🗝️ A workstation is a room. Your RMM is the master key cabinet. This kit is the two-hour management-plane review: the hardening checklist (identity · remote-control scoping · egress · logging), the patch verification log that turns "we're patched" into evidence, the four session tells worth alerting on, and the 90-day retro-hunt worksheet. Supports security-review and audit-prep workflows — a practical starting point to review and adapt for your organization; not legal, compliance, or audit advice, and not a substitute for managed security or incident-response services.

How to use this (5 steps)

  1. Duplicate this page into your workspace (top-right).
  2. Schedule 2 hours with whoever owns your RMM/remote-access tooling.
  3. Run the hardening checklist — answer all five architecture questions with evidence, not memory.
  4. Verify your patch level on the host and fill the Patch Verification Log.
  5. Run the retro-hunt over the last 90 days of session history. Write down what you found — including "nothing."

The hardening checklist — five questions that outrank any feature comparison

# Question Why it matters
1 Does the console share an identity system with your domain? Shared identity means one takeover becomes two. Separate the console's auth from the domain it manages.
2 Is MFA enforced ON THE CONSOLE — not just on the technician's email? MFA at the mail tier does nothing if the console accepts a password alone (or has a bypass path).
3 Can any technician open remote control on any endpoint at any hour? Scope and schedule it. Unscoped remote control means one compromised account reaches everything, anytime.
4 Does the management server have unrestricted outbound access? A server that can tunnel anywhere can exfiltrate and beacon anywhere. Restrict egress to what the vendor documents.
5 Is there ONE session record an admin of that same server cannot edit? If the intruder is admin on the console, the console's own log is theirs too. Ship session logs somewhere append-only.

✅ The one rule, same as restore week: every claim gets a NUMBER and a DATE. "The console is locked down" is a mood; "5/5 questions answered with evidence, 14 endpoints scoped, reviewed Aug 18, by J.R." is an artifact — the kind cyber-insurance applications and client security questionnaires keep asking for. (Names and numbers above are format examples, not benchmarks.)

Patch Verification Log (duplicate this block per advisory)

PATCH VERIFICATION LOG
Date: ______________   Checked by: ______________
Product / component: ___________________________________________________
Advisory / CVE reference(s): ___________________________________________
Advisory version at time of check (date you read it): __________________
VERSION ON THE HOST (not the dashboard): _______________________________
Instances checked: ______ of ______ total (list attached: [ ] yes)
Path re-test (where vendor documents the closed path):
  [ ] Tested — result: ____________   [ ] Not documented by vendor
RE-CHECK BOOKED (+7 days — incomplete fixes surface late): _____________
Result:  [ ] VERIFIED   [ ] GAP FOUND → owner + fix-by date below
Gap / owner / fix-by: __________________________________________________
Signature: ______________

The dashboard is a claim; the host is the fact. Incomplete fixes are usually discovered after the first wave of patching — the +7-day re-check is part of the control, not an extra.

The four tells — a starting detection list

What separates an attacker from a technician when the tool is identical: context. None of these are alerts in most shops today. All four are answerable this week.

90-day retro-hunt worksheet