What this guide covers
RMMZit is a free, open-source (AGPLv3) remote monitoring and management tool. Remote access is part of it: every computer with the RMMZit agent can be opened from the web console for a remote desktop session, a terminal or a file manager. Hosted remote support tools such as TeamViewer or AnyDesk run their service for you; with RMMZit you host it yourself — the console runs on your server, and the sessions go between your server and your agents.
What you need
- A running RMMZit server — see the installation guide if you do not have one yet.
- Computers with the RMMZit agent: Windows 10 / 11 or Windows Server 2016 and newer (64-bit), or Linux with systemd (x86-64 or ARM64).
- An account with the role Administrator or Technician. A technician sees only the customers they are allowed to manage.
- A current web browser. Nothing is installed on the technician's computer.
How a session reaches the computer
The server has two ports: the console (web interface and API, TCP 8443) and the agent endpoint (TCP 8444). The agents connect outbound to the agent port, so the managed computers need no open ports and no port forwarding. A remote session uses that same agent connection: everything goes through the agent's encrypted connection and is written to the audit log.
When an agent enrolls, it pins the fingerprint of the server certificate, so a fake server cannot take it over. Every command from the console is signed by the server and checked by the agent. For computers outside your network, open TCP 8444 on the firewall and set the public agent address under Settings → Network and access; the console port stays closed.
Start a remote desktop session
- Open Devices and click the computer (the search in the header, Ctrl+K, finds it by name, user, IP address and more).
- Click Remote desktop — on the device page, or in its own window. You see the screen and control it with mouse and keyboard.
The viewer has what support work needs:
- Keyboard: click the screen to type; keys go to the remote computer with its own keyboard layout. Send Ctrl+Alt+Del and Send text (types a text, for example a long password) are in the toolbar.
- Full screen: shortcuts such as Ctrl+W or the Windows key also go to the remote computer; hold Esc to leave full screen.
- Quality: Fast, Balanced or Sharp, depending on the connection.
- Monitors: choose one monitor or All monitors.
- Sign-in and UAC screens are shown and can be used, so you can sign in and confirm administrator prompts.
What the user on the other side sees
The session starts directly; the user is not asked to accept it. By default the person at the computer sees a bar at the top of the screen with your name while you are connected. You do not see the bar in the picture.
An administrator can switch the bar off under Settings → Remote desktop (Show a notice on the remote screen while a technician is connected). Every session is written to the audit log either way. The RMMZit security best practices recommend leaving it on, so users know when someone is connected.
Tell your users and customers how remote support works in your company — that a technician can connect and that the bar shows who it is. Whether you need more than that, such as a written agreement with the customer, depends on your contracts and local rules.
Clipboard and file copy
On Windows computers, copied text goes both ways with Ctrl+C and Ctrl+V. Files copied in your Explorer are pasted on the remote computer with Ctrl+V. Files copied on the remote computer are offered as a download (Download copied files), because a browser cannot put files on your clipboard. Copying files through the clipboard needs a signed-in user on the Windows computer.
The clipboard exchange can be switched off under Settings → Remote desktop.
Remote terminal: PowerShell and root shell
Terminal opens a shell of the device in the browser, without connecting to the screen — useful for servers and for quick fixes while the user keeps working.
- Linux: a root shell.
- Windows: Windows PowerShell running as SYSTEM on a pseudo console. It needs agent 0.12 or newer and Windows 10 1809 / Windows Server 2019 or later.
Click into the terminal to type; copy by selecting text, paste with Ctrl+Shift+V or Send text. Leaving the page ends the shell and every program it started. The start and the end of the session are written to the audit log.
For commands you run often, or on many computers at once, use Scripts instead: PowerShell, cmd, bash or sh, as SYSTEM or root, on one device, many devices or on a schedule, with the output kept for each run.
Files, processes, services, registry and tasks
Many support tasks need no screen at all. The device page has tabs for them:
- Files browses the drives of the computer: upload files (up to 4 GB), download files, download a folder or a selection as ZIP, create folders, rename and delete. The agent does every file operation as SYSTEM (Windows) or root (Linux).
- Processes lists running programs with their memory, threads and session and ends a process.
- Services lists Windows services or systemd units and starts, stops or restarts them. The RMMZit agent protects itself: it cannot be stopped or ended from the console.
- Registry (Windows, agents 0.12 and newer) opens a key by its path or from the roots HKLM, HKU, HKCR and HKCC; values and keys can be added, changed and deleted. The roots, the keys right below them and the system's own branches are protected. The users' registries are under HKU (by their SID).
- Scheduled tasks (Windows, agents 0.12 and newer) lists the tasks of the Task Scheduler; a task can be run, ended, enabled, disabled and deleted.
The power buttons on the device page restart or shut down the computer, now or after a delay, with an optional message to the signed-in user.
Who may connect, and what is logged
Every person signs in with their own account and two-factor sign-in. Roles decide what they may do:
- Administrator — everything, including users and settings (such as the notice and the clipboard switch); always sees all customers.
- Technician — manages the devices of the allowed customers: remote access, scripts, updates, programs, alerts.
- Read-only — only views the allowed customers; no remote access and no scripts.
Technicians and read-only users get access to all customers or only some. Accounts are added under Users, or come from Active Directory / LDAP or single sign-on.
The Audit log lists every change and every remote action with the user, the target and the address: remote desktop sessions, terminal sessions (start and end), every file operation with your name, every registry change with the value it replaced, every action on a scheduled task. The entries are hash-chained; the console checks the chain on every view and reports if an entry was changed or deleted. Customer reports list the technician work from the audit log — remote desktop and terminal sessions, scripts run and file operations.
Network and security notes
- Keep the console reachable only from your admin networks; for access from outside, use a VPN (for example WireGuard) instead of opening the console port.
- Open the agent port only where agents are, and set the agent networks if all agents come from known addresses.
- Give each person their own account with the smallest role and only the customers they need; disable accounts of people who leave.
- Use a certificate browsers trust (Let's Encrypt or your own CA) under Settings → Certificate.
- Leave the notice on the remote screen on, and check the audit log from time to time.
A terminal, a script or a file operation runs with full rights (SYSTEM or root). Whoever can sign in as a technician can change those computers — protect the accounts accordingly.
Limits
- Linux desktops: remote desktop works with X11 (Xorg). Wayland does not let a background service see or control the screen: sign in with an X11 session there, or use the terminal. Without a graphical desktop, use the terminal.
- Clipboard and file copy through the remote desktop work with Windows computers.
- Windows terminal: agent 0.12 or newer and Windows 10 1809 / Windows Server 2019 or later.
- Registry and scheduled tasks: Windows only, agents 0.12 and newer.
- Uploads in the file manager: up to 4 GB per file.
See everything RMMZit does on the features page, get it on the download page, or read the full documentation and the security page. To set up the server and the first agents, follow the installation guide. Questions are welcome in GitHub Discussions; companies can get commercial support from MaxZit.