Skip to main content

Installed Remote Access Tool Audit

Purpose​

The purpose of this solution is to identify a curated set of remote access tools using multiple detection methods, uninstall registry entries, running processes, running services, and common executable paths. It supports exclusions from both script variable and a Ninja custom field. The results are compiled into an HTML table and written to a Ninja custom field for easy visibility within the NinjaOne platform.

Tool display names supported by this script:

  1. AeroAdmin
  2. Ammyy Admin
  3. AnyDesk
  4. Atera
  5. Automate (ConnectWise Automate)
  6. BeyondTrust
  7. Chrome Remote Desktop
  8. CW RMM (ConnectWise RMM)
  9. DameWare
  10. Datto RMM
  11. DWService
  12. GoToAssist
  13. GoToMyPC
  14. ITSPlatform
  15. Kaseya
  16. Kaseya VSA (VSA)
  17. LiteManager
  18. LogMeIn
  19. Malwarebytes
  20. ManageEngine
  21. N-Able N-Central
  22. N-Able N-Sight
  23. Ninja RMM
  24. NoMachine
  25. Parsec
  26. Remote Utilities
  27. RemotePC
  28. ScreenConnect / ConnectWise Control (instance-based detection)
  29. Splashtop
  30. Supremo
  31. Syncro
  32. TeamViewer
  33. TightVNC
  34. UltraVNC
  35. VNC (generic detection)
  36. VNC Connect (RealVNC)
  37. Zoho Assist

Associated Content​

ContentTypeFunction
cPVAL Enable Remote Tools DetectionCustom FieldCustom field to select the required platform to start detecting Unauthorized remote tools.
cPVAL Whitelisted Remote Access ToolsCustom FieldCustom filed to define an optional comma-separated list of remote access tool display names to exclude from detection.
cPVAL Installed Remote Access ToolsCustom FieldCustom field stores the remote management applications list gathered by the script Installed Remote Tools Audit.
Installed Remote Tool AuditsAutomationScript to audit Windows endpoint for known remote access tools using multiple detection methods.
Unauthorized Remote ToolsTicket TemplateThis ticket template configures how a ConnectWise Manage ticket will be generated in response to the Audit Installed Remote Tools - Workstation and Audit Installed Remote Tools - Server compound conditions.
Audit Installed Remote Tools - WorkstationCompound ConditionTriggers the Installed Remote Tools Audit automation on Windows workstations where deployment is enabled.
Audit Installed Remote Tools (with Ticketing) - WorkstationCompound ConditionTriggers the Installed Remote Tools Audit automation on Windows workstations where deployment is enabled and creates tickets if Windows (with Ticketing), Windows Workstations (with Ticketing) is selected at cPVAL Enable Remote Tools Detection custom Field.
Audit Installed Remote Tools - ServerCompound ConditionTriggers the Installed Remote Tools Audit automation on Windows Servers where deployment is enabled.
Audit Installed Remote Tools (with Ticketing) - ServersCompound ConditionTriggers the Installed Remote Tools Audit automation on Windows servers where deployment is enabled and creates tickets if Windows (with Ticketing), Windows Servers (with Ticketing) is selected at cPVAL Enable Remote Tools Detection custom Field.

Implementation​

  1. Create the below Custom Fields:
  2. Create the Automation - Installed Remote Tool Audits
  3. Create the Ticket template: Unauthorized Remote Tools
  4. Create the below Compound Conditions using the implementation instruction provided in the documents.
  5. Select Windows, Windows Workstations, or Windows Servers from the custom field cPVAL Enable Remote Tools Detection to enable just auditing for remote tools. These options will enable the below compound conditions:
  6. Select Windows (with Ticketing), Windows Workstations (with Ticketing), or Windows Servers (with Ticketing) from the custom field cPVAL Enable Remote Tools Detection to enable the below compound conditions which will create a ticket if any unauthorized remote tool is detected:

Changelog​

2026-06-24​

  • Initial version of the document