RFF watches the machine now
RFF’s whole identity was one sentence: the really-fast way to push software to Windows machines. That’s the name. I got a remote deploy from 183 seconds down to 26 and wrote a whole post bragging about it, because being fast was the point.
So here’s the awkward thing to admit in an announcement post: a common question I got was some version of “okay, but can it watch the machine too?” Can it tell me a service died. Can it alert me before the disk fills. Can it just be the one tool instead of the fast tool that lives next to my real RMM.
I dodged that question for a while, and I want to be straight about why. RMM is where fast tools go to die. You start with a clean agent and a console that loads instantly, you bolt on monitoring and ticketing and a hundred dashboards, and three years later you’re the thing I was building RFF to get away from - slow, priced per endpoint like it’s made of gold, with a UI that needs a certification to operate. I did not want to become NinjaOne. I definitely did not want to become Kaseya.
Then I actually looked at what the RMM primitives are, underneath the marketing, and had the mildly deflating realization that most of them are not hard. They’re just work nobody wants to do carefully. And I’d already built the parts that are hard - the agent, the dispatch path, the remote plumbing, the tenant isolation. The monitoring layer was sitting on top of infrastructure that already existed.
So I built it. RFF is a full Windows RMM now. Here’s what shipped, and then the part I actually care about, which is why it didn’t turn into the bloat I was afraid of.
The primitives
Monitoring checks. Scheduled health checks that run on the endpoint on an interval: service state, disk-free below a threshold, Defender health, reboot-pending, a specific process running, a registry value matching, a Windows event-log pattern, a script’s exit code, EDR health. The boring backbone of every RMM. It’s the list you’d write on a whiteboard if someone asked “what do we need to know about a Windows box,” and now RFF checks all of it.
Alerts, routed. A failing check opens an alert. Alerts route by email and webhook, so they can land in a channel or a ticketing system or wherever your team actually looks. One decision in here matters more than it sounds: “service not installed” is not a failure by default. If you’re checking that the Acme Backup service is running, and a machine never had Acme Backup, that machine screaming at you every interval is how a monitoring rollout dies in week one. Been there. Missing and stopped are different states, and only one of them is your problem. You can opt into treating absent as a failure when that’s genuinely what you mean.
Auto-remediation. A check can heal itself. The obvious case: keep a service running - when the check finds it stopped, restart it, and only alert if the restart doesn’t take. This is the difference between “I got paged at 2 a.m. to run Restart-Service” and “the machine fixed itself and I read about it over coffee.” The whole reason to watch a thing is usually so you can fix it, so we let the watch and the fix be one object.
Workflows. When a single restart isn’t the answer, a failing check can trigger a step sequence on the device that failed - PowerShell, service control, whatever the recovery actually takes - with a cooldown and an attempt cap so a flapping check can’t hammer a box in a loop. It’s remediation for the cases where the fix has more than one move.
Live Manager. Live processes, services, and shared folders for any device, in the browser, right now. Not a snapshot from the last inventory sweep - the current state, pulled on demand. The “what is this machine doing this second” view.
Background Console. An interactive SYSTEM shell to a machine with no screen takeover - nobody sees a cursor move, no “someone is viewing your screen” banner, because you’re not on their screen, you’re on the box. This is the tool I reach for most. Most of what I need to do to a machine, I need to do without interrupting the person sitting at it.
Remote Files and Remote Registry. Browse and transfer files to and from a machine, and browse and edit its registry, remotely. The two things you end up needing five minutes into any real troubleshooting session, without RDP-ing in and kicking the user off.
Drive mappings. GPP-style network drive maps, reconciled in the user’s session, targetable by device group and by user or AD security group. If you’ve tried to reproduce “GPO drive maps were simpler” in Intune, you already feel this one. The data to do it right was always there. Somebody just had to wire it up the obvious way.
One-click compliance export. The report as PDF or CSV, for the auditor who does not have a login and does not want one.
Why it didn’t become the thing I was running from
Every item above is a primitive an RMM has had for fifteen years. None of it is novel. The novel part - the only part worth an opinion - is what we didn’t do.
We didn’t reprice. The RMM features don’t move you to an RMM tier, because there isn’t one. It’s still free for your first 100 endpoints - every feature, not a monitoring-lite teaser. Knowing a service died is free. Fixing it is free. The console, the checks, the alerts, the remote tools - free to 100 boxes. The big RMMs price monitoring per endpoint per month because monitoring is the thing every managed machine needs, which makes it the perfect thing to meter. I’d rather it be the thing that gets you in the door. You pay when you outgrow 100 endpoints, not when you want a feature.
We didn’t add a second console. The checks live on the device you already open, the alerts route to where you already work, the remote tools are one click from the device page. There’s no “monitoring module” with its own navigation tree and its own mental model. A machine is a machine; everything you can do to it is in one place.
We stayed Windows-first and stayed fast. The checks run on the endpoint and report verdicts, not raw firehoses of telemetry. The remote tools use the same dispatch path that does deploys in 26 seconds. Adding monitoring didn’t cost the thing the name promises.
I built RFF because the tools I ran for ~30,000 hospital endpoints made me wait, cost like a small car, and needed a certification to drive. Growing into an RMM was the moment I was most worried about turning into one of them. The way you don’t is boring and unglamorous: do the plain primitives, do them carefully, and refuse to charge rent on the part everyone needs.
It’s the fast deploy tool still. It just watches the machine now, too, and fixes it when it can.
RFF is a Windows RMM that’s free for your first 100 endpoints - changelog here, or point it at your fleet and see how “fast” is supposed to feel at getrff.com.