Your password was reset. Choose a new one to continue.
Switch customer
Dashboard
EN
GT
Overview
Live fleet status across 6 sites, refreshed every 15s
134/142
Devices online
7
Critical alerts
38
Patches pending
12
Open tickets
Recent alerts
Fleet health
Online134
Warning5
Offline3
Devices needing attention
Device
Status
CPU
RAM
Last seen
Endpoint Management
142 endpoints across 6 sites
Not yet built
0
Managed devices
0%
Compliant
0
Non-compliant
0
Not checked in (24h)
Devices by platform
Compliance status
Device
Type
OS
Status
CPU
RAM
Disk
Last seen
Device groups
Hardware & software inventory
Everything the agent has actually reported — blank means not yet reported, never guessed.
Device
Manufacturer / model
Serial number
RAM
Disk
OS version
Agent version
Policies & configuration profiles
Click a policy to assign it to a device or group. Real read-only compliance checking runs at each agent check-in for screen lock, firewall, and encryption policies.
Compliance rules
Evaluated on every check-in, plus a sweep every 15 minutes for time-based rules. A device going non-compliant opens a real alert.
0
Compliant
0
Non-compliant
Security posture
Real evidence per device — disk encryption from the agent, compliance from policy evaluation. No cosmetic scoring.
Device
OS
Disk encryption
Compliance
Agent version
Vulnerabilities
Real matches against the National Vulnerability Database's public API — keyword-based, not precise CPE version matching, so treat this as a starting point for investigation, not a definitive scan. A sync can take a minute or two (NVD's rate limit); check back after triggering.
Device
Software
CVE
Severity
CVSS
Backup visibility
Tracking, not a backup engine — status comes from a technician's manual updates or a real webhook the backup product's post-job hook calls. A job that goes 2x its expected interval without a success opens a real alert. Add jobs from a device's detail drawer.
Device
Product
Destination
Status
Last success
Expected interval
Applications
Package-manager based, not free-text install commands — a named package from a trusted catalog (winget/Homebrew/apt/dnf), not arbitrary scripts. Click an application to deploy it.
Driver inventory
Windows-only, read-only
macOS/Linux don't have a comparable driver-management surface. Deployment/updates aren't implemented — a bad driver update can prevent a machine from booting, a worse failure mode than almost anything else here.
Device
Driver
Manufacturer
Class
Version
Certificate authorities
Real X.509 CAs, signed with the cryptography library — no hand-rolled crypto. Root CA private keys are encrypted at rest, not HSM-protected; see the create dialog for what that does and doesn't cover.
Certificate templates
Reusable issuance profiles — type, validity period, and which intermediate CA signs from it.
Issued certificates
Issued from a CSR you supply — G-Tech never sees or stores the private key. Generate one with openssl req -new -newkey rsa:2048 -nodes -keyout device.key -out device.csr.
Subject
Device
Status
Expires
Serial
Wi-Fi / Wired 802.1X / VPN policies
Read-only presence checking is real for all three types. Actual deployment (writing the Wi-Fi/wired profile or VPN connection) is written for Windows/macOS/Linux but genuinely unverified against real network hardware — it only runs when both the agent has deployment enabled (on by default for newly-onboarded machines) and the policy itself has "Enable real deployment" checked below, and it's protected by an auto-revert safety watchdog if the change can't be confirmed within 10 minutes. See a device's remote actions for status. Need a certificate first? Go to Certificates & PKI →
Recent deployment jobs
Phase 1: data model and lifecycle tracking only. No real imaging execution happens yet - job status is advanced manually until the deployment engine (Phase 3) and Site Gateway sync (Phase 2) exist.
Job
Customer
Profile
Image version
Status
Created
OS Images
Catalog entries for Windows installation images and packages. Each image can have multiple versions; only a version with a verified SHA-256 checksum and status "available" can be used in a deployment job. Files live on local disk, never in the database, and are never exposed as direct paths.
Deployment Profiles
Reusable configuration for a deployment job. Editing a profile that already has jobs creates a new version automatically instead of rewriting history - past jobs keep the exact configuration they ran with.
Deployment Jobs
Phase 1: job lifecycle tracking only - there is no PXE/WinPE deployment engine yet. Status below is a manual override for exercising the data model end-to-end. A disk-erase confirmation is required before a job can move to "in progress" or "completed".
Imaging Gateways
Phase 2 - synchronization not yet built
Your existing Site Gateways, with an "imaging enabled" flag you can set now. No artifact caching or synchronization happens yet - this only marks which gateways will participate once Phase 2 (gateway image caching) ships.
Imaging History
Read-only - nothing here can be edited or deleted
Every PC Imaging change: image/version create or upload, checksum failures, profile versioning, job creation and status changes, gateway imaging toggles.
When
Actor
Action
Entity
PC Imaging Settings
Per-customer defaults. Select a specific customer (not "All Customers") to view or edit.
Deployment packages
Create a deployment package to enroll new devices — hand it to a technician, or roll it into a script, email, or your own tooling. Each package can enroll devices up to its usage limit, until revoked or expired.
Audit log
Read-only — nothing here can be edited or deleted
Every customer, site, contact, and policy change made through the console.
Active Directory
Real-time directory data from the customer's own Active Directory, via their connector.
Create/edit/delete and membership changes queued from this app, most recent first.
Time
Action
Entity
By
Password Policy
Domain-wide password & lockout policy, synced from Active Directory on every connector cycle.
Expiring soon
Users whose password expires within 30 days, or already has.
Name
Sam Account Name
Expires
LAPS — Local Administrator Passwords
Local admin passwords synced from Active Directory (Windows LAPS or legacy LAPS) on every connector cycle. Hidden by default — click Reveal to view.
Computer
Account
Password
Expires
Stale Accounts
Enabled users and computers with no logon in 90+ days, or none on record.
Name
Type
Last Logon
Privileged Groups
Built-in high-privilege groups and their current member counts.
Group
Members
Recent Security Events
Account lockouts/unlocks and privileged group membership changes, detected on each connector sync.
When
Event
Target
Detail
Deleted Objects
Recently deleted users, groups and computers (AD Recycle Bin), with a one-click Restore. Empty if the AD Recycle Bin feature isn't enabled on this domain.
Name
Type
Last Location
Deleted
System State Backup Monitoring
Status of each domain controller's system state backup — detected natively (Windows Server Backup/wbadmin), triggered on demand or on a schedule from here, or reported by a 3rd-party tool via the generic backup webhook.
Domain Controller
Product
Status
Last Success
Target/Destination
Schedule
Actions
GPO Snapshot/Restore
Point-in-time GPO backups (Backup-GPO), with the ability to restore a GPO to a previous version. Take a snapshot or view history from a GPO's own detail panel (GPOs tab); set the domain-wide storage location, retention and schedule here.
Loading...
GPO
Taken
Trigger
Storage
Status
Restore
Automation
Typed, reviewed workflows only - no free-text scripts. Offboarding, password rotation, stale-account cleanup, and config deployment for existing GPO/802.1X/Wi-Fi/VPN/certificate profiles.
Name
Type
Target
Trigger
Approval
Enabled
Loading...
Workflow
Status
Triggered by
Created
Loading...
Run items
Target
Action
Status
Config templates
Name
Type
Version
Validation
Loading...
Quick Actions
Approvals
0
runs waiting for approval
Recent Runs
No runs yet.
Incidents
NOC incident management — correlated from real alerts
0
P1 — Critical
0
P2 — High
0
P3 — Medium
0
P4 — Low
Incident
Severity
Title
Devices
PagerDuty
Customer notified
Status
Technician
Age
Resolution report
All resolved incidents, this customer view
Who resolved what, and how long it took — for MSP reporting
No resolved incidents yet for this customer.
0
Resolved incidents
—
Avg. resolution time
0
Technicians involved
Technician
Resolved
Avg. time
Fastest
Slowest
Alerts
7 critical, 11 warning, 4 informational — across all sites
Severity
Device
Message
Triggered
Status
Patch Management
Compliance across all managed operating systems
Windows
91%
88 devices · 6 pending patches
macOS
74%
34 devices · 19 pending patches
Linux
96%
20 devices · 2 pending patches
Pending patches
Patch
Severity
Affected devices
Released
Status
Remote Access
Remote Desktop sessions and technician permissions. Linux devices connect via Terminal automatically. File Manager is available via the Files button.
Sessions
Customer
Device
Technician
Type
Status
Started
Ended
Permissions
Technician
Scope
Remote Desktop
Approval required
Clipboard
Add Device
Devices
Customer
Device
OS
Status
Last seen
Network Monitoring
SNMP polling, bandwidth utilization and topology across 6 sites
31/33
Network devices up
6.2ms
Avg response time
2
Interfaces down
82%
Peak link utilization
Live topology — HQ Site A
Auto-discovered
Monitored network devices
SNMP v2c/v3 + controllers
Device
Role
IP address
Status
Response
CPU
Memory
Uptime
Config backup
WAN link utilization
Peak 82%
Packet loss & latency
Nominal
Interface utilization
Interface
Device
Speed
In
Out
Errors (24h)
Status
Top talkers — last 15 minutes
NetFlow
Rank
Source
Destination
Application
Volume
% of total
NetPath — real traceroute
Hop-by-hop
Real traceroute results, run on demand
Access point placement
Manual placement — not a measured survey
Real AP inventory from SNMP, positioned manually. Drag an AP to place it; click to set its coverage rating. True RF measurement would need a physical site survey.
Strong (manually set)
Fair (manually set)
Weak (manually set)
Click an AP to cycle its rating, drag to reposition — both save automatically.
Capacity forecasting
2 resources trending to capacity
30-day linear trend projected against current growth rate
Resource
Type
Current
30-day trend
Projected full
Recommendation
Device configurations
Real SSH backup
Scheduled SSH backups, stored encrypted, with change detection. Devices need SSH credentials (set via Edit).
Device
Status
Last backup
Versions
Schedule
Recent configuration changes
Quality of Service — WAN link classes
Policy active
Traffic class
Priority
Allocated
Current usage
Drops (24h)
IP address management
Real ping sweep
Subnet
Label
Total IPs
Used
Available
Utilization
Last scanned
VoIP & call quality
Avg MOS 4.2
Call path
MOS score
Jitter
Latency
Packet loss
Status
User Device Tracker — switch ports
Port mapping
Switch
Port
Connected device
MAC address
VLAN
Status
SNMP traps (real)
UDP/162 — needs port exposed & firewalled in
Real traps received by this server. Classic RFC3164/5424 syslog (UDP/514) isn't implemented yet — SNMP traps only.
Site Gateways
On-prem service inside a customer's LAN — the bridge to infrastructure the cloud can't reach directly (AD, DHCP, DNS, NPS, PXE). Phase 0: enrollment, check-in, and LAN discovery via ping sweep. AD/DHCP/DNS/NPS connectivity comes next, once this foundation is proven.
Discovered hosts
Ping-sweep hits only — nothing here is auto-added to monitoring. Promote a host to start managing it as a real network device.
IP address
Hostname
Response time
Last seen
Infrastructure credentials
Admin-only — an AD/NPS-capable service account is domain-admin-equivalent in what it can do if compromised, meaningfully more sensitive than SNMP/SSH credentials elsewhere in this app.
Identity & Infrastructure — discovered
AD via LDAP; DHCP/DNS/NPS via PowerShell remoting (WinRM). Read-only discovery — no changes are made to any of these services. Note on confidence: unlike ping-sweep discovery above, this code hasn't been run against a real AD/Windows Server in the environment it was written in (the required libraries weren't installable there) — written carefully against documented APIs, but genuinely unverified until it runs against your first real gateway.
Type
Name
Host
Status
Summary
Last discovered
Security
Security posture, asset inventory and findings
—
Posture score
0
Open CVEs
0
Critical CVEs
0
Devices with critical/high CVEs
Open CVEs by severity
Endpoint protection coverage
Top open CVEs
Highest 10
CVE
Severity
Type
Device
Detail
Endpoint security summary
0 devices
Per-device endpoint security status
Device
OS
Disk encryption
Firewall
Antivirus
Secure Boot
TPM
Local admins
Last seen
Other security assets
0 assets
Name
Type
Criticality
Exposure
Owner
IP
Status
Security posture score
Computed from real asset and finding counts — not a placeholder figure
Network security
0 devices
Built from what the platform actually collects. A device whose firmware could not be checked is shown as not checked, never as clean.
Device
Site
Status
Firmware
CVE check
Open CVEs
SNMP
Config backup
Vulnerability management
0 matches
Matches come from NVD keyword search against installed-software names.
CVE
Severity
CVSS
Software
Device
Fixed in (NVD)
Status
Last detected
Network device coverage
0 devices
Firmware is auto-detected from SNMP sysDescr for Cisco (IOS, IOS XE, NX-OS, ASA), Juniper, Palo Alto, Fortinet, MikroTik, Aruba, Extreme, SonicWall and Arista. For any other vendor, or when sysDescr has no version, use Set firmware to enter its NVD CPE (vendor:product:version). Unchecked devices are never shown as clean.
Device
Vendor
Firmware
NVD check
CVE
Severity
CVSS
Device
Product / firmware
Status
Last detected
EDR
Telemetry (logon success/failure, new services), a rule-based detection engine, and IOC matching. Detections at high/critical severity automatically open a Security Case. Process creation, file, registry, DNS, PowerShell, USB and network-connection telemetry are not collected yet.
Detections
Severity
Rule
Device
Evidence
Case
When
Respond
Detection rules
Rule
Severity
Confidence
MITRE
Recent telemetry events
Type
Device
Detail
When
Status
Indicators of compromise
Matched against telemetry IP addresses and file hashes at detection time. Global indicators apply to every customer.
Type
Value
Confidence
Source
Scope
Response actions
Actions are queued here and picked up by the agent on its next check-in - there is no instant/real-time channel to the endpoint. Network isolation, file quarantine and IP blocking are not implemented yet.
Device
Action
Status
Result
When
Security baselines
—
Checks
Check
Severity
Pass
Fail
Not checked
Excepted
Exceptions
Check
Applies to
Reason
Expires
Not collected yet
Needs agent update
These baseline items need new collectors in the G-Tech agent. They are listed so nothing is implied: they are not checked and not scored.
Security assessments
Worker: checking…
Nothing is scanned until a scope has been defined and an administrator has recorded authorization for it. Scans run in a separate worker, never in this page's request, and only against the targets listed in the scope. Domains are resolved once and the resulting addresses are what get scanned.
Scopes
Scope
Targets
Type
Window
Authorization
Last run
Runs
Scope
Status
Requested
Result
Scanner tools
What the security worker can actually see. Only tools with an adapter in this build can run; the others are listed so nothing is implied.
Tool
Adapter
Installed
Threat Intelligence
Matches against your scans
Matched against the CISA Known Exploited Vulnerabilities (KEV) catalog, compared to the most recent completed scan of each scope.
Severity
Match
Status
Details
Discovered
Security Cases
Group one or more findings into a case you can assign, track through a status workflow, and keep notes on. Closing a case never changes the status of the findings it links.
Severity
Title
Status
Assigned
Findings
Updated
Coming in a later phase
Not yet implemented
This part of the Security module ships in a later build phase and isn't wired up yet. It isn't hidden — this placeholder is here so nothing on this page ever shows fabricated data.
Tickets
12 open · 3 pending customer reply
ID
Subject
Site
Priority
Status
Assigned
Updated
Scripts
Reusable automation for your fleet
Name
Target OS
Last run
Runs
Policies
Monitoring and alert thresholds applied to device groups
Reports
Generate, schedule and export PDF reports for your fleet
Report templates
PDF export
Alert volume
+12% vs last month
Fleet uptime
99.2%
Scheduled reports
Recent reports
Organizations
Client sites managed under this account
Team
Technicians and admins with console access
On-Call Rotation
Who's primary/secondary auto-advances on the schedule below — used to auto-assign new incidents and drive the escalation ladder. Internal only, not synced to PagerDuty.
Primary
Secondary
Billing
Plan usage and invoices
Pro
Current plan
142/250
Endpoints licensed
Oct 1
Next invoice date
Invoice history
Documentation
Guides for deploying and operating G-Tech ONE
Profile
Your account details and password
Account
Name
Email
Role
Change password
G-Tech AI
Ask about your endpoints, alerts, and security findings
G-Tech AI
Open incident
New OS image
New image version
New deployment profile
New deployment job
New Remote Desktop session
New Remote Access permission
Add security asset
New Workflow
Move-to-OU and LAPS revoke aren't wired up to the connector yet - these fields are saved but ignored until that's built.
New Template
Resolve incident
Invite team member
This login will only ever see this one customer's incidents — nothing else in G-Tech ONE.
Technicians automatically get a PagerDuty account created for on-call paging. Other roles don't.
Edit team member
Add subnet
Max /20 (4096 addresses) — larger ranges take too long to sweep on demand.
New traceroute
Real source — a device on this list has SSH credentials configured and a known traceroute command for its vendor, so the trace genuinely runs from that device's position in your network. Devices without SSH set up, or an unsupported vendor, aren't offered here since they'd fail rather than silently fall back to something else.
Edit customer details
Business address
Billing address
Add site
Add contact
Add customer
Used for incident WhatsApp notifications — leave blank if this customer shouldn't receive them yet.
Export as .p12
This file contains the CA's private key. Treat it exactly as sensitively as the CA itself.
New certificate authority
The private key is generated here and encrypted at rest — this is real protection, but not HSM/KMS-grade. Don't use this as a trust anchor for anything beyond internal device/802.1X certs without understanding that trade-off.
New certificate template
Issue a certificate
Certificate issued. Copy it now — download and install on the requesting device/service.
New infrastructure credential
Use a dedicated, least-privilege service account, not a personal or Domain Admin login. This credential is sent to the customer's Site Gateway to run read-only discovery.
Gateway enrollment token
Shown once — copy it now. Gateways hold more sensitive access than endpoint agents; keep this token as carefully as you would a domain admin credential.
New application
Package ID is the exact identifier that package manager uses — e.g. winget's Mozilla.Firefox, Homebrew's firefox, apt's firefox-esr. This is never combined into a shell string, so it can't be used to inject other commands.
Deploy
Recent deployments
Track a backup job
This report token is shown once — copy it now.
Backup target
Automatic backup schedule
GPO snapshot settings
-
Push certificate
Generates a new key and certificate from this template's CA and pushes it to the device's certificate store on its next check-in. The private key is never shown to a technician and is cleared from the server the moment the device confirms installation.
Certificate push queued - it will be delivered to the device and installed on its next check-in.
Add direct API connection
Connection saved. It will sync on the next scheduler tick (direct-to-DC) or once the gateway runs its AD sync (via gateway).
Assign policy
Current assignments
New configuration profile / policy
Screen lock/firewall/encryption are checked read-only at each check-in. Wi-Fi/Wired 802.1X use config like {"ssid": "CorpNet"}, VPN like {"connection_name": "CorpVPN", "server": "vpn.example.com", "tunnel_type": "ikev2"}. All three are read-only presence checks by default. Checking "Enable real deployment" above opts this specific policy into actually writing the config to the device — it still only takes effect on agents with GTECH_ENABLE_NETWORK_POLICY_DEPLOYMENT=1 set (on by default for newly-onboarded machines as of today), and is protected by an auto-revert watchdog if the change can't be confirmed within 10 minutes. This is genuinely unverified against real network hardware — see a device's remote actions for status, and consider leaving deployment off at first to confirm the read-only check. If you pick a certificate template, that certificate must already be pushed to the device (via "Push certificate" on the device page) before Windows deployment will proceed. Password/USB/Custom are stored but not yet evaluated at all.
New compliance rule
New device group
Deployment package
This deployment package's token is shown once — copy it now. It won't be retrievable again after you close this window.
Add device
Add permission
Or enter a name manually (overrides the dropdown above):
Add Active Directory connector
This connector's secret is shown once — copy it now. It won't be retrievable again after you close this window.
Run the on-prem discovery connector inside the customer's network with this secret in its config, pointed at a domain controller using a read-only service account. It never writes to their AD.
Unzip onto the Windows Server (e.g. C:\GTechRMM\), then open ad_connector_config.json for the exact PowerShell commands to run.
Create Active Directory group
Edit Active Directory group
Group members
Create organizational unit
Create Group Policy Object
Uses Copy-GPO to duplicate the selected GPO's full settings, including things our templates can't express (like 802.1X wired/wireless policy). Only available with a classic connector.
"Refresh inventory" is dispatched to the agent for real. Other actions are logged to the audit trail below but not yet executed by the agent — that's planned for a future phase.
Recent remote actions
Installed software (0)
Backup jobs
Danger zone
Removes this device with its software inventory, compliance history and remote-action log. This cannot be undone. If the agent is still installed it will no longer be able to check in.
—
—
Not fetched yet
Live report details require a classic connector — this GPO's connector is Direct API only.
Domain—
Owner—
Created—
Modified—
Status—
WMI filter—
Automation ID—
Links
Path
Enabled
Enforced
Security filtering
Trustee
Permissions
Taken
Trigger
Storage
Status
Creating 802.1X policies requires a classic connector — this GPO's connector is Direct API only.
Note: the connector account needs edit rights granted directly on this GPO first (Set-GPPermission ... GpoEditDeleteModifySecurity) — GPOs don't inherit permissions from their parent container. If creation fails with an AD permission error, check the Operations tab for the exact message.