Everything RFF does, on one page

This is the complete list of what ships today, with free and paid features marked. The fastest way to check any of it is the live demo - no signup, straight into a synthetic fleet.

Mac and Linux

Since October 2026, Macs and Linux machines get their own agent, in the same console as your Windows fleet. On macOS it’s a launchd daemon, signed with our Apple Developer ID and notarized by Apple. On Linux it’s a systemd service, signed with the same code-signing certificate as the Windows agent, and the installer checks that signature before it writes anything. It installs with one line, talks outbound 443 only, and keeps itself up to date.

• Where it runs - macOS on Apple silicon and Intel. Debian, Ubuntu, and RHEL-family Linux like Rocky and Alma, on x64 or Arm, anywhere systemd is. Linux also comes as a .deb or .rpm
• Inventory - hardware, every installed app or package (dpkg, rpm, snap and flatpak on Linux), services, scheduled jobs, users and who’s an admin, pending updates, and whether a reboot is waiting. On a Mac, security posture covers FileVault, SIP, Gatekeeper and the firewall; on Linux, the firewall (ufw, firewalld or nftables), AppArmor or SELinux, LUKS, and automatic updates
• Scripts - bash, zsh, sh or python3 (anything with a #! line), run as root, with the full output in the job. The script library has a Mac set (flush DNS, reset printing, rebuild Spotlight and more) and a Linux set (sync the clock, clean the package cache, vacuum the journal, repair dpkg and more)
• Software - on a Mac: .pkg, .dmg or .zip, plus a Mac app catalog where every download has to be signed by that vendor’s Apple Team ID or the install is refused. On Linux: .deb, .rpm, or straight from the distro’s repositories (apt, dnf, zypper, snap), and every install is looked up in the package database before the job reports Success
• OS updates - softwareupdate on a Mac, apt or dnf on Linux (security only, or everything), as a job or in the same Patch Tuesday cycle as your Windows machines. On Apple silicon, macOS downloads the update and the user finishes it, because Apple wants the owner’s password for that step
• Checks, alerts and workflows - service running (launchd or systemd), process running, a script’s exit code, a log match, EDR healthy, firewall on, disk encrypted, with the same alerts, auto-remediation and workflows as Windows
• Live tools - a console as root, as the signed-in user, or as another account with its password; Files, big files included; Endpoint Explorer for processes, services and shares; and on Linux, a settings editor over dconf (GNOME’s registry)
• Remote desktop - in the browser, in H.264. On a Mac it works in a signed-in session and at the lock screen (with unattended access turned on); the login window, when nobody’s signed in, is coming. On Linux it works on GNOME, KDE Plasma and X11 desktops like Xfce, MATE and Cinnamon, with a monitor picker and clipboard, and the signed-in user is always asked first. Linux login screens can’t be reached, because GNOME and KDE refuse remote sessions there, and servers without a desktop get the console
• And the rest - performance checks and history, time-boxed admin elevation for one program (through sudo), printers over IPP with no driver to pick, trusting a CA through a job, service, task and user control, log collection, Wake-on-LAN from a Linux machine, and agent installs over SSH from any Mac or Linux agent
• Self Service and notices on Macs - Self Service, a branded app where users install the apps you’ve approved, each request a normal job, and notices before and after a job with the option to postpone a reboot
• macOS Profiles - build a configuration profile from 31 settings areas or a template (CIS Level 1, Microsoft 365, shared or kiosk Mac, encrypted DNS), or import any .mobileconfig, then see which Macs have the current version, an older one, or none. The user approves each install, since only MDM can install a profile silently
• Still Windows only - Group Policy baselines and the ADMX policy catalog, imaging, the Secure Boot rollout, Windows 11 readiness, browser updates, drive mappings, shortcuts, BitLocker key escrow, and break-glass admin escrow. Vulnerability scanning covers Windows and Mac; Linux isn’t covered yet

Deployment & software

• Deploy anything - MSI, EXE, PowerShell, any script - targeted or fleet-wide, pulled in parallel from a CDN edge
• Curated package library - browsers, runtimes, security agents, PDF tools, utilities - each with silent switches, detection, and uninstall already wired. Winget-backed entries install the current version at deploy time, and a daily true-up re-checks that every pinned download link still serves a real installer, that pinned versions are still current, and that nothing has gone end-of-life → browse the full catalog
• Agentless reach - push to a box with no agent over SMB + WMI (one-off installs, agent rollout)
• Wake-on-LAN - wake a sleeping machine and then patch it, instead of writing it off as offline. Magic packets can’t cross a router, so RFF sends from an agent already awake on the target’s own subnet - no appliance and no port forwarding. The device page shows whether each adapter is actually configured and armed to wake, and is honest that firmware settings aren’t readable from Windows
• Bare-metal imaging - one USB stick takes a wiped machine to named, enrolled and domain-joined with no keystrokes after the boot menu. We never host or ship Windows media: the image comes straight from Microsoft at deploy time, so there is no golden image to rebuild and no library to maintain → more
• Self-enrolling agent - one install line; machines register themselves and stay reachable off-LAN. Jobs queue and land on a laptop’s next check-in
• Deploy as the signed-in user - apps that refuse SYSTEM context (per-user installers) deploy into the real desktop session. The classic SCCM blind spot.
• Uninstall engine - silent-flag detection per installer engine, escalation ladder for stubborn apps, handles the tricky ones (Citrix Workspace, AnyDesk)
• Software + hardware inventory - searchable by name, publisher, or version, refreshed daily and on demand

Patching

• Automated patch deployment - policies, schedules, on-demand, offline catch-up for machines asleep at deploy time
• Patch Tuesday rings - staged rollout with a health gate and auto-halt, blast-radius limits, per-ring reboot control, skip-cycle

Configuration & compliance

• Conformance baselines (GPO you can read) - capture a golden box’s effective Group Policy or seed from a CIS Windows L1 template, edit it as a versioned desired-state document, and see drift in plain English - down to which GPO set each value. Enforce is approval-gated with one-click rollback. → more
• Vulnerability scanning - NVD + CISA KEV matched daily against your real inventory; deploy the fix and re-scan until it clears; suppress with a reason and expiry
• Windows OS-CVE detection - build/UBR-level truth about which OS CVEs actually apply, KEV-flagged
• Compliance dashboard - EOL Windows, missing AV/EDR, expiring certs, unlocked screens, BitLocker encryption state - with thresholds you set
• BitLocker encryption + recovery-key escrow - every volume’s encryption state across the fleet, recovery keys escrowed encrypted at rest, revealed admin-only and written to the audit log in the same transaction as the read. The Windows answer to FileVault escrow.
• One-click compliance export - export the fleet compliance report to PDF or CSV for the auditor who asked
• Recurring fleet report - a weekly, monthly, or quarterly email to up to five people who don’t need RFF logins. Every figure carries a delta against the previous period, so it reports what moved - encryption coverage, patch compliance, open and resolved vulnerabilities, jobs, alerts - which is the question a QBR actually asks

Monitoring & automation

• Monitoring checks - recurring health checks on a schedule: a service running or stopped, disk free below a threshold, Defender healthy, reboot pending, a process running, a registry value match, a Windows event-log match, a script’s exit code, EDR healthy. Some are evaluated from inventory, some run on the agent
• Alerts - a failing check opens an alert, routed by email and webhook; acknowledge it to mark it seen while you work the issue, or snooze it when it’s real, known, and not tonight’s problem. “Service not installed” is not treated as a failure by default, so you don’t get false-alarm floods
• Auto-remediation - a check can self-heal: “always keep service X running” restarts it automatically the moment it’s found stopped
• Workflows - check-triggered automation: when a check fails on a device, run a sequence of steps (PowerShell, service control, and more) on that failing device. Retries with a cooldown and an attempt cap so it never thrashes, runs your escalation steps if the fix doesn’t hold, and notifies you when it gives up - and because the check keeps re-evaluating, the fix is verified, not assumed

The endpoint experience

• Remote Desktop (beta) - browser-based, H.264, attended control of any session; drives elevated/admin windows and UAC prompts; unattended lights-out access (per-tenant opt-in); Ctrl+Alt+Del works. Free covers 2 hours a month; paid is unlimited
• “Why is this machine slow?” - one click samples the box for 60 seconds and answers in plain English, naming the culprit process. 14 days of minute-by-minute history stays on the machine, so you can ask “why WAS it slow this morning” hours after the ticket, and hourly CPU and memory history is kept in the console and charted on the device page, so “was it already struggling last week” is a look rather than a guess. Fleet-wide Health page triages the chronically slow, crash-looping, and slow-boot machines. (Free)
• Self Service, JAMF-style - publish apps to a catalog in your users’ system tray; they install without a ticket, and RFF runs it as a normal audited job with install-state read from real inventory. Brand it - your name, logo, and accent color, so the end-user surface reads as your IT → more
• Live Manager - Task Manager in the browser: live processes, services, and shared folders for any device, sortable, with service control - kill a runaway process or restart a hung service without touching the user’s screen
• Background Console - an interactive SYSTEM shell in the browser, no screen takeover. Admin-only, and every session keeps a transcript
• Remote Files - browse, download, and upload files on any device from the browser
• Remote Registry - browse and edit the registry remotely: set and delete values, create and delete keys
• Drive mappings - GPP-style network drive maps, reconciled in the user’s real session and targetable by device group or by user / AD security group. The Intune pain point (“GPO drive maps were simpler”), fixed
• User notifications - deploy/patch/reboot notices in the user’s session, with notify-and-defer for reboots

Security & governance

• Shadow-AI visibility - see every AI app, browser extension, and local model runner (Ollama, LM Studio) on the fleet - the local ones your network tools structurally can’t. Content-blind: identity and metadata, never a prompt. Detection, sanctioning and bulk-remove are all on every plan. → more
• Secure Boot 2023 certificate rollout - the brick-risk remediation, staged and server-gated so it can’t run away
• Break-glass local admin escrow - the local administrator password set during RFF imaging is escrowed encrypted to the console, and the plaintext copy is wiped from the machine only after the console confirms it has it. Reveal is admin-only, one device at a time, and every reveal is written to the audit log with who saw which machine’s password. The password rotates on a schedule and automatically after every reveal, so one read during an incident doesn’t stay valid afterwards
• Credential vault - encrypted at rest under a cert-wrapped key ring, isolated per tenant
• Audit trail on everything - every privileged action recorded, per tenant
• Sign-in security - MFA/2FA, SSO with Google and Microsoft, and role-based access
• Custom roles - build roles shaped like your helpdesk instead of living with admin / operator / viewer. Twelve capabilities can be withheld from a base role, including remote desktop, remote console, credential management, and revealing stored secrets - so a tier-1 role that can’t read a BitLocker key is a two-minute change. Deliberately subtractive: a custom role can only take access away, so a mistake in a role definition can never escalate someone. All twelve are enforced by the API, not just hidden in the console: a role without a capability is refused by the server. Changes take effect within seconds rather than at next sign-in → guide
• SCIM 2.0 directory provisioning - Entra ID and Okta create, update, and deactivate RFF users on their own. Provisioned users arrive as viewer by design (your directory decides who, an admin decides what), promotions survive the next sync, and deactivated accounts are disabled and badged rather than deleted so old audit entries still resolve to a name

For MSPs

• True multi-tenancy - each client gets a hard-walled tenant (database-level row isolation), you switch between them from one login, endpoint licensing pools across clients
• Per-client branding - the self-service catalog and notification dialogs wear each client’s logo, name, and colors (MSP)
• Dynamic groups that see your fleet - target by OS, installed software, or on-prem AD OU / Computer DN, recomputed every run

The platform

• Cloud-native - agents talk outbound HTTPS (443) only; no inbound holes, no on-prem server to feed
• Transparent pricing - published, self-serve, monthly. Free for 100 endpoints, forever
• Support that answers - email the founder, get an answer in hours → how support works
• Documented REST API - on every plan, free included. Sync a CMDB, feed a dashboard, export compliance evidence. Read-only keys by default, every action attributed in the audit log → the API

What RFF does NOT do

No phones or tablets - Windows, Mac and Linux only (use Intune or JAMF for mobile). No MDM - the Mac agent isn’t an MDM, so anything Apple reserves for MDM (silent configuration profiles, remote wipe and lock) stays with yours. No ticketing/PSA - we don’t replace ConnectWise, but we do publish a documented REST API on every plan so you can wire the two together. No network monitoring - endpoints, not switches. If those are your must-haves, one of the tools on our comparison pages may fit better - the comparisons are honest about who wins where.

Try the live demo → · no signup   Start free - 100 endpoints →