Moorfox
What is RMM? (remote monitoring and management)
RMM stands for remote monitoring and management: software that puts an agent on every computer a team looks after, so you can watch and fix them from one dashboard. The agent reports health and inventory, raises alerts, and gives the technician remote desktop, a terminal and script execution without visiting the machine.
What an RMM actually does
An RMM does four things: inventory hardware and software, monitor for issues and send alerts, run remote desktop or terminal sessions, and automate patching and maintenance scripts. The agent connects outbound to the vendor's servers. This keeps machines behind home routers and client firewalls reachable without network changes.
Who uses one
MSPs run RMMs to manage many clients' machines at once. Internal IT teams use the same tooling for their own fleet. The alternative is per-machine remote access tools plus spreadsheets. That stops scaling somewhere around the second dozen machines.
How does the RMM agent work?
The agent is a small program installed as a service: a Windows service on Windows, a systemd service on Linux. It starts with the operating system and runs before anyone logs in, which is what makes unattended access possible. A technician can reach a machine nobody is sitting at, because the agent is already running in the background.
It runs with full system rights, LocalSystem on Windows and root on Linux, because installing patches and software needs them.
The agent keeps one outbound connection open to the RMM server and sends a regular check-in, called a heartbeat. When the check-ins stop, the machine shows as offline in the dashboard, which is why the offline alert is the first one every MSP sets up. Inventory and health data travel up the same connection, and commands travel down it: start a remote session, run this script, install these updates.
RMM vs remote desktop tools: what is the difference?
A remote access tool such as TeamViewer, AnyDesk or ScreenConnect connects a technician to one machine at a time, often with someone at the other end accepting the session. It is built for fixing one problem on one computer.
An RMM includes remote access, but it is built around the whole fleet. It watches every machine all the time, alerts you before the user calls, patches on a schedule and runs the same script on 200 machines at once. If you only need to fix machines when someone calls, remote access is enough. If you want to keep them healthy so nobody has to call, you need an RMM.
RMM vs MDM vs PSA
MDM (mobile device management), for example Microsoft Intune, pushes policy and configuration through the operating system's built-in management channel: compliance rules, app deployment, Wi-Fi profiles, BitLocker settings. It is good at making every laptop match a standard and poor at hands-on troubleshooting, with no live terminal, no remote desktop for an engineer and slow feedback when you change something.
An RMM is the hands-on tool. You get a live view, a live terminal, script output you can read straight away, and alerts within minutes. Plenty of MSPs run both, with MDM for policy and the RMM for daily work.
PSA is the business side of an MSP: tickets, time, contracts and billing. It has its own entry in this glossary.
Why is RMM software a security target, and what should you check?
An RMM has administrator access to every machine it manages, so a stolen technician login is a stolen fleet, and attackers know it. In July 2021 the REvil ransomware gang exploited Kaseya's VSA RMM to push ransomware through MSPs to their customers. In January 2023 CISA, the NSA and MS-ISAC published advisory AA23-025A, "Protecting Against Malicious Use of Remote Monitoring and Management Software", about scammers using legitimate remote management tools against their victims.
When you choose one, check four things: MFA on every technician account, per-user permissions so not everyone can reach every client, an audit log nobody can edit, and signed agent binaries that verify their own updates.
Moorfox is an RMM for Windows and Linux. Every technician account can use two-factor sign-in, permissions are set per user with a guest role for limited access, the activity log is append-only, and the installer and agent updates are code-signed and checksum-verified. It is free for up to 10 devices with every feature included, then $2 per device per month.
Related terms: PSA, patch management, EDR.
Frequently asked questions
What does RMM stand for?
RMM stands for remote monitoring and management: software that monitors and manages many computers remotely through an agent installed on each one.
Is RMM the same as remote desktop?
No. Remote desktop is one feature of an RMM. An RMM also monitors every machine continuously, alerts on problems, and patches and runs scripts across the fleet, while a remote desktop tool only connects you to one machine when you ask it to.
Do I need an RMM for a handful of computers?
Below about ten machines, a remote access tool and good habits can be enough. Once you are patching, checking disks and answering "is it down?" for more machines than you can keep in your head, an RMM pays for itself in time. Several RMMs, Moorfox included, are free at that size.
What is the difference between RMM and MDM?
MDM pushes configuration and compliance policy through the operating system's management channel. An RMM gives a technician live, hands-on control plus monitoring and scripting. Many MSPs use both.