Legacy RMMs bury techs in 3,000 menus.
AIM RMM is built for speed and Zero-Trust.
The high-frequency 20% of Remote Desktop, Silent Remediation, Native Patching, Privilege Elevation, and Lite Service Desk MSPs actually use every day—engineered on hardware-bound Shift Keys, 5-second local Flight Recorders, and optional universal AI.
| Hostname | Role / User | CPU / RAM | Disk I/O | Patch & Security |
|---|---|---|---|---|
| SQL-PROD-01 | Server 2022 • SQL/IIS | 18% • 22.4/32 GB | C: 7.8% (1.8ms) | VSS 3h • S1 Active |
| DC-PRIMARY-01 | Server 2022 • AD/DNS | 6% • 7.1/16 GB | C: 64% (0.9ms) | RAID Optimal • S1 |
| ACCT-WKS-04 | Win11 Pro • m.chen | 11% • 9.8/16 GB | NVMe 0.4ms | UAC Request Pending |
| EXEC-LAPTOP-02 | Win11 Pro • j.partner | 14% • 11.2/16 GB | NVMe Wear 92% | Rogue AnyDesk Blocked |
| RECEP-PC-01 | Win11 Pro • frontdesk | 4% • 6.0/16 GB | NVMe 0.5ms | BitLocker Escrowed |
+39.4 GB in C:\inetpub\logs (48h)
IIS verbose flag changed Tue 14:10
C:\inetpub\logs\LogFiles grew by +39.4 GB in 48h; C:\Windows\Temp holds 6.1 GB. Local Change-Diff timeline captured IIS verbose logging enabled Tue 14:10. SQL database latency remains healthy at 1.8 ms.
wuapi.dll (zero noisy PowerShell loops) • Pre-Patch VSS Check on Serverswinget apps (skips active Zoom/Teams); holds 24H2/25H2 feature upgrades.SHA-256 script hash + scope locally before running scheduled tasks.Automatically escrows 48-digit BitLocker recovery keys (rescuing non-domain laptops at blue recovery screens in 3 seconds) and rotates unique per-PC emergency Local Admin passwords with full view auditing.
Instantly blocks 100% of SMB shares, LAN traffic, RDP, email, and internet on a compromised PC—while keeping your encrypted AIM RMM rescue session alive for forensics or clean shutdown.
"Diagnosed critical primary storage exhaustion threatening production SQL availability on SQL-PROD-01; isolated runaway IIS log retention, reclaimed 45.5 GB safely, updated rotation policy, and verified database health."
Everything your techs touch daily. None of the 2008 bloatware.
Instead of scattering tools across dozens of policy matrices, AIM RMM organizes operations into four clean workflows—with inline per-client overrides that read Using Default until changed.
Know what froze a server Tuesday at 2:14 PM—before picking up the phone.
Every endpoint maintains a capped 50 MB local 7-day SQLite Black Box sampling CPU, RAM, Disk Latency (ms), and Gateway/DNS ping every 5 seconds, cutting central server database writes by ~85%.
Site-Grouped Outage Correlation
Collapses 40 offline PCs at one office into 1 "Site Offline" alert correlated with read-only UniFi WAN1/WAN2 & AP telemetry.
BSOD, NVMe & RAID Forensics
Harvests Windows minidumps + faulting .sys drivers on reboot and monitors NVMe wear & Dell/HP RAID StorPort events.
Vendor-Neutral VSS Backup Truth
Verifies real OS Shadow Copy completion timestamps across Veeam, Datto, Acronis, Cove, and Ahsay.
Rogue-RMM & Shadow-Admin Trap
Flags unauthorized AnyDesk/ScreenConnect launches (even portable in Downloads\) and unexpected Local Admins within 5s.
Fix silently behind the scenes, or connect in 1 second with full parity.
Screen capture stays completely Stopped 99.9% of the week—waking only upon a human Shift-Key signature and verifying exact SHA-256 + Authenticode integrity on every launch.
60-FPS Desktop + Browser IronRDP
Multi-monitor pop-out, clipboard keystrokes for UAC/login, private headless Server RDP over Port 443, and 6-digit Quick Support.
Behind-the-Scenes Machine Manager
Live Processes, Windows Services, Registry, Event Logs, Signed Terminal, File Browser, and 1-click Silent Uninstall.
2-Second Phone UAC Elevation
Remove daily Local Admin rights: users request installer approval from the right-click menu and techs sign off in 2s.
Foolproof Safe Mode & Printer Fixer
Safe-Mode reboot pauses BitLocker for 1 boot with a 15m auto-escape guard; Printer Fixer converts flaky WSD ports to TCP/IP.
Patching and onboarding that never surprise-reboot a production server.
Native COM wuapi.dll + silent winget updates keep CrowdStrike, Huntress, and SentinelOne timelines completely clean.
4-Day Soak & 1-Click Bad-KB Shield
Holds Windows feature upgrades for manual approval, enforces explicit Server windows + VSS checks, and blocks bad KBs fleet-wide.
<20ms Fleet Software & CVE Search
Instant version search across thousands of PCs with Admin-signed Canary testing and LAN-staggered wave install/uninstall.
1-Click New-PC Setup Autopilot
Debloats OEM trialware, installs client app stacks, enables BitLocker escrow, sets BIOS Wake-on-LAN, and maps office printers.
Signed Portable & Script Toolbox
Launch private or shared scripts and GUI portable tools (WizTree, Autoruns) that auto-clean themselves on session disconnect.
Turn fast AI fixes, client WFH access, and hardware refreshes into revenue.
Use the built-in 4-status Lite Service Desk (New, In Progress, Waiting, Resolved) or route straight into HaloPSA/ConnectWise via webhook.
Tray & support@ Lite Service Desk
User tray requests auto-attach screenshots + 60s Flight Recorder data, with live tray-toast replies and loop/spoof-safe email sync.
Recordings & "Labor Book" Billing
Compact .webm session videos with action pins, Value-Hour estimation, outcome invoice synopses, and Billing API push.
Live Site Docs & Refresh PDFs
Auto-populates WAN IPs, subnets, AD/SQL roles, Domain/SSL/DMARC expiry, Unmanaged LAN Radar, and Red/Yellow/Green PC PDFs.
Zero-Driver Client WFH Portal
Included client-facing remote access to assigned office PCs with self-service Wake-on-LAN and 1-second browser remote printing.
Remote & End-User
- 60-FPS DXGI + Multi-Monitor
- Headless Browser Server RDP
- 6-Digit Ad-Hoc Quick Support
- Zero-Driver WFH Browser Print
Silent Ops & Automation
- Native wuapi + winget Patching
- 1-Click New-PC Autopilot
- <20ms Software Search & Waves
- Printer Spooler & WSD Fixer
Security & Vault
- E2E BitLocker + Rotating LAPS
- 0.5s WFP Ransomware Isolate
- 2-Second Phone UAC Approval
- Rogue-RMM & EDR Watchdogs
Visibility & Business
- 5s Local SQLite Flight Recorder
- Toggleable Lite Service Desk
- .webm Video & Value Billing
- Live Site Docs & Refresh PDFs
Engineered so a total cloud breach still executes zero commands.
Legacy RMM servers hold god-mode keys to every client endpoint. AIM RMM treats the central broker—and reverse proxies—as untrusted transport.
24-Word Cold Master Key
Generated during setup and never stored on the server. Even if your server and backups burn down, entering your 24 words on a blank VM re-authenticates and self-rebuilds your entire Client tree.
12h Non-Exportable Browser Signing
After SSO + MFA/Passkey login, your browser mints a short-lived WebCrypto Shift Certificate. Clicking Connect, Shell, or Approve signs locally in <1ms—even scheduled tasks require signed PlaybookGrant SHA-256 hashes.
Hardware CNG + 7 AI Guardrails
Endpoints verify human signatures inside an E2E Noise tunnel before running commands or waking screen capture, while Non-AI Danger Badges, PII scrubbing, and a 1-host cap cage every AI suggestion.
1. What happens if attackers compromise the central server and database?
PlaybookGrant verifies the exact SHA-256 script hash on every endpoint).
2. How does AIM RMM block AI hallucinations, runaway fleet scripts, and prompt injection?
support@ emails are isolated inside <untrusted_endpoint_data> / <untrusted_external_email> tags with markdown image exfiltration stripped; and (4) Every state change requires a human Shift-Key signature.
3. Is AI required—and can we run 100% private or BYO-model AI for HIPAA/legal clients?
.docx/.xlsx/.pdf), respects active-screen privacy gates, and scrubs credentials, tokens, SSNs, and card numbers automatically.
4. How do single-click branded installers stay SmartScreen-trusted without EDR noise?
root_pubkey into the unhashed PE metadata slot of our cloud-HSM Authenticode-signed Go agent in <5ms—preserving a 100% valid Windows SmartScreen signature with zero certificate headaches. Updates use a Dual-Slot (Slot A/B) supervisor with a 90s auto-rollback watchdog plus a rolling 6-digit Offline Break-Glass passcode.
Replace seven separate MSP bills with one predictable license.
No per-technician taxes on growth tiers, no annual lock-in traps, and deployable in 5 minutes via docker compose up or 1-click Azure Container Apps (~$35–$45/mo covered by Microsoft Partner credits).
| Replaced Standalone Tool Category | Typical 1,000-PC Spend | Included Inside AIM RMM |
|---|---|---|
| Remote Support & Ad-Hoc Access | $350 – $700 / mo | 60-FPS Desktop, Headless Browser RDP, WebP Peek, 6-Digit Support & WFH Print |
| Endpoint Monitoring & Server Watchdogs | $2,000 – $3,500 / mo | 5s Flight Recorder, Site-Grouped Smart Alerts & VSS/NVMe/RAID/EDR Watchdogs |
| OS & 3rd-Party App Patch Management | $300 – $600 / mo | Native wuapi + winget 4d Soak, <20ms CVE Search & 1-Click Bad-KB Shield |
| Endpoint Privilege Elevation | $2,000 – $3,000 / mo | 2-Second Shift-Key Signed Installer Elevation From Phone or Console |
| Automated Workstation Onboarding | $350 – $500 / mo | 1-Click New-PC Debloat, App Stack, BitLocker Escrow & Printer Autopilot |
| Site Docs & Hardware Lifecycle QBRs | $450 – $650 / mo | Self-Updating Site Cheat Sheets, Domain/SSL/DMARC Watch & Aging-PC PDFs |
| Lite Ticketing & Unbilled T&M Recovery | $1,500+ / mo value | Toggleable Tray/support@ Lite Desk, .webm Recordings & "Labor Book" Billing API |
.exe & 100% White-Label