Endpoint Management for Shared and Public-Access Devices: What Standard RMM Misses

Multiple people use shared and public-access devices throughout the day. Each session can leave changes on the device that persist into subsequent sessions.

Remote monitoring and management (RMM) software is widely used to manage endpoints, but it has limitations on shared and public-access devices. Read on as we cover those limitations and explain how Reboot-to-Restore addresses them.

Limitations of Standard RMM for Shared and Public-Access Devices

RMM tools combine continuous monitoring with remote administration through an agent that reports endpoint health and status to a central console. On shared and public-access devices, this approach has four key limitations.

• Configuration Persistence

Changes made during a session are written to the device’s disk and persist after sign-out and restart unless removed. On shared devices, these changes accumulate across sessions, causing configuration drift as the device diverges from its approved configuration.

RMM tools can correct specific settings by checking whether each one matches its expected value and running a script when it doesn’t. Those checks cover only what an administrator has set them to look for. Anything outside that scope stays in place until someone finds and reverses it.

• Unauthorized Software

Users can install unapproved software on shared devices. Standard RMM detects it only after installation. Scheduled inventory audits record installed software, and policies can flag programs on a prohibited list. Neither prevents the installation.

Removal requires a separate action by script or a technician after the software is flagged. Until then, it remains installed and can persist across multiple user sessions.

• User Access Controls

RMM access controls govern IT personnel and determine which technicians can manage or remotely control specific devices. They do not control user activity on those devices.

User restrictions are primarily enforced through operating system permissions and Group Policy settings, which RMM can help deploy. A standard account without administrator rights can still modify certain settings, save files, and install some applications. On shared accounts, these changes and files remain available to subsequent users.

• Endpoint State Restoration

RMM addresses identified issues through targeted fixes. Standard RMM has no mechanism to automatically restore an entire device to its approved configuration.

When targeted fixes are insufficient, recovery typically requires reimaging from a stored image or restoring from a backup. Both require technician intervention and take the device out of service during recovery. Neither provides a practical method for resetting a device between sessions.

Reboot-to-Restore for Shared and Public-Access Devices

Reboot-to-Restore is an endpoint protection method that restores a device to a defined baseline when it restarts. The administrator defines the baseline as the device’s approved configuration. While protection is enabled, changes made during a session are temporary.

This approach addresses the gaps in standard RMM through four key capabilities:

• Automated state restoration: Session changes are redirected to a temporary area, leaving the protected baseline unchanged. At restart, the changes are discarded, and the device returns to the baseline. Restarts can be scheduled or triggered at user sign-out.
• Consistent endpoint states: Each restart restores the device to the same baseline, maintaining a consistent configuration across sessions and devices. Devices using the same baseline remain aligned because session changes do not persist.

• Reduced administrative intervention: Session-related issues, including configuration changes and unwanted software, are cleared at the next restart. Because session changes do not persist, IT can resolve these issues without identifying individual changes or reimaging the device.

• Minimized configuration drift: The baseline changes only when an administrator updates it, typically during a scheduled maintenance window. Protection is suspended during maintenance, so approved updates and software become part of the baseline. Session changes are discarded at restart, preventing accumulation.

Reboot-to-Restore complements monitoring and patching by allowing session changes while discarding them at the next restart. Standard RMM has no equivalent mechanism.

Discover Deep Freeze Cloud

Deep Freeze Cloud combines Reboot-to-Restore protection with centralized management through a web-based console. IT teams can define baselines, schedule maintenance windows, and manage shared and public-access devices across multiple sites from a central location.

Discover Deep Freeze Cloud.