Setup guide

1Before you start

Choose where it runs. TechSavve RMM is the NOC: the console, the database and the alerting. It runs on one machine of yours:

Everything is in the download. Docker, the application and (on Windows) WSL come with it: nothing else is installed first and nothing is downloaded during the install.

Decide on its address. Your technicians open the console at this address and your site collectors report to it. A name such as rmm.yourcompany.com, pointed at the machine in your DNS, lets you get a free trusted certificate later. Collectors at other offices or customers must be able to reach it over HTTPS (port 443).

3Prepare DNS, Microsoft 365 and mailboxes

Get these ready before you set the platform up (step 5). None of it is needed for a first look, but sign-in with Microsoft accounts, email and trusted certificates all depend on it. yourcompany.com stands for your own domain below.

DNS records

• The console, for example rmm.yourcompany.com: an A record pointing at the server’s public IP address (or your internal DNS, if only your own network uses it). Needed for the free certificate and for collectors at other sites.
• Remote control (TechSavveRDP), for example rdp.yourcompany.com: an A record pointing at the same server’s public IP address. The remote-control apps of your technicians and your customers connect to this name, and it can also host the customer support pages (https://rdp.yourcompany.com/support).
• The password vault, if you use it, for example vault.yourcompany.com: an A record pointing at the same server.
• Email authentication for the domain the platform sends from: an SPF record that includes your mail service, DKIM records and a DMARC record. Microsoft 365 domains usually have these already. A sending service such as Amazon SES gives you its own DKIM records to add (below).
• Firewall: port 443 (HTTPS) open to the server for people and collectors, and port 80 open from the internet while Let’s Encrypt issues and renews the certificate.
• Firewall for TechSavveRDP (open and, behind a router, forward them to the server): TCP 21115, 21116 and 21117, and UDP 21116. TCP 21118 and 21119 only for the optional web client; TCP and UDP 3478 plus UDP 49160–49360 let sessions connect directly (faster) instead of through the relay.

Microsoft 365 / Entra: three app registrations

Create them in the Microsoft Entra admin center under App registrations (you need the Application Administrator or Global Administrator role). They are entered in the NOC under Admin → Platform settings → Single sign-on & mail (Microsoft Entra). First note your Tenant ID (the Directory (tenant) ID on any app’s Overview page): every app uses it. The worksheet has a box for every value below.

Not using Microsoft 365 for mail? Choose a standard SMTP server under Email settings and skip the NOC Mail App and the SMTP app; the NOC App and NOC API App are still what Microsoft sign-in needs. Scripts that work in Microsoft 365 use their own app registration, stored under Credentials as an App registration (OAuth client credentials), with only the permissions those scripts need.

Mailboxes

• noc@yourcompany.com: sends alerts, invitations and password resets.
• noc-reports@yourcompany.com: sends scheduled reports and business reviews.
• vault@yourcompany.com: sends the password vault’s invitations and new-device sign-in alerts, if you use the vault.

They can be shared mailboxes: no licence and no password needed, and replies land where your team can read them. A distribution group can’t send, so don’t use one as a sender (it is fine as a recipient, such as a list of your technicians). Put noc@ and noc-reports@ in the NOC Mail App’s access policy group, then enter them under Admin → Platform settings → Email settings and use the test buttons.

How the password vault sends email

The vault sends through an SMTP server with a username and password. Microsoft 365 normally refuses that kind of sign-in (SMTP AUTH is off for new tenants and being retired), so use one of these for vault@:

• In AWS: Amazon SES. Verify your domain in SES (it gives you three DKIM records to add to DNS), create SMTP credentials, and use the SES SMTP endpoint for your region on port 587. Ask AWS to move the account out of the SES sandbox so it can send to any address. It costs cents a month at this volume.
• On premises:
  • a Microsoft 365 SMTP relay: an inbound connector in Exchange that accepts mail from your server’s static public IP address, no password needed (port 25 must be open outbound);
  • a mail relay service such as SMTP2GO, SendGrid, Mailgun or Brevo, with its own SMTP username and password;
  • or your own mail server or your internet provider’s relay, if you already run one.

Whichever you choose, add the sending service to the domain’s SPF record and publish its DKIM records, so the mail isn’t marked as spam.

5Set up the platform

Everything here is under Admin in the menu on the left. Do it in this order:

1. A trusted certificate – Admin → SSL Certificates: Add a domain with your console’s name, then Request certificate. You get a free Let’s Encrypt certificate that renews itself. It needs a real domain name (not an IP address) pointed at the machine and port 80 reachable from the internet. Collectors on other networks check this certificate, so do it before installing them. Already have a certificate? sudo techsavve install-cert fullchain.pem privkey.pem installs it.
2. The platform’s own address – Admin → Platform settings, Frontend URL: the address people and collectors use, for example https://rmm.yourcompany.com. It goes into invitations, password-reset links and the install command each collector is given, so make sure it is right.
3. Microsoft sign-in and email – Admin → Platform settings: enter the Tenant ID and the three apps’ IDs and secret from step 3 under Single sign-on & mail (Microsoft Entra), choose Microsoft 365 or SMTP under Email settings, put noc@ and noc-reports@ in the send-address boxes, and use the Send a test email buttons. Alerts, invitations, password resets and reports all need this.
4. Remote control address – Admin → TechSavveRDP, TechSavveRDP remote access server: enter rdp.yourcompany.com (from step 3). Every TechSavveRDP client and support link is pointed at it.
5. Your name and logo – Admin → Platform settings: your company name and logo appear on the console, reports, status pages and the customer portal.
6. Your license – Admin → License: Activate with a purchase code (online) or Activate a license key (for a server with no internet). Request a quote if you don’t have one yet.
7. Your technicians – Admin → Local Account Users & Security: Invite user for each person, with the role that fits.
8. Two-step sign-in – Admin → Platform settings: require it for staff. Your NOC holds the keys to every customer.

7Install a collector at the site

TechSavve RMM is agentless: nothing is installed on the customer’s computers. A small collector at each site reaches the devices there (SNMP, SSH, WinRM, ping, SNMP traps and NetFlow) and reports to your NOC over HTTPS. Put it on any always-on Windows or Linux machine at the site.

1. Admin → Collectors: choose the customer in the box at the top right.
2. Under Collector software, download the collector for Windows or Linux and copy it to the machine at the site. Unzip it there.
3. Under New collector, give it a name, choose the site and click Generate enrollment token. The page shows the exact command, with the token and your platform’s address filled in.
4. On the site machine, from the unzipped ts-collector folder, run that command:
   • Windows (PowerShell, Run as administrator): .\install\install-windows.ps1 -Token … -Api …
   • Linux: sudo sh install/install-linux.sh --token … --api …
   It installs the collector as a service, connects it and starts it. Within a minute it shows online on the Collectors page.

A token works once and expires (the page shows when). If something goes wrong, generate a new one. On Linux, systemctl status ts-collector shows whether the collector is running.

A collector on the NOC’s own server

When the NOC runs on a machine in an office it should also watch, that machine can be the office’s collector too: no second computer needed. The two don’t get in each other’s way (the NOC uses ports 80 and 443; the collector listens on 162 for SNMP traps and 2055/4739 for NetFlow).

• Linux server: install the Linux collector on the server itself (not inside the NOC’s containers), exactly as above, but point it at the NOC on the same machine. In the command the Collectors page shows, replace the address after --api with http://127.0.0.1:8000:
  sudo sh install/install-linux.sh --token <token> --api http://127.0.0.1:8000
  The collector then talks to the NOC inside the machine: no certificate needed and nothing leaves the server.
• Windows PC: install the Windows collector on Windows itself (not inside the TechSavve appliance), from an administrator PowerShell, with the command exactly as the Collectors page shows it. Windows is on the office network, so the collector sees the devices directly. Install the trusted certificate (step 5) first.

Worth knowing: the collector shares the machine’s memory and processor with the NOC, which is fine for a small office; and if that machine goes down, the NOC and that office’s monitoring stop together. A NOC in the cloud (AWS and similar) only sees itself, so customer sites still need their own collectors.

9The rest of the first week

Getting started in the console keeps a checklist of what is left and ticks each item off as it is done. In short:

• Monitors for the services that matter: websites, mail, VPNs and line-of-business apps
• On-call paging (Admin → On-call) and the TechSavve phone app for alerts on the go
• Patching: scan for missing updates, then set maintenance windows for when updates install and machines restart
• Backups your customers depend on, watched so you know the day a job stops
• Microsoft 365 or Google Workspace, endpoint protection and the customers’ DNS, connected for security findings
• Reports: a first business review, scheduled monthly reports, status pages and the customer portal

11Getting help

The User Guide in the console’s menu explains every page. Stuck or want a hand with the first site? Email assistance@techsavve.com or call (214) 430-9342.

Download TechSavve RMM