Installed Remote Access Tool Audit

Purpose

The purpose of this solution is to identify a curated set of remote access tools using multiple detection methods, uninstall registry entries, running processes, running services, and common executable paths. It supports exclusions from both script variable and a Ninja custom field. The results are compiled into an HTML table and written to a Ninja custom field for easy visibility within the NinjaOne platform.

Tool display names supported by this script:

1. AeroAdmin
2. Ammyy Admin
3. AnyDesk
4. Atera
5. Automate (ConnectWise Automate)
6. BeyondTrust
7. Chrome Remote Desktop
8. CW RMM (ConnectWise RMM)
9. DameWare
10. Datto RMM
11. DWService
12. GoToAssist
13. GoToMyPC
14. ITSPlatform
15. Kaseya
16. Kaseya VSA (VSA)
17. LiteManager
18. LogMeIn
19. Malwarebytes
20. ManageEngine
21. N-Able N-Central
22. N-Able N-Sight
23. Ninja RMM
24. NoMachine
25. Parsec
26. Remote Utilities
27. RemotePC
28. ScreenConnect / ConnectWise Control (instance-based detection)
29. Splashtop
30. Supremo
31. Syncro
32. TeamViewer
33. TightVNC
34. UltraVNC
35. VNC (generic detection)
36. VNC Connect (RealVNC)
37. Zoho Assist

Associated Content

Content	Type	Function
cPVAL Enable Remote Tools Detection	Custom Field	Custom field to select the required platform to start detecting Unauthorized remote tools.
cPVAL Whitelisted Remote Access Tools	Custom Field	Custom filed to define an optional comma-separated list of remote access tool display names to exclude from detection.
cPVAL Installed Remote Access Tools	Custom Field	Custom field stores the remote management applications list gathered by the script Installed Remote Tools Audit.
Custom field - cPVAL Detected Remote Tool Names	Custom Field	Custom field stores the remote management applications list names gathered by the script Installed Remote Tools Audit.
Installed Remote Tool Audits	Automation	Script to audit Windows endpoint for known remote access tools using multiple detection methods.
Unauthorized Remote Tools	Ticket Template	This ticket template configures how a ConnectWise Manage ticket will be generated in response to the Audit Installed Remote Tools - Workstation and Audit Installed Remote Tools - Server compound conditions.
Audit Installed Remote Tools (with Ticketing) - Workstation	Compound Condition	Triggers the Installed Remote Tools Audit automation on Windows workstations where deployment is enabled and creates tickets if Windows (with Ticketing), Windows Workstations (with Ticketing) is selected at cPVAL Enable Remote Tools Detection custom Field.
Audit Installed Remote Tools (with Ticketing) - Servers	Compound Condition	Triggers the Installed Remote Tools Audit automation on Windows servers where deployment is enabled and creates tickets if Windows (with Ticketing), Windows Servers (with Ticketing) is selected at cPVAL Enable Remote Tools Detection custom Field.

Implementation

1. Create the below Custom Fields:
   • cPVAL Enable Remote Tools Detection
   • cPVAL Whitelisted Remote Access Tools
   • cPVAL Installed Remote Access Tools
   • Custom field - cPVAL Detected Remote Tool Names
2. Create the Automation - Installed Remote Tool Audits
3. Create the Ticket template: Unauthorized Remote Tools
4. Create the below Compound Conditions using the implementation instruction provided in the documents.
   • Audit Installed Remote Tools (with Ticketing) - Servers
   • Audit Installed Remote Tools (with Ticketing) - Workstation
5. Importing the below compound conditions will automatically enable audit Remote Access tools audit in the environment. Select Windows (with Ticketing), Windows Workstations (with Ticketing), or Windows Servers (with Ticketing) from the custom field cPVAL Enable Remote Tools Detection to enable the below compound conditions to create tickets if any unauthorized remote tool is detected:
   • Audit Installed Remote Tools (with Ticketing) - Servers
   • Audit Installed Remote Tools (with Ticketing) - Workstation

Changelog

2026-08-04

• Updated the cPVAL Enable Remote Tools Detection custom field to include only ticketing options, as the audit is automatically performed by the ticketing compound conditions.
• Removed the audit compound conditions Audit Installed Remote Tools - Workstations and Audit Installed Remote Tools - Server, as the ticketing compound conditions execute the script regardless of whether the custom fields are selected. If ticketing conditions are imported into the environment, the audit will run automatically, and tickets will only be generated when the ticketing options are enabled in the cPVAL Enable Remote Tools Detection custom field.

2026-07-27

• Added new Multi-Line Text field cPVAL Detected Remote Tool Names to store only the detected tool names.
• Updated script to populate this new field, allowing results to be used in dynamic groups and exports.

2026-06-24

• Initial version of the document