The agent
The RabbitRMM agent
One Windows service per machine. It reports, patches, runs scripts, carries remote sessions and, on the machine you choose, collects the network. It only ever connects out.
Requirements
- Windows 10, Windows 11, or Windows Server 2016 and later, 64-bit.
- Outbound HTTPS (TCP 443) to
app.rabbitrmm.com. No inbound ports, no VPN. - Local administrator rights to install. The service runs as LocalSystem.
Installing
Create an enrollment token from Devices > Add devices > Enroll device, pick the client, and choose the format that suits your tooling:
| Format | Use it with |
|---|---|
| PowerShell | A one-line command to paste into an elevated PowerShell window on Windows 10, 11 or Server 2019 and later. |
| PS (2016 and earlier) | The same, for older PowerShell versions on Windows Server 2016. |
| EXE | Run interactively or from a deployment tool with the token as an argument. |
| MSI | Group Policy, Intune or another RMM. Pass the token as a property. |
Tokens tie a machine to a client and can expire or be limited to a number of devices.
What runs on the machine
| Item | Detail |
|---|---|
| Service | RabbitRMM Agent (service name PatchManagerAgent) |
| Program files | C:\Program Files\PatchManager Agent\ |
| Data | C:\ProgramData\PatchManager\ and C:\ProgramData\RabbitRMM\ |
| Tray app | Runs in each user's session: the support button, reboot prompts and the remote-session banner. |
| Check-in | Every few minutes, plus a persistent connection for instant commands and remote sessions. |
Antivirus and EDR
The agent and tray app are Authenticode-signed. Most products trust them as they are. If yours quarantines the agent or blocks its updates, add an exclusion for the program folder and allow the signed publisher rather than a file hash, because the hash changes with every release.
Updates
The agent updates itself from RabbitRMM when a new version is released. It checks the update's signature against the pinned publisher and its hash before installing, keeps a backup, and rolls back automatically if the new version does not start. A version that fails is not retried straight away.
When RabbitRMM moves to a new address, agents learn it on their next check-in, confirm the new address answers as the same service, then switch over, falling back if they cannot reach it.
The tray app
- Get support opens a short form; the ticket goes to your PSA with the device details attached.
- Reboot prompts let users postpone a patch reboot within the limits you set.
- Remote sessions: in privacy mode the user approves each session, and a banner names the technician while connected.
- The tray carries your branding: name, icon and colours from Settings > Branding.
Being the network collector
Any agent can be its client's collector. It then sweeps subnets, polls SNMP, receives syslog on UDP 514 and flows on UDP 2055 (NetFlow and IPFIX) and 6343 (sFlow), and reaches switches and firewalls over SSH for config backups. Allow those ports to the collector from your network gear if a local firewall is in the way.
Uninstalling
Delete the device in RabbitRMM (it needs the delete permission and typing DELETE to confirm). The next time the agent checks in it is refused and uninstalls itself. You can also remove RabbitRMM Agent from Apps & features on the machine.