Remote monitoring and management · self-hosted
Your machines, your server, your keys.
ACMEcontrol is a remote monitoring and management platform for managed service providers and IT teams who look after Windows computers. You host the server and you hold the data. It is designed on the assumption that someone will one day try to take that server from you.
Pre-release In development, not yet available. Target: mid-2027.
Why it exists
It started with someone else’s worst day.
A managed service provider had its remote-control server taken over. The attackers never had to break into a single customer. They used the provider’s own tool, and pushed ransomware to every machine it managed.
Remote management software is the most trusted thing on a network, which makes it the most valuable thing to steal. Most of it is built as though the server will never fall.
ACMEcontrol is built as though it will. Every design decision is asked the same question: if the server is taken, what can the attacker do with it? The design goal is that a taken server cannot, on its own, push code to the devices it manages.
No software is unbreakable, and we will not claim this is. What we can do is say plainly how it is built.
Security
The first requirement, not an afterthought.
- Devices call out. Nothing calls in.
- Each agent opens one outbound connection to your server over mutual TLS and checks the server against a pinned key. The agent listens on no port.
- Scripts, patches and updates need a signature the server does not hold.
- Agent updates are signed offline. Scripts and patches are approved by a technician in a separate approval app, with Windows Hello or a FIDO2 key, and the agent checks that approval itself. The server carries it and cannot forge it.
- Passkeys for every technician.
- Every staff account signs in with a device-bound passkey, from the first day. Multi-factor sign-in is required, not optional.
- Remote control is never invisible.
- Every session shows an indicator on the screen being viewed. A consent prompt can be required per company, and a one-time guest is always asked. Sessions are never recorded.
- The console calls no one.
- No content delivery network, no analytics, no fonts fetched from elsewhere. The console is served by your server and talks only to your server.
Product
A small set of things, done properly.
ACMEcontrol takes the handful of jobs a technician does every day and leaves the rest out. There is no ticketing system, no billing module and no dashboard of dashboards.
Everything is organized as company, site, device. A site can be a head office or one laptop at a kitchen table. A device can be set dormant (tracked, not monitored, no alerts) or archived (kept with its history, never deleted), because spares, seasonal machines and people on leave come back.
This is what version 1 is being built to do. None of it is released yet; the roadmap shows the order.
Remote control
A one-time support client that needs no install, then native control for managed devices and an RDP tunnel for unattended work. A sleeping machine is woken by another agent on its own network.
Inventory and reporting
Hardware, installed applications, and every network adapter with its MAC, IP, type and role. Warranty dates where they exist and an estimated system age where they do not. All of it exports to CSV.
Patching
Windows updates scanned, approved and installed, per company and per site.
Scripted automation
PowerShell on demand or on a schedule, against a device, a site or a company, with the output kept. Every run is approved first.
Antivirus health
Reports which antivirus or EDR product is present and whether it is healthy. It works alongside tools such as Microsoft Defender and Huntress and does not fight them.
Network devices
A discovery sweep, started by a technician, finds what is on a site’s network. Firewalls and switches are then read over SNMPv3, read-only, with their logs collected and their configurations backed up.
Accounts
Technicians and customers get different kinds of account. A customer can be given a read-only view of their own company.
Installers
One per company or site, a generic one that asks, or an automatic mode that reads the domain and waits for a person to place the device. One entry in Add or Remove Programs.
Backup
Incremental backup of servers and workstations to local or server targets, with scheduled test restores. More below.
How it behaves
The ground rules.
You host it.
Each company runs its own server, on Windows Server. The database and the web listener are built in, so there is no database server to install and no web server to configure.
No probe.
Every agent talks straight to the server, because many sites have one computer and some offices have no office.
Light on the machine.
A heartbeat, periodic inventory and update checks. Nothing runs continuously.
Month to month.
No contract, and no surcharge for unattended access. Billing will be per technician or per device; prices are not set yet.
Security updates are never held back.
They install on every server, paid up or not. An unpaid invoice must never become your customers’ problem.
Backup Planned
A backup the attacker cannot delete.
Ransomware crews go for the backups first. So the agent that writes a backup can add to the store and can never delete or overwrite what is in it. Retention and clean-up run on the server, after a delay.
Backups are incremental: after the first, only the blocks that changed are sent. The engine runs in user mode with no kernel driver, uses Windows volume snapshots, and stores encrypted chunks. A scheduled test restore checks that what was saved can be read back.
Version 1 restores files and volumes onto a running Windows. Bare-metal recovery media comes later.
Roadmap
Not ready yet. Here is where it stands.
Stage 1 Done
Research and design
A written security standard, a threat model that starts from a taken server, and a study of what existing tools do well.
Stage 2 In progress
Core platform
Companies, sites and devices; passkey sign-in; enrolment; signed updates; the agent, inventory and antivirus status; the console; the installers; CSV export.
Stage 3 In progress
Remote operations
The one-time support client first. Then the RDP tunnel, native remote control, Wake-on-LAN, patching, warranty and age reporting, and network discovery with firewalls and switches.
Stage 4 Planned
Backup
Incremental backup for servers and workstations, to local and server targets.
Stage 5 Later
Integrations
Microsoft 365, and a map of which device is on which switch port.
The aim is mid-2027. That is a target, not a promise. No customer release ships until its security checklist has been verified on the wire and reviewed by someone other than the author. If the two collide, the date moves.
About
An independent product, made in Canada.
ACMEcontrol is for the people who keep other people’s systems running: managed service providers and in-house IT teams. It is in active development, and the first release will be in Canada.