Posts on cross-platform kernel-level diagnostics, behavioral security monitoring, AI-powered analysis, and Linux root access with per-command audit
One Windows or Linux server on the Free query tier with your own AI key costs $5 a month. See pricing
Live Session shell commands on Linux agents can now run as root, behind a per-member privilege, a host opt-in file, and an audit entry for each command. sudo no longer hangs the shell.
The public API and MCP server now return one device's status, active alerts, and session links for a PSA ticket, and organization API tokens can be limited to allowed addresses.
A device lookup for PSA tickets in the public API and MCP server, address limits on API tokens, live updates on the Tickets page, and remote desktop fixes for phones and reconnects.
"A stop job is running for" means systemd is waiting up to 90 seconds for a unit to stop at shutdown. Find the unit, read its journal, and set a shorter stop timeout.
NVIDIA Xid 79, "GPU has fallen off the bus", means the driver lost the GPU over PCI Express. Find the Xid and PCIe errors in the kernel log, then test power management.
From Windows agent 2.8.4.6, remote control connects when nobody is signed in, such as after a restart, and opens on the sign-in screen when both secure desktop permissions are on.
When SSH or SFTP logins fail because pam_systemd reached the maximum number of sessions, count logind sessions by state, find what holds the closing ones, and clear them.
Alert rules for a named service, event log entries, file and folder size, ping, and patch failures, detection evidence context, an agent support bundle, and remote desktop zoom.
When several unrelated Windows processes show high CPU at once, compare privileged time, list the minifilters with fltmc, and read the thread stacks to find the filter driver behind it.
Detection evidence, chat evidence export, and a per-host timeline in the desktop app, remote control reconnects, new agent health data, and new event fields in Data Explorer.
winget error 0x8A15000F (APPINSTALLER_CLI_ERROR_SOURCE_DATA_MISSING) means data a winget source needs is missing. Find the account and package that fail, then register or reset the source.
Event ID 41 from Kernel-Power means Windows restarted without a clean shutdown. Read BugcheckCode and PowerButtonTimestamp to tell a crash, a forced power-off, and a power fault apart.
Published pricing and features for ET Ducky and NinjaOne in one table, from each vendor's pricing page and documentation, with billing model, endpoints, patching, and dated sources.
When a Windows Server in-place upgrade rolls back with 0xC1900101, read the extend code, the SetupDiag result, and the setupact.log for that phase to find the driver or file that stopped it.
When an Active Directory account keeps locking out, follow events 4740, 4771, and 4776 on the domain controllers, then 4625 on the source computer, to the process with the old password.
Cited events in desktop app answers, baselines and file I/O latency on the System Analysis page, predictive text for remote control from a phone, and faster Automated Troubleshooting.
Configuration export and import with AI drafts from other RMM tools, Data Condition and cron triggers, a Keys menu in remote control, per-user catalog installs, and lighter live sessions.
0x800F0922 (CBS_E_INSTALLERS_FAILED) means an update's advanced installer failed and Windows rolled it back. Find the failed installer in CBS.log and apply the fix for that cause.
Event ID 20 from WindowsUpdateClient means Windows failed to install an update. Find the KB and error code, read CBS.log for the failed component, and apply the fix for that code.
When a Windows PC wakes from sleep on its own, ask Windows what woke it with powercfg, check wake timers and scheduled tasks, and limit which devices can wake it.
Service crash and event log health on Windows and Linux agents, alerts for agents that stop reporting, an MCP server with a read-only API, and one online rule across the dashboard.
When Windows print jobs sit at Ready until the Print Spooler restarts, check for a spooler crash, read the printer port with Get-Printer, and move a WSD printer to a TCP/IP port.
ET Ducky has a read-only REST API and MCP server for agents, alerts, and a fleet summary. Create a token, connect Claude Code or Cursor, and read the same data from scripts.
The Offline Windows Update card now shows whether the hub's wsusscn2.cab matches Microsoft's current catalog, with checked PowerShell steps to download and copy a newer one.
Offline Windows Update from your distribution hub, install paths and per-user apps in the inventory, a Deploy dialog that can run an open job now, and fixes for the hub and agent.
Tagged Windows agents can now scan against Microsoft's offline catalog and install update files from your distribution hub, for hosts that can't reach Microsoft Update.
ET Ducky agent 2.8.1.0 adds install paths, apps installed for one Windows user, and Microsoft Store packages to the installed-application inventory, with a refresh on demand.
Bind the VoiceStudio desktop app backend to your LAN with OMNIVOICE_BACKEND_CMD, a settings file, and a firewall rule so other devices can generate speech from the voices you designed.
How a Surface Pro X running Windows 11 on ARM64 is enrolled in ET Ducky, scripted from GitHub, updated from the dashboard, and kept in a kiosk profile, with lessons from running scripts.
Published pricing and features for ET Ducky and Atera in one table, from each vendor's pricing page and documentation, with billing model, endpoints, patching, and dated sources.
When Windows servers block all traffic until the firewall is turned off, find the deleted rules with firewall events 2033 and 2059, the active policy store, gpresult, and the audit log.
Tell a crash from a stop request when a service is inactive after an Ubuntu or Debian update, using systemctl status, apt history, the unattended-upgrades logs, needrestart, and journalctl.
Copy on select, text size, and full screen in the web shells and the serial console, shell sessions that fit a phone screen, a dark Fleet Tools terminal, and two documentation fixes.
Network Discovery keeps hosts the scan could not fingerprint in the agent-compatible Devices filter and out of Non-computers, and the Live Session run-as user label fits its toolbar.
Name the process behind a short CPU spike on a Linux server after the alert clears, using sar, atop history at a 60 second interval, systemd timers, the journal, and execsnoop.
Remote control permissions granted under Systems > Security, keyboard shortcut capture in remote desktop, Run as logged in user in Fleet Tools, and documentation search that keeps your query.
Published pricing and features for ET Ducky and Syncro in one table, from each vendor's pricing page and documentation, with billing model, endpoints, patching, and dated sources.
Find why a Windows 11 secure channel keeps failing after KB5124008 by checking Machine Identity Isolation, testing each domain controller, and reading Netlogon events and logs.
Per-agent settings for Windows sign-in screens and UAC prompts in remote desktop, an agent buffer limit, agent relinking after a restore, and a Recovery and Repair docs page.
Mobile remote desktop gets quick keys for common shortcuts, a Type button for the on-screen keyboard, and trackpad tap fixes. The agents table and top bar now render correctly on phones.
How an RMM agent gets data from a Linux host by polling /proc, the audit subsystem, or eBPF, what each can answer about something that already happened, and a ten-minute test on one host.
Checks that can report success without the thing they check being true, why review does not catch them, and the rule for adding verification that cannot pass vacuously.
A strategy for the unused members an AI-assisted codebase accumulates, covering which analyzer rules carry real signal, why the escalation order matters, and where static analysis stops helping.
A nightly load spike on a managed Postgres was the data-retention service itself. Why chunk drops replace per-org row DELETEs on a hypertable, and how ctid can delete rows in the wrong chunk.
The ET Ducky dashboard installs as a Progressive Web App on Android and iOS, delivers alerts through web push with on-call routing, and runs remote desktop sessions with touch controls.
Two ways to install the ET Ducky agent on an unmanaged host found by network discovery. A one-time enrollment link the host runs itself, and a gateway push over WinRM or SSH with a credential relay.
Why x11vnc fails on Wayland desktops and how to capture the screen and inject input through the xdg-desktop-portal ScreenCast and RemoteDesktop APIs, PipeWire, and GStreamer.
The Linux capture helper encodes H.264, the agent relays Annex-B NALUs over a WebSocket, and the dashboard decodes them with the WebCodecs VideoDecoder. Covers the wire format and keyframe recovery.
Eleven custom Roslyn analyzers built from production incidents and audit findings, with the conservative syntax rules, the greppable justification markers, and the runtime verification check.
Which Windows memory signals come from kernel keywords, which keywords only work on the NT Kernel Logger session, and the keyword set the ET Ducky memory-growth profile uses.
The winget package index is a downloadable msix holding a SQLite database. This post covers where the artifact lives, the packages table columns, name folding for matching, and the weekly refresh.
ET Ducky's Local-First tier runs the full stack on your own infrastructure as Docker images with unlimited agents at $650 per month. Covers licensing, identity, updates, and network egress.
NinjaOne is quote-only. Community reporting puts core RMM at $2.50 to $4.50 per endpoint per month, near $5 to $6 under 50 endpoints and below $2 at 1,000 or more endpoints.
Atera publishes per-technician pricing with unlimited endpoints. IT department plans run $149 to $219 per tech per month billed annually and MSP plans about $129 to $209, plus paid add-ons.
Syncro publishes per-user pricing with unlimited endpoints. Core is $129 per user per month billed annually ($159 monthly) and Team is $179 ($209 monthly), with RMM and PSA included.
RMMs reach a machine's hardware controller either through a separate Intel EMA server or from the RMM's own agent and gateway. Compares what each requires, where provisioning runs, and control mode.
How the ET Ducky agent relays out-of-band commands and configures dormant Intel AMT from the host, covering the MEI transport, AMTHI, the LME port-forwarding tunnel, and the WS-Man setup call.
ET Ducky manages business-class hardware below the operating system over Intel AMT, DASH, and IPMI. Covers the WS-Man discovery probe, device eligibility, power and console, and gateway hosting.
The out-of-band gateway inventories the hosts on its local network and marks which are not running the ET Ducky agent. Covers the admin-triggered sweep, MAC and hostname correlation, and the views.
How the Software Catalog resolves a third-party application by name, searching winget and the Linux fleet inventory first, falling back to an AI web search, and verifying installers before install.
How the ET Ducky agent hashes approved application binaries, how the cloud elects a per-organization trusted reference, and how on-disk tampering is detected and reported.
Two ways to detect malicious behavior in kernel telemetry. Signature and threshold rules match known-bad shapes, and a per-application fleet baseline learns normal and flags deviation from it.
When an application works on one Windows machine and fails on another, the cause is usually environmental. Record what the app touches with ETW and diff it against the broken machine.
How eBPF syscall tracepoints on Linux and ETW providers on Windows attribute a network connection to a process, why one is direct and the other requires correlation, and what each approach misses.
A reference for the ETW providers that see network activity on Windows, covering what Kernel-Network, TCPIP, and NDIS-PacketCapture emit and how to correlate a packet back to a process.
Kaseya doesn't publish prices. Community-reported VSA rates run $3 to $6 per device per month plus $1,000 to $10,000+ for setup. Kaseya 365 Endpoint is quoted per endpoint with a 50-endpoint minimum.
Datto RMM is quote-only, with no published per-endpoint rate. Covers the December 2025 move off high-watermark billing to committed minimum quantity billing and what RMM does not include.
ConnectWise RMM is quote-only across the Essentials, Pro, and Premium tiers. Community estimates put it at $1.50 to $3.50 per agent per month, with ScreenConnect Remote Access in every tier.
A walkthrough of an ET Ducky multi-agent session that diagnosed a host to VM ping failure across four machines, with the commands it ran, the settings it changed, and the verification step.
How ET Ducky's dynamic ETW agent picks providers for each investigation round, enforces capture caps inside the engine, and keeps raw events on the host while uploading counts only.
How the ET Ducky Windows helper meets the four uiAccess preconditions, captures the Winlogon secure desktop with GDI BitBlt, and injects input while a UAC prompt is on screen.
Four cross-platform behavioral rules cover shadow copy deletion, mass file rename to ransomware extensions, ransom note creation, and cryptominer execution, plus a kill-chain meta-rule.
The ET Ducky agent collects seven inventory domains on Linux and Windows at boot, every 24 hours, and on demand, storing each domain in its own JSONB column for Smart Reports queries.
ET Ducky's Linux agent attaches eBPF programs to scheduler and syscall tracepoints for kernel event capture, uses CO-RE and BTFHub for portability, and shares the Windows agent's pipeline.
A walkthrough of the thirteen cross-platform detection rules the ET Ducky agent ships with, covering exec chains, mass file access, ransom notes, shadow-copy deletion, backup sabotage, encryption sweeps, process ancestry, and crypto-miner command lines.
The ET Ducky agent captures the desktop with DXGI on Windows and the Wayland portal or x11vnc on Linux, encodes H.264 where hardware allows, and streams frames to a browser viewer.
ET Ducky's Linux agent runs as an unprivileged user. Root commands go through Run as root: a privilege owners hold or grant, a host opt-in file, and a record of every command.
Per-device and per-technician rates for eight RMM platforms in 2026, what each base price includes, worked costs for 800 endpoints, and a cost calculator, with sources and methodology.
How to capture an ETW trace on a slow Windows machine with logman, xperf, or wpr, which kernel providers cover CPU, disk, network, and memory, and the trace patterns that point to each cause.
Comparison of WMI polling, the Windows Event Log, and Event Tracing for Windows (ETW) as RMM data sources, covering sampling behavior, data volume, and the kernel events each one records.
How a two-stage pipeline correlates ETW events on the host and sends the reduced summary to an LLM, with an example IIS incident and the model output produced from it.