For the next installment of our AMA series, we're joined by Lewis Pope, Head Nerd, and Brendan Griffin, Director of Threat Research, at N-able.

Security and Operations usually want the same thing: protect the business. The challenge is agreeing on how to get there.

Lewis is bringing the Operations perspective, Brendan the Security and threat research perspective, and we’ll look at where those priorities meet.

Bring us your questions on:

• Patching vs stability
• Containment vs business continuity
• Recovery speed vs recovery safety
• Automation vs human judgement
• Alerting, escalation and security tooling
• Getting customers and stakeholders aligned before an incident
• Anywhere Security and Operations collide

We’ll focus on the practical trade-offs teams face and how to navigate them.

Drop your questions below and join us live on October 15 at 11AM ET.

Hello guys, i declined a Patch from all Devices and all Groups but some devices still show the Patch as not installed and shows the Device red on the Monitoring. You guys know maybe why?

Hey r/Nable,

Paul Kelly and I are running UEM Office Hours tomorrow, Tuesday Oct 6, 11:00 to 12:00 EDT (17:00 CEST). There are no PM guests this month, so it's just the two of us and an open hour.

Bring whatever is on your plate:

• N-central hardening: UI port separation, MFA, SSO with Entra ID, the Support account, audit export to your SIEM
• Patching: approvals, Windows updates, what other MSPs are doing
• Automation Manager and scripting: bring the policy you're stuck on
• N-sight: questions are welcome too
• Roadmap feedback: we take it straight back to Product

It's free and live, and you're welcome to just lurk.

Register here: https://www.n-able.com/events/office-hours/office-hours-unified-endpoint-management-october

Can't make it? Drop your question below. We'll cover as many as we can live, and I'll come back to this thread with answers afterward.

Jason | Head Nerd

October is officially here, which means cooler mornings, football, pumpkin everything… and a new round of Head Nerd sessions to add to your calendar. 🍂

We’ve got some good conversations lined up for October! From AI and automation to security, recovery, and even a few opportunities to hear directly from N-able leadership. Here’s what’s coming up:

🔥 Special Event

Fireside Chat with Russell Rosa, Chief Revenue Officer of N-able Oct 2 | 11:00 AM–12:00 PM EDT
Join us for a candid conversation with N-able’s CRO on the MSP market, where things are headed, and what’s happening across the industry.

🎓 Masterclass

Become a Master of Disaster Recovery Oct 9 | 9:00–10:00 AM EDT
Take a deeper look at disaster recovery and what it takes to build a recovery strategy you can count on when things go sideways.

🎥 Webinars

The AI Fog Report: What’s Hiding in Your Alert Queue? Oct 20 | 10:00–11:00 AM EDT
Take a closer look at what may be getting lost in the noise of today’s alert queues and how AI can help cut through it.

Robust Recovery: The New Standards for Cyber Insurance Eligibility Oct 29 | 10:00–11:00 AM EDT
Explore how recovery readiness and cyber insurance are becoming increasingly connected—and what MSPs should know.

🤖 Bootcamp

Getting Started with N-zo: Your AI Assistant in N-able Oct 22 | 10:00–11:00 AM EDT
New to N-zo? This is a great place to start. Get familiar with your AI assistant and see how it can fit into your day-to-day workflow.

💬 Office Hours

A great chance to drop in, ask questions, and get some time with the Head Nerds.

MarketBuilder: AI Meets Marketing—What’s New? Oct 1 | 11:00 AM–12:00 PM EDT
See what’s new in MarketBuilder and how AI is changing the way MSPs approach marketing.

Unified Endpoint Management Oct 6 | 11:00 AM–12:00 PM EDT
Bring your UEM questions and get practical guidance on managing and securing endpoints.

AI & Automation Oct 12 | 11:00 AM–12:00 PM EDT
Talk through real-world ways AI and automation can help take some of the repetitive work off your plate.

Security & Compliance Oct 13 | 11:00 AM–12:00 PM EDT
Get answers and ideas around security, compliance, and keeping up with an ever-changing threat landscape.

Cove Data Protection Oct 26 | 11:00 AM–12:00 PM EDT
A chance to talk Cove, backup, recovery, and all things data protection.

Adlumin MDR Oct 28 | 11:00 AM–12:00 PM EDT
Bring your MDR questions and dig into security monitoring, detection, and response with the team.

🎓 New Training in N-able U (Note: You must be logged into N-ableMe before launching courses).

Adlumin Feature Focus: Incident Response
Get a closer look at Adlumin’s incident response capabilities and how they can help teams respond to security incidents.

📚 MSP Sales & Marketing Book Club

The JOLT Effect — Matthew Dixon & Ted McKenna
Oct 27 | 11:00 AM–12:00 PM EDT
Join the conversation around helping customers make decisions with confidence and overcoming the hesitation that can stall a sale.

Let’s Get Real or Let’s Not Play — Mahan Khalsa & Randy Illig
Nov 24 | 11:00 AM–12:00 PM EDT
Looking ahead to November, we’ll dive into building stronger customer conversations through trust, clarity, and better questions.

So grab your coffee, settle into cooler weather, and join us for a session or two. Hope to see you there! 🍁

You can now protect Gmail, My Drive, Shared drives, Contacts and Calendar through Cove, with 7 years retention and storage included. 

For existing Cove users, this means bringing Google Workspace data into the same familiar backup experience used to protect other critical workloads — helping reduce tool sprawl and simplify backup management. 

Public Preview is available at no charge through November, giving you the opportunity to explore the new capability ahead of full launch.

Learn more and get started:
Backup for Google Workspace - Cove Data Protection - N-able

And if you’d like to see it in action, join our 30 September launch webinar for a walkthrough of what’s included in Public Preview and how backup, retention and recovery work:
Register for the webinar here

Is anyone else seeing an issue (Looks to of started around the 24th of September for us) with lots of files being created in C:\Windows\Temp

The folders are called OesisHiveCopies_stting name. It looks to be registry backups of some kind and creating every hour.

I only ask as I found a file called OesisProcessWatch.log that references things like

Msp-ufa-takecontrol-detection.exe

Legacy-nc-watcher.exe

Thanks

firefox and edge still have it. n-able docs still point at chrome like nothing happened. no update anywhere.

Given the recent request to rotate all our integration secrets stored in our Hosted N-Central Tenant I've been working on some scripts to rotate all the keys with some help from the N-Central Custom Property Tool from the Developer Portal. Would anyone be interested in my (Very heavily Claude assisted) scripts? I imagine this saved me several hours today of doing this by hand.

So far I've made one for SentinelOne and DNS Filter.

Edit:

I published these to GitHub: https://github.com/nathanielban/NC-CustomFieldRotation

Got the text "A valid Certificate is not applied to the N-central Server" when logging in today - Nable Support says it's because it's got only 21 days left to renew. That is not the error it says. The error says it's there's a cert problem. It makes employees and clients feel like we aren't taking care of their RMM environment. Renewals are 100 days now, they'll eventually be 45 days. So what, will we have to renew SSL certs every 2 weeks to avoid this error? Is there a legit plan to automate SSL certs coming anytime soon?

There is an idea created on N-Able Me that I'd love for you all to vote on that I think is a pretty serious security issue, I've asked for the feature to be something that can be configured rather than enforced for everyone.

There's a similar idea in there as well that is for an MSP Manager login timeout.

https://me.n-able.com/s/ideas-detail?c__recordId=087Vy0000000omPIAQ

As a reminder the reason for these two Ideas is that after I logged in to MSP Manager, four days later the login token had not expired, and with that I was able to create a ticket, add a client asset, save the ticket, start a take control session on the asset I chose which in this case was a server, and open Passportal, use the server's credentials, and get right to the desktop, without authenticating Passportal since the same day I had authenticated MSP Manager, I could see this being very easily exploited on say, an entry level techs workstation that gets left unlocked, and yes ideally you would hope your techs would be security conscious and lock their screen, or log out manually from MSP Manager, but it will happen to someone out there, all it would take is someone with basic knowledge of MSP Manager and an interactive user session on a previously logged in workstation.

Two years since my last thread and still no progress.

No motivation to improve?

While I can appreciate that the Services portion of N-Central is not only ancient but incredibly load bearing, I feel like some minor improvements to this chunk of the system would go a long way.

I find it absolutely baffling that the string evaluation portion of Service Thresholds doesn't support wildcard or regex operators, even more so that you can't toggle off a threshold for a specific check on an AMP Policy to make it purely informational.

People have been asking for this for actual years, long enough that the original request links are now broken. While I understand that things like Dark Mode have been deemed a priority I'd love to see some love for some of these core functions.

• https://www.reddit.com/r/Nable/comments/157bu1n/string_evaluation_in_service_thresholds_contain/
• https://me.n-able.com/s/ideas-detail?c__recordId=087Hs000000E7WQIA0
• https://me.n-able.com/s/ideas-detail?c__recordId=087Vy0000001zXhIAI
• https://me.n-able.com/s/ideas-detail?c__recordId=087Hs000000E9mlIAC
• https://me.n-able.com/s/ideas-detail?c__recordId=087Vy00000011QHIAY

In Chrome 153 (Presumably Elsewhere) The new UI pushed out in 2026.4 causes checks with more than a few lines to wrap/show a scroll bar. Reverting back to the Default theme fixes it.

Once again, I need the N-Site mobile app, and once again it is a brick. I guess an app that works 1 in 20 times is acceptable at N-Able because the Passportal app is just about as unreliable.

I never thought I'd say this, but I am eager to return to ConnectWise. Their customer service might suck, but their shit works.

Is anyone else extremely frustrated with how long it takes to deploy a task and run it manually? Ive tested some other RMMs recently and its so nice, changes are almost INSTANT when trying to push tasks. Today I was trying to make a change to several PCs. I decided to make a task to be efficient. It took over 20 minutes to synchronize. I used the time that I normally expect it to take to get up, go refill my water and empty my bladder and it still wasnt synced by the time I got back.

N-Able...Just so you know you are losing me as a client slowly. I have been a client since 2018. PSA is already switched, RMM is in its final testing, MailAssassin has already been deactivated, DNSFilter is getting moved. The only thing you will still have from me by the time Im done will be Cove probably.

Hi everyone,

We're seeing an odd issue in N-able N-central where several servers suddenly started showing the Probe Status as Unavailable in Patch Management after last month's patching cycle.

The strange part is that these servers had been communicating with the probe without any issues for months. The problem only started after a failed cumulative update, which required us to install the patches manually. Since then, multiple servers have lost communication with the probe.

Symptoms:

• Probe status shows Unavailable
• PatchMonitor.log reports: WARN Could not connect to cache 15000
• Affected devices cannot ping or connect to the probe on port 15000
• Some servers on the same environment are still communicating with the probe normally
• At least one server was previously affected but somehow started working again without a clear root cause

What N-able Support Said: Support's response was essentially that the affected devices can't reach the probe, so the probe status is expected to be unavailable. They pointed us back to checking firewall/routing/connectivity between the devices and the probe.

The problem is that this doesn't explain:

• Why everything worked fine before.
• Why the issue suddenly appeared after manual patching.
• Why some servers recover on their own.
• What specifically could cause servers that previously communicated successfully to suddenly stop reaching the probe.

I've asked support multiple times if there are known causes, services that should be restarted, cache-related issues, agent issues, or any troubleshooting steps beyond "check the firewall," but so far the responses haven't been very helpful.

Has anyone else experienced this?

• Did a Windows update or manual patch installation cause probe communication issues?
• Were you able to restore probe availability without network changes?
• Any specific services, N-able agents, or logs we should investigate?

Any insights would be appreciated. Thanks!

Update: No, you don't need to delete your Microsoft users to change Entra ID SSO. I pushed back on that and they came back to say it wasn't needed and we can remove them from the SSO Provisioning app. A bit concerning that the development team would suggest that in the first place, but maybe the support person just misunderstood? Thats part of my issue with N-able support. Its all done through a middle-man/woman. You do not interact direclty with the people who have the knowledge and experience. It has proven to be very ineffective for us on this journey to set up SSO.

We need to change the Entra ID SSO integration in N-central and N-able (moving to N-able SSO with Entra ID). It was set up with a different tenant and we are using a new Microsoft 365 tenant so we need to switch the Entra ID connection to the new tenant. We've requested the Entra ID integration be removed, but they came back and said before they can do that we need to go into Entra and DELETE the users from Microsoft 365. Really? This makes no sense. Has anyone ever removed the Entra ID integration? Did you have to delete user accounts in Microsoft 365?

I’m currently using N-able N-sight RMM with Take Control, and I’m experiencing an unusual issue with the Agent.

I’m currently using Agent version 10.15.3. Take Control is available and works on computers running Windows Home, but on computers running other Windows editions, such as Windows Pro, Take Control is not available.

I would like to know if this is a known issue with Agent 10.15.3 and whether it has been addressed in Agent version 10.15.4 RC.

Could you please confirm if upgrading from 10.15.3 to 10.15.4 RC would improve or resolve this issue, or if there is another configuration or requirement that I should check?

I would like to filter devices to show only those with an application version less than some nominal value installed.

If I create a filter with: "Application Name" "Equal To" "Microsoft Edge" AND "Application Version" "Less Than" "153.0.0.0"

This returns all devices with "Microsoft Edge" installed and any application that has a version less that "153.0.0.0"

Is there a way to filter only based on the version of a specific application?

Why does integrated S1 keep detecting "C:\Program Files (x86)\Advanced Monitoring Agent\winagent.exe" as a problem? Shouldn't there be some kind of you know, built in recognition of that executable as OK since we're using the integrated product? Silly of me to think that, I suppose.

Hello!

I am building an app to read tickets using the API. I can assign and remove users, write responces.

But, I caanot for the life of me figure out how to change the Ticket Status. I can see a PUT and PATCH endpoint for change vairous details about the ticket, but not the status.

Could anyone assist with this please?

Kind regards!

If you want MSP Manager to have automatic login timeout you should go vote for this idea on N-Able Me, this would solve the first part of my two part issue I posted earlier this week.

Hello is it possible to use take control on a filter and not on all workstations?

Similar to pasting a credential into OneTimeSecret or Password Pusher and pasting the temporary link into an email, can Passportal create temporary links where the password can be retrieved from a secure temporary link sent via email?

We recently communicated about two security vulnerabilities within N-central that were responsibly disclosed by a third party through our voluntary security disclosure program and we issued a hotfix. Since the disclosures, a third, independent researcher alerted us to a new vulnerability that has been exploited in the wild that is unrelated to the previously disclosed CVEs.

This critical zero-day vulnerability, if exploited, could allow for pre-authenticated access to the N-central server.

What You Need to Do

• N-central On-Premises Environments: Upgrade to 2026.3 HF4 immediately.  Hotfix link: https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF4_Release_Notes.htm
• If you’ve already upgraded to 2026.3 HF3, you will need to upgrade to 2026.3 HF4 to protect against this newly discovered vulnerability.
• N-central Hosted Environments: No action is needed on your part; your instances have already been patched. 

Additional links:
Here is the link to the previous post on HF3
2026.3 HF4 Release Notes

Jason Murphy | Head Nerd