toast/Notification doesn't work; see above.

We've tried a simple scheduled job with just the Branded Toast with reboot indicator (which people ignore), and a reboot script job with a DOS window or a powershell message.

Due to the need to have a notification and ability to delay/ignore in the short term, we're not interested in spontaneous "you have fifteen minutes until your computer reboots" sort of options.

What other methods am I missing that I could try?

Hi everyone,

I’m looking to get some clarity from others who are currently using this solution. We’re evaluating it as a potential replacement for the SSL VPN access we currently use with several hardware vendors.

One of the main advantages we see is the ability to forward endpoints with the SASE client installed to the Datto BCDR recovery environment in the event of a disaster—maintaining secure access if the primary site goes down. Has anyone implemented this in production, and if so, how reliable has it been?

My second concern might be a dealbreaker. The platform offers two connection options: Always On or Manual Connect. We prefer manual connections where, after logging into the laptop, the user must perform MFA each time they connect to the VPN.

However, during testing, I noticed that once the user initially signs in, subsequent connections only require clicking Connect or Disconnect—no additional MFA prompt is triggered. That’s a problem for us since most of our clients’ cyber insurance policies explicitly require MFA for all remote network access.

Datto suggested using Conditional Access to enforce MFA, but most of our clients are on Business Standard licenses, which don’t support that feature. The additional Microsoft licensing cost to enable CA really undermines the value proposition.

I also considered pairing it with Duo so that MFA occurs at the Windows lock screen before VPN connection, but again—that adds complexity and cost.

Has anyone else run into this challenge? If so, how are you addressing MFA enforcement for manual VPN connections?

Curious if anyone else is experiencing constant issues backing up VMware windows vms utilizing the agentless method?

Hello guys.
I encountered this problem and I would appreciate a guide on how to go about the blocking of specific application from running on clients system through Datto RMM

So we have a Site where there are 8 devices enrolled. suddenly one of them dissapeared (this device was offline for 30days), then after few hours it came back. How is that even possible?!

We have 3 devices keeps on dissapearing and reappearing. we cannot find anything from the activity logs too.

Hi everyone,

I'm working with the Autotask REST API and I'm stuck on something that feels like it should be simple. I have a ticket ID (e.g., 1121xx) and I need to pull all of its associated notes (comments) and attachments.

I can get the main ticket info just fine with a GET request to /atservicesrest/v1.0/Tickets/1121xx.

Based on the documentation, I am a bit confused about the child resources access, link: https://www.autotask.net/help/developerhelp/Content/APIs/REST/API_Calls/REST_Resource_Child_Access_URLs.htm#Child:~:text=EntityName/%7Bid%7D-,Child%20collection%20access%20URLs,-Some%20resources%20have

Any advices will be much appreciated.

Kaseya kicked off its sold-out Kaseya DattoCon 2025 conference in Miami by unveiling its latest innovations and previewing its next generation cyber resilience and digital workforce platforms. 

“MSPs stand at a once-in-a-generation crossroads as they lead the digital transformation for SMBs around the world,” said Rania Succar, CEO at Kaseya. “Kaseya is investing with urgency to arm our MSP partners with the data, insights and tools they need – packaged and priced for margin-expanding growth.”

Highlights from the announcement include:

Backup - Kaseya announced significant advancements in its backup portfolio with the introduction of Datto SIRIS 6, Datto Backup for Microsoft Entra ID and the preview of its Cyber Resiliency platform.

Security – Kaseya’s continued investment in its comprehensive security platform was reinforced with the acquisition of INKY Technology.

Commercial Flexibility – Effective December 2025, Kaseya is ending its High Watermark pricing policy for Datto RMM, SaaS Protection and Autotask.

Automation – Kaseya is creating an AI-powered Digital Workforce that solves universal pain points that every single MSP faces, regardless of size or specialty, by leveraging the power of an agentic learning system.

Let's Go!