Standard configuration for the Xzopia TacticalRMM deployment at rmm.xzopiasecure.com.
Apply these settings after a fresh TacticalRMM install to bring it to the Xzopia baseline.
Three policies cover all device types. Assign during onboarding — do not leave devices unassigned.
Applied to all Windows workstations and laptops.
| Check | Threshold | Alert | Action |
|---|---|---|---|
| CPU usage | >90% for 5 min | Warning | Create ticket |
| RAM usage | >85% | Warning | Create ticket |
| Disk usage (all drives) | >85% | Warning | Create ticket |
| Connectivity (ICMP to 8.8.8.8) | Timeout >30s | Critical | Create ticket + SMS |
| Windows Defender / AV status | Not running or definitions >7 days | Critical | Create ticket + SMS |
| Windows Update service | Stopped | Warning | Auto-start service |
| Last reboot | >30 days | Info | Daily digest |
| Event log critical errors | Any Event ID 41, 6008, 1001 | Warning | Create ticket |
| Disk S.M.A.R.T. status | Failing or unknown | Critical | Create ticket + SMS |
Applied to all Windows Server instances.
| Check | Threshold | Alert | Action |
|---|---|---|---|
| CPU usage | >90% for 5 min | Warning | Create ticket |
| RAM usage | >85% | Critical | Create ticket + SMS |
| Disk usage (all drives) | >80% | Warning | Create ticket |
| Connectivity (ICMP to 8.8.8.8) | Timeout >30s | Critical | Create ticket + SMS |
| Windows Defender / AV status | Not running or definitions >7 days | Critical | Create ticket + SMS |
| Windows Update service | Stopped | Critical | Create ticket + SMS |
| Last reboot | >30 days | Warning | Create ticket |
| Event log critical errors | Any Event ID 41, 6008, 1001 | Critical | Create ticket + SMS |
| Backup job last run | >48 hours | Warning | Create ticket |
| Key services (varies per client) | Stopped | Critical | Create ticket + SMS |
Applied to all macOS devices.
| Check | Threshold | Alert | Action |
|---|---|---|---|
| CPU usage | >90% for 5 min | Warning | Create ticket |
| RAM usage | >85% | Warning | Create ticket |
| Disk usage | >85% | Warning | Create ticket |
| Connectivity (ping 8.8.8.8) | Timeout >30s | Critical | Create ticket + SMS |
| macOS Gatekeeper | Disabled | Critical | Create ticket + SMS |
| Last reboot | >30 days | Info | Daily digest |
| FileVault encryption | Disabled | Warning | Create ticket |
| SIP (System Integrity Protection) | Disabled | Critical | Create ticket + SMS |
Runs every Sunday at 03:00 via scheduled task. Updates all third-party applications
managed by winget that are not pinned.
Script location in TacticalRMM: Scripts → Community → xzopia-winget-update
# xzopia-winget-update.ps1
# Runs weekly via TRMM scheduled task. Updates all upgradeable winget packages.
# Skips: Microsoft packages (covered by Windows Update), pinned packages.
$log = "$env:TEMP\winget_update_$(Get-Date -Format 'yyyyMMdd').log"
"[$(Get-Date)] Starting winget upgrade" | Tee-Object -FilePath $log
# Check winget available
if (-not (Get-Command winget -ErrorAction SilentlyContinue)) {
"winget not found — skipping" | Tee-Object -FilePath $log -Append
exit 0
}
# Run upgrade — exclude Microsoft source (Windows Update handles those)
$result = winget upgrade --all --include-unknown --accept-package-agreements `
--accept-source-agreements --silent 2>&1
$result | Tee-Object -FilePath $log -Append
"[$(Get-Date)] Upgrade complete" | Tee-Object -FilePath $log -Append
Write-Output "WINGET_UPDATE=COMPLETE"
Scheduled task configuration:
Runs automatically on first agent check-in via the Xzopia-Onboarding automation policy.
Assigned to the Pending Onboarding client group; moved to the correct client group by
TacticalRMM after script completes successfully.
Three actions in sequence:
See scripts/windows/deploy-teamviewer.ps1.
Required TRMM script variables:
global.teamviewer_config_id (from Vaultwarden)global.teamviewer_assign_token (from Vaultwarden)client.name → Client group nameSilent MSI install with site token from Vaultwarden.
Script variables:
global.sentinelone_site_tokenglobal.sentinelone_installer_urlCreates a new asset record in ITFlow at psa.xzopiasecure.com using the REST API.
Fields populated automatically: hostname, OS, RAM, CPU, serial number, client association.
# Partial example — full script in TRMM script library
$body = @{
asset_name = $env:COMPUTERNAME
asset_type = "Workstation"
client_id = $ClientID # resolved from TRMM client ID → ITFlow client ID mapping
os = (Get-WmiObject Win32_OperatingSystem).Caption
serial = (Get-WmiObject Win32_BIOS).SerialNumber
} | ConvertTo-Json
Invoke-RestMethod -Uri "https://psa.xzopiasecure.com/api/v1/assets" `
-Method POST -Body $body -ContentType "application/json" `
-Headers @{ Authorization = "Bearer $ITFlowAPIKey" }
Triggered by: connectivity loss, AV failure, disk failing, server RAM >85%, reboot overdue on server.
Triggered by: CPU/RAM/disk thresholds, Windows Update service stopped, event log errors.
Triggered by: reboot >30 days, minor informational events.
Import these scripts from the TacticalRMM community library on initial setup:
| Script | Purpose |
|---|---|
Get-InstalledSoftware |
Full installed software inventory |
Get-BitLockerStatus |
BitLocker recovery key retrieval and status |
Invoke-WingetUpgrade |
Winget bulk upgrade (see above for Xzopia version) |
Test-InternetSpeed |
Speedtest via Ookla CLI |
Get-WindowsActivationStatus |
Check Windows licence status |
Repair-WindowsUpdate |
Reset Windows Update components |
Get-LocalAdmins |
List local administrator accounts |
Remove-BloatwareApps |
Remove pre-installed bloatware |
Enable-BitLocker |
Enable BitLocker with escrow to TRMM |
Set-TimeZone |
Set correct time zone from TRMM client field |
Scripts are imported via Settings → Scripts → Community Scripts.