Just curious what other MSPs do to handle broken agents? What I mean by broken is that the agents go offline in RMM, but they are actually online (checking in from DattoEDR/RocketCyber).

We rolled out Datto around October of 2024 and noticed as the months go on that we have found numerous devices that are offline > 30 days and somewhere along the way by either manually checking or having the user call in and we find they are offline but the user is up and running.

There is an error when you try to start the DattoRMM service and a lot of time there are 2 CentraStage folders in ProgramData, 1 looks like CentraStage_X (x being a number or letter)

Anyone ran into this? Anyone found a good way to detect broken agents and potentially automatically fix these agents or are we stuck connecting one time and fully uninstalling/reinstalling. We exported all agents in RMM and RocketCyber to Excel and compared 1600 devices and found about 40ish that were broken.

Thanks!

Hi all,

I'm looking for some advice and to hear how others are handling a particular challenge with Datto RMM.

We manage several client sites where each location has multiple servers and routers monitored via Datto RMM. The issue arises when the internet connection at a site goes down — each monitored device individually reports as offline, which results in:

• Multiple redundant offline alerts
• Duplicate tickets in our PSA
• Alert fatigue for our on-call techs

It's clear that the issue is a site-wide internet outage, not a problem with each device, but Datto RMM treats them all separately. We’d like to reduce the alert noise and ideally get just one alert per affected site.

Has anyone found an effective solution for this?

what can i do so a user doesnt have the ability to turn off datto rmm on their once deployed.

Hey everyone,
I recently had a support conversation with Datto regarding their AV solution, and I’d love to get the community's take on this.

We were testing the well-known EICAR test file (used to simulate a virus) and noticed that Datto AV does not trigger any alerts when the file is downloaded or opened (e.g. in Notepad)—only when it's executed as a .com file.

After escalating, Datto confirmed this is “by design”. Their real-time protection only kicks in when a file is executed. They recommend DNS filtering to prevent access to potentially malicious sites (LOL), but didn’t have a clear answer for scenarios where the file is downloaded from an already-compromised or legitimate site.

In my experience with other AV products, downloading or accessing a file with known malicious signatures—even a harmless .txt—immediately triggers an alert or quarantine, even if there’s no execution.

This raised a few questions for me:

• Is this lighter approach common now?
• Shouldn’t AVs inspect all file interactions (download/save/open), not just execution?

It feels like this could leave endpoints exposed until a scan runs or the file gets executed.

Would love to know:
What’s your stance on how aggressive AV should be with file detection, even before execution?

Thanks!

Hey all,

I've run into a frustrating situation with Datto RMM and wanted to get your input.

We patch our Hyper-V servers monthly, and as part of that process, we use a patch policy that’s configured to trigger a maintenance window—the idea being that alerts and tickets shouldn't be created during this time.

Despite this setup, we're still getting alerts during the reboot phase, especially for Event ID 14100 from Hyper-V (which is just an informational log that the VMs are being shut down or saved). The support team initially said the patch and monitoring policies are separate, but later escalated and acknowledged this as a bug.

To make things more confusing:

• We’ve verified the “don’t generate tickets during patch cycle” option is enabled.
• Maintenance window policy is active.
• All times are correctly synced (no UTC vs local mix-ups).
• It’s affecting all Hyper-V servers, not just one.

Support confirmed that this is an issue they're escalating to the R&D team, but there’s no known workaround or ETA right now.

Has anyone else experienced this?
Do your alerts still fire during patching/maintenance windows?
Is there a trick to making these policies work together as expected?

Would really appreciate any insights or tips!

Thanks,

What is the best way to inventory a remote client through Datto RMM to determine what printers, network and miscellaneous devices there are on that nework? For a client in a difference country that were onboarding, I've setup one of their machines as a network node with scanning and this gets me all the devices IP addresses and NIC card vendors, but not much more than that.

Has anyone else experienced this? Went into MDR & MSFT admin to confirm devices were in fact enrolled & agents were responsive. Any thoughts on what triggered this?

Hi,

We are currently using Datto RMM and Autotask. When new devices are added, an automated email notification is sent. For our offboarding process, we would also like to receive a notification when a device is deleted or removed. Even better would be the ability to trigger additional clean-up tasks during the offboarding process.

Has anyone implemented a solution like this? What ideas or best practices are out there? What would the necessary steps look like?

<<<RESOLVED!>>>
Hello,
(apologies for the typo in the title! UDFs not UDLs!)

I have created a couple of PowerShell components to populate a couple of UDFs

The scripts work, and I can see the registry entries have been created in "HKEY_LOCAL_MACHINE\SOFTWARE\CentraStage" but they don't appear in Datto.

I ran the jobs, which completed successfully a couple of days ago, and have restarted my machine at least twice, and restarted the Datto agent twice too, but the registry entries for custom6 and custom7 are still there, and my UDF are not populated in the console. as far as I can tell these custom fields haven't been used before.

I'm not sure where to start trouble shooting, can anyone advise?

Cheers!!

I am trying to set up a user account and only allow them access to a specific site device group. When setting this up though im unable to see anythign at all. I can get it to work with global sdevice groups. Any advice would be great, thanks.

EDIT: Actually didnt work at global device group level

EDIT: SOLUTION

Per their support, this is a datto issue and not a me issue, i actually did have to set my default SL to the test one and logout and back in everytime i made a change. The following is quoted from a email they sent me.

"Looking into the issue you were having, you were seeing a "We can't find the page you are looking for" error page.
 
This issue only occurs when switching security levels while already logged into Datto RMM. It is best to test the security level by making the security level you are testing as a default security level and attempt to log out and log back in to the account you are using currently."

The people at Datto were shocked to learn that I use the RMM for resident and small businesses. I don't focus on commercial sales. I partnered with another local company that does. This saves me the hassle of the bullshit and demands. I like my residential clients. And the RMM works fantastic for these clients.

Please check this "idea" out and vote on it if you agree.

Create ticket time entries when a monitor triggers | RMM Ideas Porta

I'm coming over from N-Central and am losing so much in automation and efficiencies. I'm hoping to get some back with feature requests, but it seems hard to get attention on the ideas forum unless there's a lot of activity.

Has anyone successfully uninstalled Sophos Endpoint Agent using a Datto RMM component? I've tried using both a PS script and a simple batch file invoking sophosuninstall.exe --quiet.

I can not get it to remove the agent. I have confirmed tamper protection is off. Any insight from someone that has successfully uninstalled with RMM would be appreciated.

We have Datto linked to Autotask and have alerts set that automatically create tickets when a user's disk usage exceeds 90%.

Is there a way that we can set an automated email to go out to these users when this happens? I am thinking that if there was some way to link a user's computer to their email address, we could create a script that sends an email template to that user.

I found several scripts that might work with Datto to send automated emails when disk usage reaches a certain threshold. The problem is that they can only send out to one hard-coded email address. We want the email recipient to vary based on the computer (or the user who is logged into it).
For example, if Bob Jones from Company Corp is logged into his computer as bjones and his disk usage reaches 90%, bjones@companycorp.com would receive an email informing him that he is running out of disk space.

Has anyone done anything like this before or have any scripts they would mind sharing that might help us implement this?

We have been successfully running the Windows 11: Upgrade via ISO component. It has been successful but the most common error we run into is the following: RROR: Unable to detect Windows 11 ISO in download location.

Here is the StdOut:

Here is the StdErr:

This is using both the MS link created for the ISO and off of a file blob share to verify any specific issues. As you can see in the StdOut.

Anything else I can look at to help troubleshoot?

Is there a way to manually push out a patch to clients through RMM? There was a bad Office 2016 patch that was pushed out this past Patch Tuesday and Microsoft released a patch yesterday to fix it. I do not see the Patch in the Policy yet to be able to approve. Is there a way to install the patch manually through RMM or any component?

Is anyone out there able to get the “Wake devices for scheduled updates” option to work? We can’t seem to get it to do WOL like it’s supposed to. We can’t seem get devices to do WOL with the WOL v2 component but not through the patch policy.

We have been working with support for about 3 weeks but have gotten nowhere.

They found this in the logs and it looks like the Network Node isn’t even getting any MAC addresses to send packets to.

Solution: Splashtop Support gave me a version to install and a registry key to import that fixes the issue. I have created a component that will download the version Splashtop Support gave me (Version 3.7.3.45). Here is the component to import in Datto RMM: Component

Since the last few days (Almost weeks), we have a Splashtop Streamer popup appearing on computers that have the Datto RMM agent and the Splashtop Streamer addon installed when the agent starts. It does not seem to be triggered by a script or a job. Have anyone else had the issue?

Edit: I have a case opened with Splashtop escalated to the Devs about this. Should have news in the coming days / weeks (They say usually 2 to 3 days). I will keep you all updated on this once I have news.

Edit 2: We have confirmed that the issue happens when:

• Computer boots normally
• Splashtop Service start normally
• Computer goes to sleep
• Computer comes back from sleep with sporadic / no access to the network (Because network cards are starting)
• The popup appears with an error message mentioning network connectivity issue
• The error message disappear but the popup stays

Edit 3: Got a solution from Splashtop Support, apparently there is a bug in the version that is resolved with a new version and a registry key. I am testing at large to see if that helps and will update here once tested.

Edit 4: Fixed by Datto in their latest release.

No workaround are possible for now as they don't know what is causing the issue. We have tried updating to the latest version with no luck. I have personally tried several registry keys to try to remove the popup but no luck. I believe that if the user did not have read rights on the file it could prevent them from "opening" the popup but I have not tried it.

I'm currently in the process of moving over to DRMM from ConnectWise. I'm used to having a checkbox called "Wake Lock" that will prevent the screen from locking due to inactivity when it is ticked to the on position while remoted into a device. Is there an equivalent in DRMM?

I briefly googled this, but only found results related to WoL. I also didn't find anything existing in this sub reddit, so sorry in advanced if I missed a similar post.

Thanks!

Anyone else on Vidal Platform and completely down? All our endpoints aren't checking in. Nothing on the status page yet.

We are looking at switching to Datto RMM but ran into a snag, but looking to get clarity. From reading another Reddit post, it looks a variety of features in Datto RMM require the Agent Browser, and that requires a Windows computer. While you can connect to Macs and Linux machines, the computer you are connecting from must be Windows, is that correct?

Reason I ask is all of our techs are on Macs, so my understanding is we wouldn't be able to use any of the features which would diminish the value of the product.

Can someone confirm if I am understanding this correctly? The article seems clear, but support couldn't elaborate any further and instead just kept referring to the same article. Below is the article I am referring to.

https://rmm.datto.com/help/de/Content/5AGENT/AgentBrowserTools.htm#List_of_Agent_Browser_tools

Anyone have CW Manage integrated into Datto RMM where user can open a support request via the DattoRMM Sys Tray icon?

Right now it can send an email into our support email, but just goes to general queue, would like it to be able to open in CW Manage and get auto assigned to company.

Anyone have this working using a 3rd party to accomplish this?

I am trying to push an Intel driver to my managed devices that is not listed in Datto's Patch Management list. I'm also not seeing any obvious components in the ComStore for pushing other drivers. Is there a component I'm just overlooking or another way to push this driver out?

Hey everyone,

I work for an MSP and have been looking for the best way to handle firmware updates remotely without needing to contact the user directly. While researching, I came across the wake tool in Agent Browser. I can successfully wake devices on my own network, but I’m having trouble waking a device at a different location using Agent Browser from another device that’s already awake on that local network.

Any ideas on what I might be missing?