What's new

Deployment

New

• Cancel a job on one device - stop a pending, running or lost-contact device while the rest of the job carries on. A running script is killed mid-run, and the job closes when the last device finishes. Cancelling the whole job now stops lost-contact devices too.
• Choose what happens when a newer version is installed - per MSI install step: fail the device (the default), leave it as it is, or downgrade on purpose by removing the newer product first. The same version already installed is still a plain skip.
• The installer's architecture on every job - the agent reads whether the staged installer is 32- or 64-bit before it runs, and shows it under each device, failed ones included.
• Uploaded MSIs fill themselves in - drop an MSI into the job wizard and its name, version and ProductCode come from the file itself, read in your browser.

Improved

• A heads-up before you run - the review step says how many of the picked devices already report a newer version, names them, and says what the step will do there. When the version is only known after download, it says that instead.
• Run script and Run job on the device page - in the same panel as the live tools, so there is one place to act on a machine.

Health & monitoring

New

• Refresh planning - a Refresh tab on the Health page, separate from the triage queues: which machines make their users wait, and which are barely used, scored over weeks.
• Performance alerts reach your inbox and your PSA - a machine that has been disk-bound for three hours now sends the same email and webhook as a failing health check, with the matching close when it recovers.

Platform & console

New

• Full data export - everything your workspace holds in one zip, from Settings. Admin-only, audited, on every plan.
• Readable console transcripts - a recorded console session replays as the screen looked. Raw keeps the exact bytes.
• Device counts on the Sites page - each Site shows its devices and how many are online, before you enter it.
• The public demo now shows Sites - two client companies, each walled off in its own Site, as an MSP would run them. Try the demo.

Changed

• Going over your plan's device limit - the admin gets an email and a week's notice. After that, the newest-enrolled devices beyond the limit stop receiving work until you're back under it or move up a plan. They keep checking in, and nothing is uninstalled.
• The MSP plan is self-serve - it checks out like any other plan, with no email to us first.

Improved

• Remote desktop - the viewer shows what's really on the screen (waiting for the user, locked, nobody signed in) and only enables the controls that can work. Keys arrive in order, UAC prompts pass through, and an offline device gets a Wake button.
• Windows end-of-life dates by edition - the supported-OS check knows LTSC, IoT LTSC and Enterprise/Education schedules, so a Windows 10 LTSC 2021 machine supported into 2027 is no longer flagged as out of support.
• Drive, printer, shortcut and folder changes are audited - and one drive letter can't be claimed twice for the same machines.
• Search that holds up - device search and tag filters run on the server, so a device on page two no longer searches as "no results". Search on Audit, OS Vulnerabilities, Inventory and the package library survives a reload and Back.
• Confirmations say what will happen - every destructive action asks in the app's own dialog and names the machines and what the server will do.

Fixed

• An expired session no longer loses your work - a save that hits an expired session keeps the page open and says it wasn't saved, so you can copy your work before signing in again.
• The fleet report counts Windows CVEs - it had reported "Open vulnerabilities: 0" while thousands of Windows CVEs were open, because it only counted application findings.
• Compliance exports disclose suppressions - a suppressed finding, a known-exploited one included, is listed as suppressed.
• Two people editing one policy - the second save is refused with a prompt to reload, so the first edit can't be silently undone.
• Retry Failed asks first when it would re-run devices you cancelled.

Accessibility

Improved

• Every dialog behaves like one - focus moves in, Tab stays inside, Escape closes, and focus returns to what opened it.
• Dark-mode contrast - the brand color and secondary text now pass WCAG AA.
• Phone-width pages wrap instead of scrolling sideways.

Windows agent

Improved

• Local MSI installs log in full - and when one fails, the job log says why, from the installer's own log.
• Crash counts are real crashes - only application crashes and hangs count toward a machine's crash total.
• User-session work reports honestly - when nobody is signed in, a job meant for the user says so.

Free tools

New

• CVE catalog - every CVE, and for Windows the KB that fixes it. Search by number, sort by CVSS or known-exploited, refreshed hourly from NVD and CISA KEV.
• Is this Windows build patched? - check a build against a CVE in your browser.
• VBS to PowerShell - converts a VBScript to PowerShell and keeps what it means. Open source.
• Intune detection rule - builds a Win32 app detection rule from an MSI, an EXE or a script. Nothing is uploaded. Open source.

Improved

• SwitchHunt says whether an installer is 32- or 64-bit.

Security

New

• Sign out ends the session server-side - signing out revokes the session on the server, and every token descended from that login goes with it, including ones already refreshed. Useful on a shared machine and after a support call.
• Secure Boot certificate visibility - devices now report the certificates actually present in firmware, with expiry dates, rather than only what Windows servicing recorded. A smart group can target machines missing the 2023 CA. Why the registry value is not enough, with the scripts.
• Agent auto-update opt-out is enforced end to end - if your workspace turns fleet auto-updates off, agents honour it. Operator-run upgrades still work on demand.

Improved

• Upload restrictions are enforced server-side - the file-type allow-list is applied by the API as well as the browser, so it holds regardless of how the upload arrives.
• Break-glass passwords stay usable after a reveal - revealing a local admin password and rotating it no longer race each other. The rotation waits fifteen minutes, which is about the walk to the machine.

Platform & console

Improved

• Failed jobs carry the real reason - install and service failures report what actually happened: the service is disabled, the installer log path, a post-install version mismatch, a DNS failure. Starting a disabled service now names the blocker and what to change.
• Fleet-wide uninstall is one job - uninstalling an app across many machines creates a single job with every device as a target, so you get one "succeeded / failed" rollup instead of a row per machine.
• Deleting a group checks what depends on it - maintenance windows and policies pointed at that group are named first, and on confirm the windows are disabled rather than silently widened to the whole fleet.
• Concurrent edits are detected - two people editing the same object get a conflict warning instead of one overwriting the other.
• Smart group rules validate on save - a rule naming an attribute that does not exist is rejected with the field named, negative rules no longer sweep in machines that never reported the attribute, and removing the last rule asks first because an empty rule set matches everything.
• Schedules reject impossible times - a cron expression that can never fire is caught at save.
• Duplicate names are blocked across groups, checks, policies and maintenance windows, including names that differ only by trailing whitespace.
• Clearer reporting - dashboard tiles distinguish "measured and healthy" from "not yet measured", schedules and next-run times use one labeled timezone, and report agent version is labeled "at last inventory" so a machine that has updated since is not counted as stale.

Accessibility

Improved

• Keyboard and screen-reader access - a skip-to-content link on every page, sortable columns that announce their sort state, and confirmation dialogs that render in the page so the detail in a safety prompt is readable and selectable.
• Destructive actions in Endpoint Explorer confirm first, with the prompt matched to the consequence.

Windows agent

Improved

• Self-update waits for running jobs - an agent update no longer interrupts work in flight, and the job log attributes it correctly.
• Smoother enrollment - a newly installed agent waits for its configuration instead of restarting while it arrives, so a fresh machine does not show up as unhealthy on day one.
• Remote Desktop works through TLS-inspecting and authenticating proxies.
• Printer mappings are more resilient - they survive a connect failure, apply the default once, and reach every session.
• Imaging name prompt is easier to find - in WinPE the prompt announces itself and comes to the front, so it cannot sit behind the deployment console.
• Store apps show a real publisher instead of an identifier, which also cleans up the publisher filter.

Windows 11 readiness

New

• Which machines can take Windows 11, and what each one costs - the fleet graded against the requirements and split four ways by remedy, because "47 machines blocked" isn’t a number anybody can act on. Free firmware fix is eligible hardware with Secure Boot or TPM switched off in BIOS, which costs a reboot. Buy a part fails only on memory or disk, so the machine stays. Replace is a processor that isn’t on Microsoft's supported list, and no part fixes that. Needs inventory says so rather than guessing, because a purchasing decision made on missing data is worse than no answer. Windows Server is excluded outright - these requirements don’t apply to it, and grading it produced alarming counts that meant nothing.
• Export it with your filters - the list you are looking at, not a canned one, so the spreadsheet you hand to finance matches the screen you were reading.
• Disk space is treated as a blocker - because it measurably blocks the upgrade, and leaving it out made machines look ready that would fail at setup.

Deployment

New

• Who signed this installer - the agent reports the signing certificate before running an artifact as SYSTEM, so an unsigned or unexpectedly-signed package is visible at the moment it matters rather than afterwards.
• Hash reputation on uploaded artifacts - files you upload for deployment are checked by hash, so a bad package is caught before it reaches a fleet.

Vulnerabilities

Improved

• Expand a CVE in place - open a finding without losing the list, with the count of affected applications on the row.
• Inventory refreshes itself after a fix - remediate a CVE and the affected machines re-inventory, so the finding clears on its own instead of sitting there looking unfixed.

Fixed

• Findings were being matched against the wrong snapshot - the matcher could run against inventory taken before the upload it had just been told about, so a fresh scan could report on stale software.
• Windows clients were graded against Windows Server patch levels, components inherited their parent product's CVEs, and Python was compared against its installer version rather than its real one. Each of those invents findings that aren’t there, which is the fastest way to make a vulnerability report ignorable.
• Remediate is no longer offered where it can’t work - CVEs whose fix package is gone used to show the button anyway, and the dialog said "Deploy to 0 devices" on every CVE.

Platform & console

Fixed

• Counts in emails now match what the email lists. Several notifications stated a number that wasn’t the real total: the Patch Tuesday halt email showed 20 failures without saying there were more, the drift email listed 50 devices under a claim of 60, the device-cleanup warning under-stated how many were going, and the daily digest reported a capped event count as the day's total. A report that quietly truncates is worse than one that says it truncated, because you act on the smaller number.
• Automation no longer switches itself off quietly. A run of given-up alerts could disable a tenant's workflows and auto-remediation without saying so, a failed warning email still silenced the next 24 hours of warnings, and a manual billing suspension un-suspended itself overnight. Each of these looked like nothing happening.
• A device that never checked in is no longer pruned with no warning, and the catalog true-up no longer calls a truncated run clean.
• Hardware fit stopped recommending a purchase from missing data - absent RAM data produced a "buy a new machine" verdict, which is the one recommendation that should never be a guess.
• Smaller ones: a deploy logged an error to Sentry on every run, a login rate-limit cap wasn’t actually a cap, the trial-ended email had no retry despite a comment promising one, and a wizard's focus trap made it a keyboard trap.

Agent

Agent 1.3.63. Free-plan agents update themselves; paid plans control the rollout.

Fixed

• An install is verified by what actually registered, not by matching the name we expected, with file-version evidence where there’s no DisplayIcon and Appx-aware checks for packaged apps.
• winget "already current" isn’t success when the version is behind, and the version guard that was blind to installer versions now sees them. A watchdog covers winget installs that hang.
• Visual Studio installs report honestly - its silent switch has to be appended rather than prepended, and without --wait the installer returns exit 0 about nine minutes before it has finished.
• A completed uninstall is no longer reported as failed, and a failed upgrade that removed the software instead of patching it now says so rather than reporting a generic failure.

Vulnerabilities

New

• Every finding shows its proof - a vulnerability row now carries the registry key the version was read from, the DisplayVersion the vendor wrote there, and where they disagree, the version stamped on the binary itself. Nine of forty-three applications on one ordinary workstation contradict their own DisplayVersion, so "you are running 7.1.2" is a claim worth being able to check. The same applies to the Windows OS verdict, which shows the build and revision it compared and the revision Microsoft fixed the CVE in. It exports with the compliance CSV.
• Store and MSIX apps are inventoried - packaged applications were invisible to the agent, which read only the uninstall registry. Anything installed as MSIX read as NOT INSTALLED across the whole fleet, including on machines that had it. They are now collected and counted. Most have no CVE mapping published yet, so few can be checked, but they are no longer missing from the picture.

Platform & console

New

• Custom fields, in bulk - define your own fields on devices and on the workspace, then set one across many devices at once instead of opening them one at a time. They work in smart-group rules, so "every kiosk in the west region" is a rule rather than a hand-maintained list. On the Sites page the same applies to clients, which is where an MSP actually wants it.
• Search the audit log - free text across who, what, which tenant and which IP, with the page count shown so a long investigation stops being guesswork.
• Alerts from your own scripts - raise and resolve an alert from a script, deduplicated by condition, so a check you wrote yourself lands in the same queue as the built-in ones. Quiet mode holds notifications while a maintenance window is open rather than paging somebody about work you scheduled.
• The PSA loop closes - resolve events go back to your ticketing system with a routable payload, and there is a test button so you can prove the path works before you rely on it.
• Policy reach preview - before a cross-client policy runs, see exactly which clients and which devices it would touch.

Free tools

New

• VulnScan - run one signed PowerShell script and get the published CVEs affecting your installed software and your build of Windows, with the registry key behind each finding. On a machine with internet that is the whole thing: it pulls the index down, matches on the box, and writes an HTML report to the desktop. Air-gapped machines get a JSON snapshot you drop on the tool page instead, and the matching happens in the browser tab. Either way your inventory never leaves the machine. Covers roughly the top 500 Windows applications plus the OS, reads Store apps, and needs no account and no agent. Free, and the collector and index builders are public. Try it, or read how the version matching works.

Platform & console

New

• Shortcuts - put a desktop, Start Menu or Startup shortcut on your fleet as a readable row instead of a logon script. A URL becomes a .url, anything else a .lnk, with arguments, working directory and a custom icon. The agent writes it in the signed-in user's own profile, which is the part a script gets wrong: running as SYSTEM it lands the shortcut in a profile no human ever opens. Delete the row and RFF removes the shortcut it created - and only the one it created, so a shortcut the user made themselves is never touched. Why this is harder than it looks.
• Folders - make sure a directory exists across the fleet, including %USERPROFILE% paths that resolve to each person's own profile. Remove is deliberately not recursive: an empty folder is deleted, a folder with anything in it is reported and left alone. RFF does not delete a user's files because a policy row said so.
• Item-level targeting on both - scope a row to a device group, and optionally to an AD or Entra security group so it only applies for members of it. That check runs on the device, in the signed-in user's session, which is how Group Policy Preferences did it and the reason it worked.
• Installer switches, read out of the file - drop an installer into a deploy job and RFF identifies the engine from its bytes and offers that engine's silent switches: Inno Setup, NSIS, WiX Burn, InstallShield, Advanced Installer and more. For an MSI it reads the package's own property table and suggests the properties you probably have to set, which is the usual reason an install "succeeds" and leaves you with nothing configured. Nothing is written into your arguments until you click. It runs entirely in your browser, so the installer is never uploaded for analysis.

Changed

• Drive Mappings, Printer Mappings, Shortcuts and Folders are now tabs under Preferences - one sidebar entry instead of four. They are four views of one idea: a desired-state row, scoped to a group, reconciled in the signed-in user's session. Every existing link still works and opens the right tab.

Fixed

• URL shortcuts are cleaned up properly - Windows rewrites https://example.com as https://example.com/ when it saves a .url, so the agent's "does this still point where I left it" check never matched and it refused to delete its own file. Deleting the row left the icon on every desktop, and the name stayed unusable afterwards. Agent 1.3.53.
• Skipped rows now say why - when the agent deliberately does not act on a row, because the signed-in user is not in the targeted group or a shortcut with that name already exists that RFF did not create, it reports "skipped" with the reason. It used to report nothing at all, which read as a clean apply.
• Patch Tuesday cycles no longer lose a tick to one tenant's error - each tenant's ring cycle now runs in its own short transaction, so a failure in one is contained instead of aborting the sweep for everyone else in that pass.

Platform & console

New

• Wake-on-LAN - wake a sleeping machine from the device page or as a job step, then patch it. Magic packets cannot cross a router, so RFF picks a healthy agent already awake on the target's own subnet and sends from there - no appliance, no port forwarding, no separate relay to install. If nothing on that subnet is awake, RFF says so plainly instead of reporting a wake it could not have delivered.
• Wake readiness in inventory - "can this machine even wake" is now answered on the device page, per network adapter, before you depend on it. Windows tells us whether the NIC is configured to wake on a magic packet and whether it is currently armed; both are shown. Firmware and BIOS settings are not readable from Windows in any vendor-neutral way, so RFF says that outright rather than implying a green tick means the whole chain is good.
• Custom roles - build roles shaped like your team instead of living with Admin, Operator and Viewer. Twelve capabilities can be withheld from a base role, including remote desktop, remote console, credential management, and revealing stored secrets. It is deliberately subtractive: a custom role can only ever take access away, so a mistake in a role definition can never escalate someone. All twelve are enforced by the API, not just hidden in the console: a role without a capability is refused by the server. A change takes effect within seconds rather than at next sign-in. Guide.
• SCIM 2.0 directory provisioning - Entra ID and Okta can create, update and deactivate RFF users on their own. New hires appear, leavers lose access, and neither needs a ticket. Provisioned users arrive as Viewer by design - the directory decides who, an admin still decides what they can do - and promoting someone in RFF is not overwritten by the next sync. Deactivated accounts are disabled and badged rather than deleted, so old audit entries still resolve to a name.
• Recurring fleet report - a weekly, monthly or quarterly email to up to five recipients, who do not need RFF accounts. Every number is shown against the previous period: encryption coverage, patch compliance, jobs run and failed, open and resolved vulnerabilities, alerts opened and resolved.
• Alert snooze - the third verb, alongside acknowledge and resolve, on both check alerts and monitoring alerts. For the alert that is real, known, and not tonight's problem.
• CPU and memory history you can query - per-device performance history is now stored hourly in a queryable table and charted on the device page, so "was this machine already struggling last week" is a look rather than a guess. The minute-by-minute detail still stays on the endpoint.
• The package catalog is public - the full library of pre-built packages is now browsable on this site, with a machine-readable version at /catalog.json. No signup needed to check whether the app you care about is already wired up.
• Break-glass password rotation - the managed local admin password now rotates on a schedule and automatically after every reveal, so a password that was read once during an incident does not stay valid afterwards.

Fixed

• Renaming a machine no longer forks the device - renaming a Windows machine used to create a second device record and leave the original looking abandoned. The agent's identity now follows the rename, so history, jobs, and inventory stay on one device.
• Devices mislabelled "orphan agent" - a paging bug made most of a healthy fleet display as orphaned. It was only ever a display fault, but it looked exactly like a real one.
• Light-mode contrast - text across the console was failing WCAG AA in light mode. Fixed app-wide.
• Pinned download links are re-checked daily - the catalog true-up now verifies every pinned link still serves an actual installer and that pinned versions are still current, instead of only checking end-of-life dates. A vendor silently moving a download is caught before a deploy fails on it.
• In-app plan upgrades billed for one endpoint - upgrading from inside the console sent a quantity of 1 to Stripe regardless of fleet size.

Agent

New

• The installer asks for the enrollment token - double-clicking the MSI now prompts for the token instead of requiring a command line, and the download carries a bounded, revocable multi-use token.
• Wake-on-LAN relay - an agent can now be asked to wake a neighbour on its own subnet, and reports network-adapter wake configuration as part of inventory.

Platform & console

New

• Settings Catalog - Group Policy without a domain controller - upload your own PolicyDefinitions folder (or any vendor's ADMX) and RFF parses it into a searchable catalog of every Administrative Template setting, with the vendor's own display names and explanations. Search "automatic updates", pick Enabled, choose the option from a dropdown built out of the ADMX, and see the exact registry values before you commit to anything. Add it to a Conformance baseline and it's enforced like any other desired state. All three Group Policy states are supported, including Not configured, which removes the values from managed devices rather than just leaving them behind. How we built it.
• One-click template collection - pick a device and RFF asks its agent for the Group Policy templates it already has, so nobody has to zip a folder to get started. Prefers the domain Central Store on a DC (authoritative, and it carries any custom ADMX you added). Read-only on the device, and deliberately a manual job rather than something riding inventory - the templates are identical across a fleet, so collecting them everywhere would be pure waste. Manual upload is still there for machines with no agent.
• Custom ADMX upload - Chrome, Zoom, Firefox, or a template you wrote. Endpoints do not need the vendor's ADMX installed to receive the setting, so RFF acts as your central store.
• Bare-metal imaging - build a bootable USB from the console, plug it into a new machine, and walk away. It wipes the disk, installs Windows, applies the name you typed at boot, installs the agent and enrolls, then appears in Devices as pending approval. Enrollment tokens are per-stick and individually revocable, so a lost stick is revoked on its own without breaking any other install path. What it took.
• Per-device vulnerability links - the vulnerability and OS-CVE counts on a device page now open those pages filtered to that machine, with the device named.
• What's-new notifications - a bell in the console for product updates, so you find out about things like this without reading a changelog.

Fixed

• Commands that wait for input fail fast instead of hanging - a job running something interactive (net user name * /add, an installer with no silent flag) used to sit until its timeout with an empty log. It now errors in milliseconds with the command's own message. This also closes a sharper edge: with an inherited input handle, net user name * /add could create the account with a blank password and report success.
• Job wizard action search - picking an action from the search results now lands you on that action, checked, instead of jumping back to the first category.

Agent

Fixed

• Child process input - the agent now gives every command it launches its own closed input handle, so interactive prompts fail immediately rather than wedging a job (see above).

Platform & console

New

• BitLocker dashboard + recovery-key escrow - every volume's encryption state across the fleet, soonest problems first, with recovery keys escrowed encrypted at rest. Revealing a key is admin-only, a POST (never a prefetchable link), and writes an audit row in the same transaction as the read, so no key is ever revealed without a record. The Windows answer to FileVault escrow.
• Time-boxed admin elevation - grant a specific program local admin for a set window, without ever adding anyone to the Administrators group. Revoke kills the whole process tree (including apps that escaped through out-of-process activation), the grant expires on the endpoint even if the console can't reach it, and every grant is audited with who asked, who approved, and when it ended. How we built it.
• Printer Mappings - GPP-style network printer maps as policy, the Drive Mappings sibling: reconciled in the user's session and targetable by device group and by user or AD security group.
• Certificate expiry dashboard - machine certificates across the fleet, soonest-to-expire first, so a cert stops being a surprise before it stops being trusted.
• Hybrid-join doctor - dsregcmd /status wrapped into a one-click verdict per device (domain, hybrid, or broken, with the reason) instead of reading raw output on every box.
• Entra join state in inventory - Azure AD / Entra join status on the device page and in the census, alongside the domain-join facts.

Agent

New

• BitLocker + identity collectors - the agent reports per-volume BitLocker state, escrows recovery keys, and reports Entra / hybrid join state for the doctor.
• Elevation enforcement - the agent mints the time-boxed elevated token, scopes it to the launched program, enforces the expiry locally, and revokes the whole logon session on demand - including out-of-process apps that dodge a job object.
• Printer mapping reconcile - printer maps are applied and reconciled in the user's session, the same engine as drive mappings.

Platform & console

New

• Script Library - a browsable catalog of ready-made operations you can run from the job wizard without writing PowerShell. Repair WMI, repair Group Policy, sync system time, rebuild the Windows Search index, remove mapped printers, clear the Teams cache, rebuild an Outlook OST, repair performance counters, clean up the component store, and turn on Storage Sense. The tickets you get every week, one click each.
• Deployed by and Created by - jobs, policies, and workflows now show who started them. "Who pushed this" shouldn't require the audit log.
• Self-service and branding, in one place - the Companion catalog and your logo, colors, and organization name grouped into their own Settings section instead of scattered across three.

Fixed & improved

• Every plan gets every feature except multi-tenancy. Pro is retired, Starter's endpoint cap is gone, and per-customer branding is now free on every tier including Free. Multi-tenant separation is what the MSP plan actually sells, so that stays MSP-only. Existing plans keep working; nothing to do.
• Offline devices no longer strand a job. A job targeting a machine that never came back stayed Pending forever, and a long-dead device made everyone else wait out the reboot grace period.
• Rerun asks first. It dispatches to real machines and it was one click with no confirmation.
• Jobs filters - Scripts and Workflows have their own chips, the counts add up to All again, and four columns that encoded the same fact three ways are now one.
• Trial emails said the Free tier includes 200 endpoints. It's 100, as it has always been on the pricing page.
• Wider tables and consistent page gutters across Settings, Reports, Scripts and Secure Boot.

Agent

New

• Companion branding, everywhere - your logo and colors now cover the tray icon, its tooltip, the right-click menu, the About card, and the window icon. Your users see your IT department, not ours.

Fixed & improved

• A green job now means the software is actually there. Two winget exit codes were being treated as "retry without machine scope" when they're conclusive failures: 0x8A150010 (the package has no machine-scope installer) and 0x8A15005C (winget can't extract an archive when running as SYSTEM). The retry then installed into the SYSTEM profile, where no signed-in user can see it, and exited 0. Both now route straight to the signed-in-user fallback - correct, and faster, since it skips a retry that cannot succeed. Fixes Postman, Discord, MobaXterm, Paint.NET, Process Explorer and TeamViewer outright. The full write-up.
• Package catalog testing - all 131 recipes are now schema- and source-validated, and a new harness installs them for real as SYSTEM on a disposable VM, checking that each one lands somewhere a user can actually see rather than just exiting 0. OpenVPN GUI and RealVNC Viewer moved off winget to direct MSI.

Platform & console

New

• Monitoring checks - scheduled health checks that run on the endpoint on an interval: service state, disk-free threshold, Defender health, reboot pending, a process running, a registry value, a Windows event-log match, a script exit code, and EDR health. The un-sexy RMM backbone, now built in.
• Alerts - a failing check opens an alert, routed by email and webhook so it lands where your team already works. "Service not installed" is not treated as a failure by default, so a check for software a machine never had doesn't flood you - opt in when absent really is the problem.
• Auto-remediation - a check can heal itself. Keep a service running and RFF restarts it when it's found stopped, alerting only if the restart doesn't take.
• Workflows - when a check fails, run a step sequence (PowerShell, service control, and more) on the device that failed, with a cooldown and an attempt cap so a flapping check can't hammer a box in a loop.
• Live Manager - live processes, services, and shared folders for any device in the browser, pulled on demand - the current state, not the last inventory snapshot.
• Background Console - an interactive SYSTEM shell to a machine with no screen takeover and no "someone is viewing" banner. Fix the box without interrupting the person at the keyboard.
• Remote Files and Remote Registry - browse and transfer files to and from a device, and browse and edit its registry, remotely - without kicking the user off over RDP.
• Drive mappings - GPP-style network drive maps, reconciled in the user's session, targetable by device group and by user or AD security group. The Intune "GPO drive maps were simpler" gap, closed.
• One-click compliance export - download the compliance report as PDF or CSV for the auditor who doesn't have a login.

Agent

New

• Check engine - the Windows agent runs the health checks on the box and reports verdicts, applies auto-remediation, and executes triggered workflows locally.
• On-box remote services - live process/service/share enumeration, the SYSTEM background console, and remote file and registry access, all over the same dispatch path that runs deploys.

Platform & console

New

• Fleet Changes feed - one feed of what changed across every device: software installs and removals, new autoruns, new scheduled tasks, and local-admin membership changes - without visiting each machine. Every device page gets a change strip that links into the fleet view. Noisy classes (RunOnce entries, per-user profile load/unload flap, RFF's own updates) are suppressed by default, with opt-in tracking.
• Daily change digest - a once-a-day email summarizing what changed across the fleet since yesterday.
• ClickFix hardening baselines - report-only Conformance templates that flag the settings ClickFix-style attacks abuse (Windows Script Host, autorun persistence), so you can see exposure across the fleet before enforcing anything.
• Remote Desktop minutes meter - the Free plan's remote desktop now has a monthly minutes allowance with a live "X of Y minutes" meter on the Remote page. Paid plans are unmetered.

Fixed & improved

• Vulnerability matching is platform-aware: macOS-only CVEs no longer flag the same app on Windows, and vice versa.
• The console reloads itself once after a deploy instead of erroring on stale files.
• Cancelling a Microsoft or Google sign-in mid-flow is handled gracefully.
• Hard-deleting a device now writes an audit event.
• Device action buttons wrap cleanly on narrow screens.

Agent

New

• Change collectors - the Windows agent now tracks autoruns and scheduled tasks, feeding the Changes feed and the ClickFix baselines.

Platform & console

New

• Self-service catalog (Starter+) - publish software-library packages or your own custom packages to end users. Per-entry options: rename, description, category, featured placement, scope to a device group, and an optional "new software available" announcement on users' screens. Install state is read from real device inventory ("installed as of ..."), not just the last job. The Jobs page gets a Self-service source filter and row badge so requests are easy to audit.
• PerfCheck - one-click "why is this machine slow?" on any device. Live check with a "running warm" tier, plus retrospective analysis ("why WAS it slow this morning?") from a local history ring the agent keeps on the box. Opt-in proactive alerts fire when a machine has been slow for a sustained window; conditions that persist all day are flagged chronic.
• Fleet Health page (free) - triage queues for the chronically slow, crash-looping, and slow-booting machines across the fleet, fed by PerfCheck's local detector.
• One-time scheduled jobs - run any job once at a future time. Maintenance-window work without creating a recurring policy.
• Policy visibility - policies that silently skip a run (for example, no eligible relay online) now wear a "Not running" badge with the reason, and a Failing filter surfaces them.
• Public read-only demo - a live synthetic fleet you can explore without signing up: app.getrff.com/demo.
• Faster console - API responses are now compressed (brotli/gzip), cutting transfer sizes across the console and agents.

Fixed & improved

• Vulnerability remediation now explains why nothing deployed - and shows amber, not green, when zero devices were touched.
• Device software search matches version strings, not just name and publisher.
• Read-only diagnostics no longer trip the domain-controller confirmation gate.
• Jobs wizard cleanup - a System tab, Notify polish, and saner action grouping.
• Self-service publish dialog prefills the display name from the package.

Agent

New

• RFF Companion - a lightweight per-session helper that delivers notifications and hosts the self-service catalog window (tile grid with icons, install-state chips, and a "Just you" vs "All users" context badge per app). Optional persistent tray icon, off by default, toggled fleet-wide from Settings.
• User-context installs - apps that only install per-user (Spotify and friends) now deploy correctly through the signed-in user's session, with a clear error when no one is signed in.
• Local performance engine - the analysis behind PerfCheck runs on the box itself; only verdicts leave the machine.

Fixed & improved

• Cancelling a run-as-user job now stops the whole process tree in the user's session.
• Companion window reliability - repaint and visibility fixes; windows and toasts identify as "RFF" everywhere (including Task Manager).

Platform & console

• Sites - self-service multi-site management, move devices between Sites (no reinstall), pooled endpoint licensing.
• Shadow-AI governance - fleet-wide AI detection (apps, browser extensions, local models), sanctioned allow-lists, human-confirmed and bulk removal, auto-remediation policies with canary rings, and AI attestation export (PDF + CSV).
• Conformance - desired-state config as an editable, versioned document: edit expected values, diff any two versions, one-click revert. Seed from a CIS template or capture a golden box; exact vs subset match modes; per-setting source-GPO provenance; fleet rollup and per-device drift reports.
• Conformance enforce + rollback - approval-gated fix jobs for drifted devices, each with a one-click rollback captured up front; bulk-approve to apply a baseline fleet-wide in one action. RFF defers to active GPOs instead of fighting them.
• Patch Tuesday rings - staged rollout, health gate, update scope, per-ring reboot, blast-radius and skip-cycle controls.
• Collect Logs from multiple machines via Jobs; device auto-cleanup; bulk-select uninstall; offline-aware jobs.

Agent

• Reliable bulk uninstall - installers run one at a time per machine, with detection and recovery for installer conflicts and stuck interactive uninstallers.
• Silent uninstall for tricky apps (Citrix Workspace, AnyDesk).
• Offline resilience - results are buffered on connection loss and flushed on reconnect, with a local policy cache.
• Remote Desktop - send Ctrl+Alt+Del, attended UAC support, control of elevated windows.