Software Management - Legacy UI

SECURITY  Refer to Permissions

NAVIGATION  Legacy UI > Account > Manage > Software Management

NAVIGATION  Legacy UI > Sites > select a site > Manage > Software Management

NAVIGATION  Legacy UI > Sites > select a site > Devices > select a device > Manage > Software Management

NAVIGATION  Legacy UI > Sites > select a site > Devices > select a device > Summary > Status > Software Status

Refer to Software Management.

IMPORTANT  If Advanced Software Management is activated for the Datto RMM account, Software Management must be executed exclusively in the New UI. Refer to Advanced Software Management.

About Software Management

Keeping software applications updated is a major part of any endpoint security strategy. Common third-party, internet-facing software applications like Adobe Reader and frameworks like Oracle Java may become a target of attacks because of possible vulnerabilities. Cyber attacks exploit security flaws. Therefore, maintaining and exercising application version control is imperative to any modern operation, and the Software Management feature was designed with this in mind.

Datto RMM Software Management has the following capabilities:

  • An automatic, policy-based approach to third-party software update management keeps endpoints updated with the latest versions of frameworks and applications.
  • Application update approval can be configured, and applications can be installed on an endpoint if they are not already present.
  • Built-in compliance reporting shows whether endpoints have the latest versions of critical applications and frameworks.

Once a Software Management policy is configured, you can use the Software Management dashboards at the account and site levels, and the Software Status page at the device level to have an overview of the software compliance status of your devices. Refer to Software Management at the account and site levels and Software Management at the device level.

NOTE  The third-party software applications you want to manage through a Software Management policy do not have to be downloaded from the ComStore. A Software Management policy can be configured independently of what's already present in your Component Library.

NOTE  Datto RMM uses Aria2, an open source download manager, to download software packages for Software Management.

User-level vs. system-level software installations

Some software can be installed at the user level or the system level. As a systems management tool, Datto RMM is only aware of and can only manage system-level installations of software applications. In the event of a clash between user- and system-level software installations, such as the same application being installed via Software Management but already existing at the user level, all user-level copies of the software will be removed in favor of system-level installations.

The primary goal of Software Management is to ensure that critical software applications and frameworks are always up to date. The following applications and operating systems are supported:

Name Windows macOS Notes
7-Zip   You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Adobe Acrobat Reader DC macOS devices cannot update the software if it is in use. The installation will fail in such cases.
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Adobe AIR  
Bitdefender Endpoint Security Tools   You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.

NOTE  The Latest Version field for Bitdefender, Microsoft Teams, and Webroot SecureAnywhere is static and does not change. Datto RMM Software Management is only concerned with deployment for these applications; once installed, the applications will update themselves without Software Management's involvement.
Citrix Workspace You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Datto File Protection When installing, Datto File Protection Team Keys can be automatically provisioned using the site variable usrDFPTeamKeySITE.
Datto Workplace Classic When installing, Datto Workplace Team Keys can be automatically provisioned using the site variable usrDWPTeamKeySITE.
FileZilla Client The software cannot be updated whilst it is in use.
On Windows devices, you must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Foxit Reader   The software cannot be updated whilst it is in use.
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Google Chrome You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Java Runtime Environment Old versions of Java are not removed by default. Map a site- or account-level variable named usrJavaClean with the value true to instruct the installer to remove old versions at installation time.
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Microsoft Office 365   Two channel types are available, since each Channel has a different "latest version" value.
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Microsoft Teams   You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.

NOTE  The Latest Version field for Bitdefender, Microsoft Teams, and Webroot SecureAnywhere is static and does not change. Datto RMM Software Management is only concerned with deployment for these applications; once installed, the applications will update themselves without Software Management's involvement.
Mozilla Firefox You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Mozilla Thunderbird You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Notepad++   You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Paint.NET   You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
PuTTY   You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Skype Since Skype is set to run on boot, the macOS installer will restart Skype if it is running in order to update it.
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
VLC Media Player On Windows, installing VLC Media Player will automatically register the program as the default media player for all supported media types.
On macOS, the installation process will remove any existing copies of the VLC Media Player software before installing the latest version.
On Windows devices, you must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
VMWare Tools   You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.
Webroot SecureAnywhere Endpoint Protection When installing, a Webroot license can be automatically provisioned using the site variable usrWRSASerialSITE.
You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.

NOTE  The Latest Version field for Bitdefender, Microsoft Teams, and Webroot SecureAnywhere is static and does not change. Datto RMM Software Management is only concerned with deployment for these applications; once installed, the applications will update themselves without Software Management's involvement.
Zoom   You must add the download URL to the allowlist. Refer to ComStore component and Software Management URLs.

NOTE  The list of supported applications is expected to grow over time. If you have a suggestion, please post it in the RMM Ideas Portal.

The Datto RMM team continuously monitors for the vendors of the Managed applications to determine if new versions are available. Any new version will go through a quality assurance process to determine if the installer logic works and if the update is deployed successfully.

Applications are tested to ensure they install properly. Datto RMM staff do not test to ensure programs have benefited substantially from the update process.

New applications are tested and available within two business days after becoming available from the vendor.

Application updates will be in the same language as the previous version of the application. In the case of new installations, the application installer logic will determine the best application language for the Managed endpoint.

You can also find all application updates in the ComStore as regular Application components. Refer to ComStore - Legacy UI. Like with other components, you can inspect the files and code used in any of these components by copying them from within your Component library. Refer to Managing components - Legacy UI.

Depending on the Software Management operation you would like to initiate at either the account, site, or device level, various permissions are required. For further information, refer to the tables below.

To learn how to configure the permissions, refer to Security levels - Legacy UI.

Permissions Description Notes
• Account > Manage > None • Manage tab is not displayed.  
• Account > Manage > View
• Account > Policies > View		 • Manage > Software Management is displayed.
• Software Management policies can be viewed but not edited or created.
• Application updates cannot be approved.		 • Without permission to view policies, the Software Management section is not displayed on the Manage tab.
• Account > Manage > Manage
• Account > Policies > Manage		 • Software Management policies can be viewed, edited, and created.
• Application updates can be approved.		 • Without permission to manage policies, Software Management policies cannot be edited (the Save button is not displayed) or created.
Permissions Description Notes
• Sites > Manage > None • Manage tab is not displayed or access is denied.  
• Sites > Manage > View
• Sites > Policies > View		 • Manage > Software Management is displayed.
• Software Management policies can be viewed but not edited or created.
• Application updates cannot be approved.		 • Without permission to view policies, the Software Management section is not displayed on the Manage tab.
• At the device level, Account-level, or site-level, Software Management policies can only be enabled or disabled if you have Account > Policies > Manage or Sites > Policies > Manage permission, respectively.
• Sites > Manage > Manage
• Sites > Policies > Manage
• Sites > Devices > Manage		 • Software Management policies can be viewed, edited, and created.
• Application updates can be approved.		 • Without permission to manage policies, Software Management policies cannot be edited (the Save button is not displayed) or created.
• Without permission to manage devices, application updates cannot be approved at the device level.
• At the device level, account-level or site-level Software Management policies can only be enabled or disabled if you have Account > Policies > Manage or Sites > Policies > Manage permission, respectively.

Application updates can be configured using a Software Management policy. Refer to Create a Software Management policy - Legacy UI

The Software Management page at the account and site levels displays software compliance status across your devices. You can quickly find devices that are not compliant and approve software updates right from the dashboards. An account-level approval will approve an update for all devices in the account, while a site-level approval will approve an update for all devices in the site in question.

The pie chart displays the number of compliant and non-compliant devices targeted by a Software Management policy. For more information, refer to Software Status.

NOTE  If the pie chart is empty and no filter has been applied to narrow the results, it indicates that there are no active (enabled) Software Management policies at either the account or site level.

Field Description
Column Chooser The Column Chooser allows you to select which columns should be visible in the list.
Show me 25 / 50 / 100 per page Select to show 25 / 50 / 100 entries per page. 50 is selected by default.
Actions Select any of the items and click one of the following actions:
• Request device audit(s)
• Schedule a job
• Run a quick job
• Export to CSV

NOTE  Microsoft Excel is unable to properly display UTF-8 compliant CSV files when they contain non-English characters.

• Refresh
For further information, refer to Action bar icons.
Policy Select a Software Management policy. Account-level policies are listed at both the account and site level, while site-level policies are only listed at the site level. By default, no policy is selected.
Type Select one of the following options:
• All - Selected by default.
• All Windows
• All Mac
• All Windows Servers
• All Windows Workstations
Software Status Select one of the following options:
• All - Selected by default.
• Not Compliant
• Compliant
• Unmanaged
Search Enter any text and click Search to narrow the results. For further information, hover over the Search Help icon next to the Search button.

NOTE  With the exception of the Policy, Last Run, and Schedule columns, click any of the column names to sort the data.

The following columns are displayed by default:

Field Description
Selection check box Check to select any of the devices.
Context menu Refer to Context menu.
Device status icon Shows the online / offline status, privacy status, and Network Node status of the device.
Site Name The name of the site that the device is associated with. Click the hyperlink to open the site summary page. Refer to Site summary - Legacy UI.
Device Hostname The name of the device. Click the hyperlink to open the device summary page. Refer to Device summary - Legacy UI.
Device Description The description of the device. This can be edited on the device summary page. Refer to Device summary - Legacy UI.
Policy The name of the Software Management policy that targets the device. Click the hyperlink to open the policy. Refer to Create a Software Management policy - Legacy UI.
Last Run Date, time, and time zone when the Software Management policy last ran.
Schedule The schedule of the Software Management policy.
Software Status The software status of the device. For more information, refer to Software Status.

The following details are displayed:

Field Description
Application Name The name of the supported application.
Latest Version The latest available version of the application on the following operating systems:
• Windows 32-bit
• Windows 64-bit
• macOS
For further information, refer to Supported software applications and operating systems.

NOTE  The Latest Version field for Bitdefender, Microsoft Teams, and Webroot SecureAnywhere is static and does not change. Datto RMM Software Management is only concerned with deployment for these applications; once installed, the applications will update themselves without Software Management's involvement.
Not Compliant Displays the number of devices whose software status is not compliant. Click the hyperlinked number to open the list of devices. The number 0 does not have a hyperlink.
Approve button Click the Approve button to approve the installation of the software application. The application will be installed instantly.
The button is only present if the policy Action is Manual Approve or Manual Approve + Install if not present AND the managed application's Status is Not Compliant.

IMPORTANT  Once an update has been approved, the action cannot be reversed.

The Software Management page at the device level shows what applications and versions are currently installed on a particular device, and what the latest available version is for that application. You can approve an update right from the list of Managed Applications.

The following details are displayed:

Field Description
Software Status A device's software status can be:
• Compliant - The status of all managed applications is Compliant.
• Not Compliant - The status of any of the managed applications is Not Compliant.
• Unmanaged - The device is not targeted by any Software Management policy.
For more information on the status of managed applications, refer to Status.
Policies The Software Management policies that target the device.
• Name - The name of the Software Management policy. Click the hyperlink to edit the policy. Refer to Create a Software Management policy - Legacy UI.
• Last Activity - Date, time, and time zone to reflect the last activity (approval or installation) for the Software Management policy.
• Schedule - The schedule of the Software Management policy.
• Enabled - A toggle to turn the policy ON or OFF for the device.

IMPORTANT  Only one Software Management policy can be enabled per device.

Managed Applications

NOTE  This section is only displayed if a Software Management policy is enabled for the device.

Field Description
Name The name of the supported application. Refer to Supported software applications and operating systems.
Installed Version The installed version of the application.
Latest Version The latest available version of the application.

NOTE  The Latest Version field for Bitdefender, Microsoft Teams, and Webroot SecureAnywhere is static and does not change. Datto RMM Software Management is only concerned with deployment for these applications; once installed, the applications will update themselves without Software Management's involvement.
Action The Software Management policy action as specified in the policy details. Refer to Create a Software Management policy - Legacy UI.
Status The following statuses may be displayed:
• Compliant - The installed version matches the latest version.
• Not Compliant - The installed version does not match the latest version.
• Unmanaged - Policy action is set to Unmanaged.
• Install Error - The last activity resulted in failure.
To see how software compliance is determined through a Software Management policy, refer to Compliance Reporting.
Stdout/Stderr Click the icon to view the Stdout (standard output) or Stderr (standard error) message for the last activity on the device.
Approve button Click the Approve button to approve the installation of the software application. The application will be installed instantly.
The button is only present if the policy Action is Manual Approve or Manual Approve + Install if not present AND the managed application's Status is Not Compliant.

IMPORTANT  Once an update has been approved, the action cannot be reversed.

Software Status is available in the column chooser on device list pages, as a filter criterion, and through the API.

Software compliance reporting can be done using the Device Health Summary and Executive Summary reports. Refer to Report scheduler - Legacy UI.

Although software compliance status changes are instantly displayed on Software Management pages, it may take up to 24 hours for the changes to be reflected on audit pages. Refer to View audit data at the account or site level and View audit data at the device level.