Windows-first. Mac and Linux too.

Windows RMM,
really freakin'
fast.

Windows is full of surfaces that punish the admin - GPO, patching, dsregcmd, silent installs. RFF wraps each one in something you can actually read, and tells the truth about the edges. Deploy, monitor, remediate and remote-control your Windows, Mac and Linux machines from one fast console.

Start free → Try the live demo
✓ No credit card ✓ Deploy in 8 min ✓ Cancel anytime
How RFF moves bits
Outbound 443 only →
Windows, macOS and Linux agents 3 OSes
Agent or agentless reach both
Packages cached at edge (R2) CDN
Parallel pull, not push ∥
Windows run-as: user, SYSTEM, or creds 3 modes
Once enrolled: No SMB, RPC or SSH · No inbound holes · No VPN
Free pilot · benchmark it on your own fleet
Built by Brian Vitko - solo founder, longtime Windows sysadmin. Bring a real fleet and kick the tires - early customers get me on the other end: direct support and a real say in what gets built next.
RFF Deployment Jobs list showing jobs with their source, status and target counts. A Patch Tuesday policy run reads PartialSuccess with 8 of 9 targets complete.
Every job, what fired it, and how far it got. That Patch Tuesday run stopped at 8 of 9, so there's one box left to chase.
RFF macOS Profiles page: three saved configuration profiles with how many Macs have each version installed, and templates for a CIS Level 1 baseline, Microsoft 365 and a shared or kiosk Mac.
Configuration profiles for your Macs, built from a template or 31 settings areas. Each one shows which Macs have this version, an older one, or none.
Free, no account

Look up a CVE and get the fix, not just the score.

Most catalogs tell you a CVE is critical and stop. For Windows, ours also carries the update that fixes it and the build revision that actually carries the fix - the part that decides whether you're patched.

What's the silent switch?

Drop any Windows installer into SwitchHunt. It reads the file in your browser (nothing is uploaded), names the engine, and gives you install, uninstall and repair commands.

Open SwitchHunt → All free tools
Why it's fast

Three architectural choices. That's it.

Most RMMs were built when "the cloud" meant a VM in someone else's basement. RFF was built in 2026. The difference shows up in three places.

01

Parallel by default, not by exception

Most tools deploy serially or in tiny "batches of 5" because the underlying transport (SMB, PSExec, WinRM) opens a session per machine and chokes on handshakes. RFF agents pull work over outbound 443 - every endpoint self-fetches in parallel. 500 machines start together; they finish together.

02

Packages live at the CDN edge

Your MSI doesn't get copied 500 times from your repository server. It gets uploaded once to R2, cached at Cloudflare's edge near each endpoint, and pulled from there. A 250MB installer landing on 500 endpoints saturates the edge, not your office's upload pipe.

03

Agentless when you need it, agent when you don't

Most cloud RMMs are agent-only - every host needs a service installed before it can be touched. RFF can also reach machines agentlessly (SMB + WMI) for one-off pushes or onboarding the next 300 endpoints without a rollout. Install the agent when you want speed; don't when you don't.

How it works

Three steps. Then go do something else.

The agent does the heavy lifting over 443. You point and click. Or write a cron string. Whatever you're into.

01

Install the agent

A signed agent for Windows, Mac and Linux. Communicates over 443. Auto-updates. Done in eight minutes across your fleet.

→ one-line install from /devices
02

Point at machines

Dynamic groups - by OS, installed software, last seen, or AD OU - or plain manual selection. "Machines WITHOUT Chrome" recomputes itself every run.

group: Machines WITHOUT Chrome
03

Hit deploy

Run as SYSTEM, current user, or specific creds. Stagger by N machines. Schedule it. Walk away.

parallelism: 50 · timeout: 300s
The good stuff

Features the big guys can't be bothered to ship.

Built by an admin who got tired of writing PowerShell wrappers around their RMM.

Run as current user

Need a deploy that respects HKCU and the user's mapped drives? Cool. RFF actually does that. Most don't.

Staggered patching

Patch Tuesday in rings: pilot 10%, soak, health-gate - then the fleet. A bad ring auto-halts before it spreads. Saved-bacon mode.

Human-readable scheduling

"Every Tuesday and Thursday at 2:30 AM" instead of `30 2 * * 2,4`. Cron picker for the brave.

Dynamic groups

Target "Machines WITHOUT Chrome" and the group recomputes every run. Compliant machines exit automatically.

Run-as-SYSTEM (still)

Yes, RFF can also run as SYSTEM. We're flexible like that.

PowerShell, MSI, EXE, anything

Drop a script, drop a package, drop a one-liner. RFF doesn't care. It just runs.

Role-based access

Start with admin, operator or viewer, then build your own: a base role minus the privileges you don't want it to have, like revealing a BitLocker key or taking a screen. Role changes are admin-only and audited.

Monitoring that tells you

Recurring health checks on a schedule: a service up or down, disk free under a threshold, Defender healthy, reboot pending, a process running, a registry value, an event-log match, a script's exit code, EDR alive. A failing check opens an alert and routes it by email or webhook. "Service not installed" isn't a failure by default, so you don't drown in noise.

Checks that fix themselves

A check can self-heal: "always keep the spooler running" restarts it the moment it's found stopped. Need more than a restart? A workflow runs a sequence - PowerShell, service control, whatever - on the device that failed, with a cooldown and an attempt cap so it never thrashes.

Fix it without taking the screen

Sometimes you don't need the desktop. Live Manager is Task Manager in the browser - processes, services, and shared folders for any device, sortable, with service control. Open a background SYSTEM shell (admin-only, transcript kept), browse and edit the registry, or browse, download, and upload files. All remote, none of it interrupting whoever's working.

Drive mappings, the GPO way

GPP-style network drive maps, reconciled in the user's real session and targetable by device group or by user / AD security group. The one thing Intune made harder than Group Policy did - mapped drives - back to simple.

Conformance + CIS baselines

Capture a golden box or seed a CIS-aligned baseline, edit it as a versioned desired-state document, and RFF flags every machine that drifts - in plain English, down to which GPO set each value. Detect, enforce (approval-gated), or fix and roll back in a click.

How Conformance works →

Brick-safe Secure Boot cert rollout

Microsoft's 2023 Secure Boot certs (KB5068202) can leave a box unbootable if you rush them. RFF rolls them in rings with a soak and a brick canary: a machine that goes dark after the cert write halts the whole rollout on the spot, before the next ring fires. Off until you opt in - the dangerous button comes with a guard.

Compliance dashboard

EOL Windows, missing AV/EDR, expiring certs, unlocked screens, BitLocker encryption state - fleet posture on one screen, with the thresholds you set. Click any number through to the exact machines.

Compliance report in one click

Export the fleet compliance report to PDF or CSV for the auditor who asked. No screenshotting dashboards at quarter-end.

Scan, fix, re-check

NVD + CISA KEV matched daily against your inventory, then deploy the fix and re-scan until it clears. Can't patch it yet? Suppress with a reason and an expiry.

Shadow-AI visibility

Free

See every AI tool, local model, and browser extension on your fleet - including the local runners (Ollama, LM Studio) your network tools structurally can't. Content-blind: identity and metadata only, never a prompt. Detection, sanctioning and removal are on every plan, Free included.

Shadow-AI, in depth →

Self Service, JAMF-style

Free

Publish apps to a catalog in your users' system tray - they install without a ticket, and RFF deploys it as a normal audited job with install-state read from real inventory. A native tray app, not a web portal, branded with your name, logo, and colors so it reads as YOUR IT.

Meet the Companion →

"Why is this machine slow?"

Free

One click samples the box for 60 seconds and answers in plain English: disk-bound, memory-starved, CPU, or network - and which process is doing it ("it's the Defender scan"). The agent also keeps 14 days of minute-by-minute history on the machine - never uploaded - so you can ask "why WAS it slow this morning" hours after the ticket. Free on every plan.

True multi-tenancy for MSPs

Each client is a hard-walled tenant - database-level isolation, not a device-group folder. Switch between clients from one login, pool endpoint licensing across them, and brand each client's end-user surfaces with their own logo and colors (MSP).

RFF Health triage showing three cards: Chronically slow, Crash-looping and Slow to boot. One names fin-ws-011 as averaging 82% CPU for 3.4 hours, with Chrome as the culprit.
fin-ws-011 averaged 82% CPU for 3.4 hours, and Chrome did it. That's the whole finding, on one line.
See the full feature list →
Remote desktop Beta

When you just need to be on the box.

Live, attended remote control of a Windows, Mac or Linux machine - right in the browser. Their screen, your mouse and keyboard. No VPN, no jump box, no inbound holes. The boring feature every fleet eventually needs, built the way the rest of RFF is.

Attended control

See the screen. Take the keyboard.

Drive the signed-in user's desktop in smooth H.264 video - not a JPEG slideshow - across every monitor. Move files both ways, push your clipboard over, send Ctrl+Alt+Del or Alt+Tab. Or flip to view-only and just watch over their shoulder.

No one home?

Drive the login screen itself.

Nobody signed in is the case most tools give up on. RFF can reach the real Windows logon screen as SYSTEM and sign in for you - so a box sitting at the login prompt before anyone's at their desk isn't a dead end. Opt-in, per tenant. On a Mac, unattended access reaches the lock screen and unlocks it; the login window is coming.

Outbound only

Same 443. No new attack surface.

The agent reaches out for the session over the same outbound HTTPS it already uses for deploys. Nothing new starts listening on the endpoint - no port to forward, no VPN to stand up, no inbound hole to explain to your security team.

Consent + audit

The user sees you. So does the log.

Attended sessions show the user a consent prompt, then a persistent "you're being controlled" banner with a panic key to cut it instantly. Every session is written to the audit trail - who connected, which machine, how long. Unattended access stays off until an admin turns it on.

Attended control is free on every plan, and so are unattended (nobody signed in) and driving UAC-elevated windows - both stay off until an admin opts the tenant in. Free caps scale, not capability: 2 hours a month and one session at a time. In beta while we harden the transport for the most locked-down corporate networks.

How we drive the login screen →
Trust & security

We're asking for the keys. Here's the lock.

Stored credentials, MFA secrets, and privileged actions across every machine - that's real power to hand a young product. We don't take it lightly, and we don't hide how it works.

At rest

Encrypted - keys and all

Credential passwords and MFA secrets are encrypted at rest. The key ring that protects them is itself encrypted, wrapped in an X.509 certificate - so a leaked database backup doesn't hand anyone your credentials.

Fail-closed

Refuses to boot unprotected

If that key-wrapping certificate isn't in place, RFF won't start in production rather than quietly fall back to plaintext keys. Protection you can accidentally turn off isn't protection.

Isolation

Tenants split by the database itself

Tenant isolation is enforced with PostgreSQL row-level security on every tenant table - the database refuses to return another client's rows even if application code gets it wrong. Not merely hidden in the UI.

RFF Compliance dashboard showing an 89 percent posture score over 13 devices, with controls mapped to CIS and HIPAA references. Several controls report unknown counts rather than passes.
Mapped to CIS and HIPAA, exports to PDF or CSV. Where it says 13 unknown, we couldn't evaluate those boxes, so they don't get scored as passes.

Plus a full audit trail of every privileged action, TLS end to end, and outbound-only agents that open no inbound holes - with a straight account of what we do and don't claim.

Read how we secure it →
Pricing

Priced for real IT teams.

Every plan has every feature (multi-client separation is the MSP plan). The price only goes up with the number of endpoints you manage. The prices are on this page, there's no sales call, and you pay month to month.

Free
$0 forever
Up to 100 endpoints
Start free
  • ✓ Every RFF feature - deploy, patch, monitor, alert, remediate, remote
  • ✓ Capped at 100 machines - that is the only catch
  • ✓ 5 GB package storage
  • ✓ Your branding on the end-user surfaces
  • ✓ Remote desktop up to 2 h / month
  • ✓ REST API - 60 req/min
  • ✓ Single tenant, multiple users
  • ✓ Email support - the founder answers
Recommended
Starter
$149 /mo
100 included, then $2.00/endpoint
Start 14-day trial
  • ✓ No endpoint cap - Free stops at 100 machines, this does not
  • ✓ $2.00/endpoint above the first 100
  • ✓ 500 GB package storage - 100x Free
  • ✓ Unlimited remote desktop - Free gives 2 h/month
  • ✓ REST API - 120 req/min, double Free
  • ✓ Still one organization - see MSP for client separation
  • ✓ Email support
MSP
$1.75 /endpoint/mo
+ $149 base · 150 endpoint minimum ($411.50/mo)
Start 14-day trial
  • ✓ Everything in Starter
  • ✓ $149 base + $1.75/endpoint - volume rate
  • ✓ Multi-tenant separation (partner console + Sites)
  • ✓ Per-client branding, not just your own
  • ✓ Unlimited package storage
  • ✓ REST API - 600 req/min
  • ✓ Quarterly billing available - ask us
Estimate your exact price by endpoint count →
How we differ: PDQ Deploy - on-prem only, no cloud · PDQ Connect - cloud, agent-only · NinjaOne - full RMM, with backup, MDM and docs as paid add-ons · Action1 - cloud, agent-only · Intune - Entra-bound, no per-host credentials · see all comparisons
FAQ

The questions you were about to ask.

How is RFF different from NinjaOne or Action1?
They're broad cross-platform platforms, and good ones. RFF goes deepest on Windows: deploy, patch, and remote actions, plus readable Group Policy baselines with drift detection and a JAMF-style self-service catalog your users install from. Macs and Linux machines run in the same console too, new in October 2026. Published pricing, no sales call, free for 100 endpoints. If your fleet is mostly Macs or you need MDM, they're the safer pick.
Can I see it without installing anything?
Yes - there's a live read-only demo at app.getrff.com/demo. No signup, no email: it drops you straight into a synthetic 12-device fleet with real data on every page. The fastest way to answer "does RFF do X?" is to go look.
Why 443 only? My security team will ask.
Once the agent's installed, it's outbound HTTPS only - no SMB, no RPC, no inbound holes. Same posture as Slack or Zoom; your firewall won't even notice. (Agentless one-off pushes do use SMB + WMI on your LAN - same primitives as PsExec - but the agent is the steady state.)
Does it really run as the current user?
Yes. Real desktop session, real HKCU, real mapped drives. We use a session-broker pattern that most RMMs don't bother with. It's why this exists.
Can I remote into a machine to fix it?
Yes - Remote Desktop (beta) gives you live, attended control of the signed-in user's desktop right in the browser: their screen, your mouse and keyboard, smooth H.264 video, two-way clipboard and file transfer. Nobody logged in? Drive the actual Windows logon screen as SYSTEM and sign in yourself. On a Mac it works in a signed-in session and at the lock screen (the login window is coming), and on Linux it works on GNOME, KDE and X11 desktops with someone signed in. Unattended and UAC-elevated control are on every plan including Free - both stay OFF until an admin opts the tenant in, because they're the two capabilities worth a deliberate decision. It rides the same outbound 443 as the agent - no VPN, no inbound ports - with a user consent prompt and a full audit trail. What Free caps is scale, not capability: 2 hours of remote desktop a month and one session at a time. Behind a TLS-inspecting proxy it keeps working: point the agent at your proxy and, if your inspection CA was never pushed to the machine store, at a PEM bundle, and it validates against that.
I'm an MSP - can I manage multiple clients?
Yes, properly: each client gets its own hard-walled tenant - database-level row isolation, separate users and data - and you switch between them from one login. Endpoint licensing pools across your clients, and on MSP you can brand the end-user surfaces (self-service catalog, notification dialogs) with each client's own logo and colors - your OWN branding is free on every tier.
What does "self-service" mean here?
A JAMF-style catalog in your users' system tray. You publish approved apps - library packages or your own - and users install them without filing a ticket. RFF runs it as a normal audited job, with install state read from real inventory rather than wishful thinking. It's on every plan including Free, and so is branding it with your own logo, name and colors.
What exactly does the agent install?
Three signed, outbound-only components. The agent itself - a Windows service running as SYSTEM that does the work and talks outbound HTTPS (443) only, with nothing listening inbound. A small updater service that self-swaps the agent on its next check-in when you publish a new version (auto-update is opt-in on paid plans, so your fleet stays pinned until you say go). And a remote-desktop helper that runs only during an attended remote session - it launches in the signed-in user's context to relay the screen, then exits. One-line install from the Devices page; agentless SMB + WMI reach covers machines you haven't enrolled yet. On a Mac the agent is a launchd daemon notarized by Apple, plus the RFF Remote helper for remote desktop; on Linux it's a systemd service. Both install with one line, talk outbound 443 only, and update themselves.
What about macOS, Linux, phones?
Yes for Macs and Linux, since October 2026. Each has its own signed agent in the same console, with jobs, checks, patching and remote tools. Group Policy baselines and imaging stay Windows only. RFF isn't an MDM, so for phones and tablets use Intune or JAMF; they're the right tools for that job.
What happens after the 14-day trial?
Paid plans take a card at checkout, and the first charge is on day 15. Cancel before then and you pay nothing: your account drops to the Free tier with every feature intact, for up to 100 endpoints. The honest caps: 100 machines, 5 GB of package storage, and 2 hours a month of remote desktop. No feature gets locked - you'd only lose any endpoints over the 100-machine cap. No awkward sales call either way.
Your agent is exactly what ransomware crews abuse. Why should I trust it?
Because that's the right question to ask, and the honest framing is that any RMM agent is remote code execution you're choosing to install. RMM abuse is up sharply year over year and security tools mostly don't flag it, because the software is legitimate. So the design assumes someone will try. Everything is outbound-only with nothing listening inbound. Every component is signed, from a hardware token with a PIN, with no build server holding the key. Every privileged action is audited per session and per command with the operator's name on it. Remote desktop shows the user a consent prompt and a banner for the whole session, and there's a panic key. Unattended and UAC-elevated control ship OFF and need an admin to deliberately opt the tenant in. And one toggle halts dispatch across your entire fleet if something looks wrong. None of that makes abuse impossible, but all of it makes abuse noisy and attributable to a name.
You're a one-person company. What if you get hit by a bus?
Then you'd want the commitment in writing rather than a reassurance, so it's on the security page: if RFF ever winds down, you get at least 90 days' notice and a data-export window before anything turns off. Your inventory, compliance and vulnerability data already exports to CSV any day of the week, and the read API serves your fleet data to anything you point at it. Your agents keep running on your machines regardless - nothing about a workstation's day depends on me being alive. And the honest part: RFF is pre-revenue and self-funded, so there's no investor clock forcing a sale or a shutdown. It's also still one person, and if that's too much risk for your shop, I get it.
What if your service goes down, or a machine is offline?
The machine carries on. The agent does its work locally and only needs us to receive new instructions, so an offline laptop keeps running what it already had. Results buffer on disk and flush when it reconnects, so you don't lose the record of what happened while it was gone, and a job queued for a machine that's asleep runs when it next checks in. Nothing about a workstation's day-to-day depends on reaching our servers.
How long until I am actually running?
Minutes for the first machine. Sign up, copy the one-line install from the Devices page, run it, and that machine shows up with full inventory on its first check-in. For the rest of the fleet you don't need to touch each box: RFF can push the agent over SMB to machines that aren't enrolled yet, the same primitives as PsExec. There's no onboarding call to schedule, no implementation fee, and no sales engineer to wait on.
Not ready for an RMM? The free tools work without an account.
Ready?

Stop scheduling deploys
around your week.

Free for 100 endpoints, forever. No card. No call. Install the agent, push some software, see for yourself.

Start free → Book a 15-min demo