RMMZit

Install a self-hosted RMM and enroll the first computers

A step-by-step guide: from an empty VM to a running RMMZit console on your own server, with the first Windows and Linux computers reporting inventory, metrics and alerts — in about half an hour.

Published 31 October 2026 · applies to RMMZit 0.13

What you will set up

RMMZit is a free, open-source (AGPLv3) remote monitoring and management tool. One web console on your own server shows the inventory of every computer, watches it and raises alerts, and lets your technicians work on it remotely, run scripts and install updates. Nothing goes through a vendor's cloud: the server runs in your network, and the agents on the computers connect to it.

What you need

  • A server for the console: a small VM with 2 vCPU, 2–4 GB RAM and a 16 GB or larger disk, on VMware, Proxmox VE / KVM or Hyper-V — or an existing Debian 12+, Ubuntu 22.04+, AlmaLinux or Rocky Linux 9+ server, or a Docker host.
  • Windows computers to manage: Windows 10 / 11 or Windows Server 2016 and newer, 64-bit.
  • Linux computers to manage: any distribution with systemd, x86-64 or ARM64 (also Raspberry Pi).
  • An authenticator app on your phone (every account uses two-factor sign-in).

How it fits together

The server has two ports: the console (web interface and API, TCP 8443) and the agent endpoint (TCP 8444). The agents connect outbound to the agent port, so the managed computers need no open ports. When an agent enrolls, it pins the fingerprint of the server certificate; every command from the console is signed by the server and checked by the agent, and every action is written to a tamper-evident audit log.

The console controls every managed computer. By default it accepts connections only from private networks — keep it that way and open only the agent port where computers outside your network need it.

Step 1 — Install the server

All files are on the release page; the download page explains each way. The ready-made VM image is the fastest:

  • VMware ESXi / Workstation, VirtualBox: deploy rmmzit-appliance.ova.
  • Proxmox VE: create a VM without a disk (2 vCPU, 2–4 GB RAM, VirtIO network), copy rmmzit-appliance.qcow2 to the node and import it: 
    qm importdisk <vmid> rmmzit-appliance.qcow2 local-lvm
    Attach the disk as SCSI and make it the boot disk.
  • Hyper-V: unzip rmmzit-appliance-vhdx.zip and create a generation 1 VM with the VHDX as its disk.

Start the VM. Its screen shows the address of the console and the setup token. The appliance gets its address by DHCP; for a fixed address, the server name or the time zone, sign in on the VM's own screen as rzadmin (first password rmmzit, which must be changed) and use the setup menu.

On an existing Linux server, the install script does everything — PostgreSQL, the newest release with a signature check, a database with a random password and the service:

curl -fsSL https://github.com/Max-Zit/rmmzit/releases/latest/download/install.sh | sudo sh

On a Docker host, use the container image ghcr.io/max-zit/rmmzit with Docker Compose (docker-compose.yml and .env.example from the release), then docker compose up -d and docker compose exec rmmzit rmmzit-server -setup-token. There is also an appliance ISO for a new VM or a physical server, and deb/rpm packages for your own setup.

Step 2 — First sign-in

  1. Open https://<address>:8443. The browser warns once about the self-signed certificate; you can replace it later under Settings → Certificate.
  2. Enter the setup token and create the first administrator. The token works once; on a script install it is in /var/lib/rmmzit/setup-token.txt and in the server log (journalctl -u rmmzit-server).
  3. Set up two-factor sign-in with your authenticator app and keep the 10 recovery codes in a safe place.

If you ever lock yourself out of the console by its network allow-list, run rmmzit-server --reset-allowlist on the server (on the appliance: setup menu, item 5).

Step 3 — Check the agent address

Agents must reach the server by the address in their enrollment code. Under Settings → Network and access, check the agent address. For computers outside your network, open TCP 8444 on the firewall and set the public agent address, for example https://rmm.example.com:8444; the console port stays closed. If you opened the console on the server itself (localhost) and set no public agent address, the site page warns you — agents would otherwise try to connect to their own loopback address.

Step 4 — Customer, site and enrollment code

  1. Open Customers, add a customer (your own company counts as one) and add a site to it — an office or branch.
  2. On the site, click Create enrollment code. Choose how long it is valid (1–365 days) and how many computers may use it.
  3. Copy the code (RZ1-…). It contains the server address and the fingerprint of the server certificate, so the installer needs nothing else. It is shown only once; revoke it when it is no longer needed.

Step 5 — Install the agent on Windows

On the site page, click Download the agent (MSI, 64-bit). Double-click the MSI on the computer and paste the code, or install it silently from a script or a software deployment tool:

msiexec /i rmmzit-agent-x64.msi /qn ENROLLCODE="RZ1-…"

The agent runs as the Windows service RMMZit Agent. A small icon next to the clock shows whether it is connected (green) and who manages the computer. Within a minute the computer appears under Devices with its hardware, software, disks and security state.

For many computers, create a code with enough uses: the site page then shows a ready Group Policy startup script and the Intune settings (Win32 app, install behavior System, detection rule) filled in with that code.

The agent switches off the automatic installation of Windows Update by policy, so that updates arrive only from RMMZit — by hand or on your schedule. The previous settings come back when the agent is removed.

Step 6 — Install the agent on Linux

On the site page, download the Linux agent (x86-64, or ARM64 for Raspberry Pi and ARM servers), copy it to the machine and run as root:

chmod +x rmmzit-agent-linux-amd64
sudo ./rmmzit-agent-linux-amd64 install --code "RZ1-…"

It copies itself to /usr/local/bin/rmmzit-agent, enrolls and starts the systemd service rmmzit-agent.

What to do next

  • Alerts and updates: under Policies, the customer's policy Default sets alert rules, monitors and automatic Windows updates; the alert emails are under Settings → Monitoring and alerts.
  • Technicians: add them under Users, or connect Active Directory / LDAP or single sign-on.
  • Agent updates: the server carries the agent installers of its own version; Settings → Agent updates updates outdated agents at once or lets them update themselves.
  • Back up the server: back up the database together with /var/lib/rmmzit — its secret key decrypts the stored passwords, and its certificates identify the server to its agents.

See everything RMMZit does on the features page, or read the full documentation. Questions are welcome in GitHub Discussions; companies can get commercial support from MaxZit.