What endpoint remediation actually covers
Endpoint remediation is the stretch of work between an alert that says a machine is unhealthy and the machine being healthy again: finding the cause, changing the right setting, and proving the change held. Done by hand it means remoting in to every device. Done with scripts it means someone wrote the right script before the problem appeared.
Remediation software closes that gap by doing the investigation on the device itself. The questions that separate one product from another are how it decides what to run, who has to agree to a change, and what proves a fix worked. The sections below answer those for RemediateDesk.
Operating systems and how they install
| Platform | Install | Notes |
|---|---|---|
| Windows | One MSI per machine | The longest production history of the three |
| macOS | One command, Intel and Apple silicon | A single static binary; no runtime to install first |
| Linux | One command, amd64 and arm64 | Installs as a systemd service; same single binary |
Fleets that already run ConnectWise RMM or Automate can push the agent from there instead of visiting each machine. The macOS and Linux agents are newer than the Windows one, and we say so rather than imply equal mileage.
How the agent connects
The agent only dials out. It holds a TLS connection to our broker and receives instructions over it, so no inbound firewall rule is opened at the client site. Each machine has its own certificate, issued when it registers with an install key.
It updates itself, once a night at about 3 a.m. local time, plus a check shortly after the service starts. A laptop that is switched off at 3 a.m. therefore still catches up the next time it is on.
Every command is classified before it runs
Commands fall into three tiers, decided in code and not left to the model:
- Read-only, such as listing services or reading a log.
- Changes something, such as restarting a service or editing a registry value.
- Blocked, such as wiping a disk or deleting shadow copies. These do not run even if someone clicks approve.
On top of the built-in list your administrators maintain two more: commands that are never allowed, and commands that always need a person even on a machine set to run everything. Both are enforced at the point of dispatch, not just when the AI proposes the command, so a rule added after a proposal still applies to it.
A way back for the common changes
For four kinds of change on Windows - a registry value or key, a service's start mode and state, a file deletion and DNS settings - the agent takes a snapshot first and the chat offers a one-click undo for that step. Reinstalling software or running Windows Update has no such snapshot, and the page in the product says which is which.
Verification, limits and cost
A session cannot be marked resolved until a check that is separate from the fix has run. If the AI makes several fix attempts without converging it stops, and it can end a session honestly as “insufficient evidence” with a recommended action for a technician.
Pricing is published: a base fee, a per-endpoint rate that tapers, a flat plan for larger fleets, and a small charge for each ticket actually resolved. The numbers are on the pricing page, where a calculator uses the same constants the billing code does.
Frequently asked questions
What is endpoint remediation software?
It is software that finds and corrects faults on managed devices, rather than only reporting them. The useful versions investigate the specific machine, make a change only under defined controls, and check that the original problem has gone before reporting success.
Which operating systems can it remediate?
Windows, macOS and Linux. Windows installs from an MSI and the other two from a single command and one static binary. The Windows agent has the longest production history of the three.
Can it change a machine without anyone approving it?
Only where you allow it. Read-only checks can run on their own, changes wait for a person's approval, some commands are blocked outright, and your administrators can add their own never-allowed and always-ask lists on top.
Is endpoint remediation the same as patching?
No. Patching applies vendor updates on a schedule. Remediation responds to a specific fault, such as a stopped service, a full disk or a broken resolver setting, and is judged by whether that fault is gone afterwards.