Software Management
Security and navigation
SECURITY Refer to Global > Manage and Global > Policies in Permissions.
SECURITY Refer to Sites > Manage and Sites > Policies in Permissions.
NAVIGATION Global > Software Management
NAVIGATION Sites > All Sites > click the name of a site > Software Management (left navigation menu)
NAVIGATION Device summary page > Software card > Managed. To view the various navigation paths you can use to access the device summary page, refer to Device summary.
About Software Management
Keeping software applications updated is a major part of any endpoint security strategy. Common third-party, internet-facing software applications like Adobe Reader and frameworks like Oracle Java may become a target of attacks because of possible vulnerabilities. Cyber attacks exploit security flaws. Therefore, maintaining and exercising application version control is imperative to any modern operation, and the Software Management feature was designed with this in mind.
Datto RMM Software Management has the following capabilities:
- An automatic, policy-based approach to third-party software update management keeps endpoints updated with the latest versions of frameworks and applications.
- Application update approval can be configured, and applications can be installed on an endpoint if they are not already present.
- Built-in compliance reporting shows whether endpoints have the latest versions of critical applications and frameworks.
Once a Software Management policy is configured, you can use the following tools to manage and monitor the software compliance statuses of your devices:
- Software Management pages at the global and site levels. Refer to Software Management summary list.
- The Software card at the device level. Refer to Software in Device summary.
- The Software Management Status widget. Refer to Software Management Status in Widget Library.
NOTE The third-party software applications you want to manage through a Software Management policy do not have to be downloaded from the ComStore. A Software Management policy can be configured independently of what's already present in your Component Library.
NOTE Datto RMM uses Aria2, an open source download manager, to download software packages for Software Management.
Advanced Software Management
While Datto RMM's standard Software Management functionality updates key applications, the Advanced Software Management module integrates an expanded library of software applications and enables both installation and uninstallation via a Software Management policy.
For an overview of the Advanced Software Management functionality available in Datto RMM and how to activate this paid-for add-on, refer to Advanced Software Management.
User-level vs. system-level software installations
Some software can be installed at the user level or the system level. As a systems management tool, Datto RMM is only aware of and can only manage system-level installations of software applications. In the event of a clash between user- and system-level software installations, such as the same application being installed via Software Management but already existing at the user level, all user-level copies of the software will be removed in favor of system-level installations.
Supported software applications and operating systems
The primary goal of Software Management is to ensure that critical software applications and frameworks are always up to date.
The following applications and operating systems are supported through standard Software Management.
Activating the Advanced Software Management module expands your third-party patching coverage to 200+ out-of-the-box third-party software applications. For a complete list, refer to Advanced Software Management application catalog.
| Name | Windows | macOS | Notes |
|---|---|---|---|
| 7-Zip |
|
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
|
| Adobe Acrobat Reader DC |
|
|
macOS devices cannot update the software if it is in use. The installation will fail in such cases. You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
| Adobe AIR |
|
|
|
| Bitdefender Endpoint Security Tools |
|
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. NOTE The Latest Version field for Bitdefender, Microsoft Teams, and Webroot SecureAnywhere is static and does not change. Datto RMM Software Management is only concerned with deployment for these applications; once installed, the applications will update themselves without Software Management's involvement. |
|
| Citrix Workspace |
|
|
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
| Datto File Protection |
|
|
When installing, Datto File Protection Team Keys can be automatically provisioned using the site variable usrDFPTeamKeySITE. |
| Datto Secure Edge |
|
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. | |
| Datto Workplace Classic |
|
|
When installing, Datto Workplace Team Keys can be automatically provisioned using the site variable usrDWPTeamKeySITE. |
| FileZilla Client |
|
|
The software cannot be updated whilst it is in use. On Windows devices, you must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
| Foxit Reader |
|
The software cannot be updated whilst it is in use. You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
|
| Google Chrome |
|
|
For Windows devices, a site-level or global variable named usrChrome64Override can be mapped with the value true to force compatible machines to always install/upgrade to 64-bit Chrome and ignore whatever was previously installed. You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
| Java Runtime Environment |
|
|
Old versions of Java are not removed by default. Map a site- or account-level variable named usrJavaClean with the value true to instruct the installer to remove old versions at installation time. You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
| Microsoft Office 365 |
|
Two channel types are available since each channel has a different latest version value. Use the Microsoft Office 365 Configuration Tool component to produce an XML which Software Management will recognize during installation. The installer will use default values otherwise. You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
|
| Microsoft Teams |
|
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. NOTE The Latest Version field for Bitdefender, Microsoft Teams, and Webroot SecureAnywhere is static and does not change. Datto RMM Software Management is only concerned with deployment for these applications; once installed, the applications will update themselves without Software Management's involvement. |
|
| Mozilla Firefox |
|
|
For Windows devices, a Site- or Account-level variable named usrFirefoxESRSwitch can be mapped with the value true to forcibly upgrade Firefox ESR installations to the latest mainline release. ESR installations will be left alone otherwise. You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
| Mozilla Thunderbird |
|
|
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
| Notepad++ |
|
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. | |
| Paint.NET |
|
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. | |
| PuTTY |
|
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. | |
| Skype |
|
|
Since Skype is set to run on boot, the macOS installer will restart Skype if it is running in order to update it. You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
| VLC Media Player |
|
|
On Windows, installing VLC Media Player will automatically register the program as the default media player for all supported media types. On macOS, the installation process will remove any existing copies of the VLC Media Player software before installing the latest version. On Windows devices, you must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
| VMWare Tools |
|
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. | |
| Webroot SecureAnywhere Endpoint Protection |
|
|
When installing, a Webroot license can be automatically provisioned using the site variable usrWRSASerialSITE. You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. NOTE The Latest Version field for Bitdefender, Microsoft Teams, and Webroot SecureAnywhere is static and does not change. Datto RMM Software Management is only concerned with deployment for these applications; once installed, the applications will update themselves without Software Management's involvement. |
| Zoom |
|
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs. |
NOTE The list of supported applications is expected to grow over time. If you have a suggestion, please post it in the RMM Ideas Portal.
NOTE Software Management icons may display a Windows flag in the corner. This is temporary and due to be fixed. Many Software Management definitions support both Windows and macOS; the Windows flag can be ignored.
Application update quality assurance
NOTE The following information applies to the applications covered as part of standard Software Management. For details about the tier-based update system used when Advanced Software Management is activated for the Datto RMM account, refer to Tier-based software update system in Advanced Software Management.
The Datto RMM team continuously monitors for the vendors of the Managed applications to determine if new versions are available. Any new version will go through a quality assurance process to determine if the installer logic works and if the update is deployed successfully.
Applications are tested to ensure they install properly. The Datto RMM team does not test to ensure programs have benefited substantially from the update process.
New applications are tested and available within two business days after becoming available from the vendor.
Application updates will be in the same language as the previous version of the application. In the case of new installations, the application installer logic will determine the best application language for the Managed endpoint.
You can also find all application updates in the ComStore as regular Applications components. Refer to ComStore. Like with other components, you can inspect the files and code used in any of these components by copying them from within the Component Library. Refer to Component Library.
ComStore components used for Software Management are configured to wait for application installers to finish installing before the component script concludes, ensuring proper execution and preventing premature cleanup of the working directory.
Software Management policy
Application updates can be configured using a Software Management policy. Refer to Software Management policy.
Software Management reporting
The Device Health Summary and Executive Summary reports provide data on software compliance. Refer to Reports.
Software Management actions are also recorded in the Activities card on the device summary page. Refer to Activities in Device summary.
Software status
The following resources show Managed software compliance statuses:
The overall software status of a device
- The Software Status field via the Column Chooser in a list of devices. Refer to Software Status in Column Chooser - Devices.
- The Software Status field in the Summary card. Refer to Summary in Device summary.
The overall software status of a set of devices
- The Software Management Status widget. Refer to Software Management Status in Widget Library.
- The Software Status filter criterion. Refer to Criteria in Device filters.
The software status of a device for a specific application
- The Status field in the Software card. Refer to Status in Device summary.
The software status of a set of devices for a specific application
- The Software Status field in the Software Management summary list. Refer to Software Status in Column Chooser - Software Management.
Software status information is also available via the API. Refer to Datto RMM API.
A device may have one of the following statuses:
- Compliant: The device is approved for the latest Managed software update(s).
- Unmanaged: The device is not targeted by any Software Management policy.
- Non Compliant: The device is not approved for the latest Managed software update(s). The Software card for the device provides full details and the option to approve software update(s), if applicable. Refer to Software in Device summary.
To learn how to control whether software approval and installation are manual, are automatic, or do not require management, refer to Software or Advanced Software in Software Management policy.
Software Management summary list
Navigate to the Software Management page by following either of the first two navigation paths described in Security and navigation.
The page shows a summary of Managed software compliance on devices and the need for manual approval of software updates.
NOTE If you're seeking a complete list of software installed on devices, refer to Software.
At the top of the page, click any of the following categories to filter the list:
| Category | Description |
|---|---|
| Approval Required | Displays the Managed software for which a certain number of devices is non-compliant, meaning the latest version of that type of software is not yet approved for the device(s). Manual approval is required for the device(s) to be considered compliant. |
| Non Compliant | Displays the Managed software for which a certain number of devices is non-compliant, meaning the latest version of that type of software is not yet approved for the device(s). Certain devices may require manual approval (Approval Required status is Yes), and others may not have manual approval available at this time (Approval Required status is No). |
| Compliant | Displays the Managed software for which a certain number of devices is compliant, meaning the latest version of that type of software is approved for the device(s). |
To learn how to control whether software approval and installation are manual, are automatic, or do not require management, refer to Software or Advanced Software in Software Management policy.
The Column Chooser allows you to select which columns should be visible in the list. Refer to Column Chooser field definitions for descriptions of all of the available fields. Selecting the Type/Versioncheck box causes both the Type and Latest version columns to show in the table. The columns can be reordered and resized. The order and size of the columns will persist the next time the page is accessed.
You can filter any columns with the filter icon 
. The Filtered by bar displays all applied column filters. If a filter search term includes wildcard characters (for example, underscores and percent signs), they serve as normal characters if they are preceded by a backslash. For details, refer to Wildcard characters. Click the X next to any filter to remove that filter or click Reset Filters to remove all filters. If no filter is applied, the Filtered by bar displays Unfiltered. The filter selection in the columns will persist the next time the page is accessed.
The table density is set to condensed theme by default. To change it to relaxed theme, click the density toggle icon. The selection will persist across all pages.
The number of results displayed can be specified by selecting the desired number from the pagination control. This selection will persist the next time the page is accessed.
Action buttons
To access all action buttons, click the Row Actions icon.
The action buttons are grayed out or become unavailable if no row is selected in the table or if the action button is not applicable to the selected rows. The check boxes allow you to select one or more rows. Select all rows shown on a page by selecting the check box in the table header. You can also use the drop-down arrow next to the check box in the table header to choose one of the following options: Select none, Select all on page, or Select all rows across all pages. If you choose to select all rows across all pages, the check boxes of the rows will not be selected; however, the page will indicate that all rows have been selected.
NOTE When all rows are selected across all pages, only certain action buttons are supported, which is indicated in the All Rows column in the table below.
| Action Button | All Rows | Description |
|---|---|---|
| Approve |
|
Allows you to approve software updates for Managed applications on the selected device(s). This action is available only if the software status for that particular type and version of software on the device(s) is non-compliant and approval is required. This occurs once a software update becomes available and either Manually approve or Manually approve and install if not present is selected for that application within the policy. Refer to Software or Advanced Software in Software Management policy. In the confirmation dialog box that appears, click Confirm to manually approve the software update or Cancel to close out of the dialog box. Clicking Confirm will cause the Software Status of the selected device(s) to change to Compliant for that application once the action is executed. This action adheres to the deployment window scheduled in the policy. Refer to Timing in Software Management policy. |
| Export Selected Rows to CSV |
|
In the confirmation dialog box that appears, select whether to show table headers in the file by turning on the toggle for Show table headers in the exported CSV. Click Confirm to download the file or Cancel to close out of the dialog box. Any column selections, filters, and sorting that have been applied to the table will also be applied in the CSV file. |
| Export All Rows to CSV |
|
This action button is available only if all rows have been selected across all pages in the table. In the confirmation dialog box that appears, click Confirm to download the file or Cancel to close out of the dialog box. Pop-up notifications will inform you of the start and completion of the CSV export action. Click the X to close the notification; otherwise, the notification will automatically be cleared after five minutes. Any column selections, filters, and sorting that have been applied to the table will also be applied in the CSV file. |
| Uncheck All |
|
Clears all selected rows. The number of selected rows is indicated next to the Row Actions icon. |
Software card
Navigate to the Managed section of the Software card by following the third navigation path described in Security and navigation. A Software Management policy must be targeting the device in order for Managed software to be displayed.
Refer to Software in Device summary.
