Field GuideUnofficial · enterprise field edition
Menu
Curriculum/Module 02

Endpoint Management & RMM

The proactive monitor-detect-act loop.

45 min3 lessons3 retrieval drills

The promise

What you will be able to do by the end of this module

Turn a customer's alert-fatigue complaint into a specific condition design, and explain why their current monitoring is not trusted.

  • Explain why a condition is a threshold PLUS a duration, and use that to reframe a customer's alert-fatigue complaint.
  • Name the condition families from memory: 28 agent, 7 VM host, 6 VM guest, 14 NMS.
  • Pick the three conditions that match a customer's stated pain instead of reciting the catalogue.
  • Show how Script Result and Custom Field conditions make the catalogue extensible to anything they can detect.
  • Spot the RAID monitoring gap — Dell PERCCLI and HP HPSSACLI, with HP Mega RAID excluded — before it surfaces mid-POC.
Start from what you already know

Everyone has monitoring. Almost nobody trusts it. The reason is rarely coverage — it is that thresholds fire without a duration, so a momentary spike looks identical to a sustained failure. Fix that and alerting becomes actionable.

01

Category fluency

Five related ideas, five different jobs

Endpoint Management is the broad control plane. RMM is continuous remote monitoring and management. Remote Tools perform focused device tasks without a user-facing desktop session. NinjaOne Remote enables interactive support for managed devices. Quick Connect is the invitation-based path for an unmanaged device.

  • Visibility: inventory, health, software, users, and status.
  • Control: policies, software deployment, scripts, services, files, and device actions.
  • Response: alert, automate, ticket, or start a remote session.
  • Evidence: activities, custom fields, reports, and documentation.
Verified sourcesNinjaOne Endpoint Management ↗NinjaOne RMM ↗NinjaOne Endpoint Management: Remote Tools ↗NinjaOne Remote product guide ↗NinjaOne Quick Connect ↗
02

Demo narrative

From symptom to durable fix

Show a degraded condition, reveal the device context, run or trigger a bounded remediation, verify the result, and capture it as reusable policy or knowledge. The durable fix is more valuable than the click path.

POC signal

Measure mean time to detect, hands-on technician steps, resolution time, and the share of incidents prevented from recurring.

Verified sourcesNinjaOne Endpoint Management ↗NinjaOne Academy curriculum ↗
03

Enterprise lens

Scale is a governance problem

At enterprise scale, the hard questions are delegation, blast radius, change windows, audit evidence, data ownership, integration, and exception management. Product depth matters, but operating design wins the room.

  • Map administrative domains and technician roles.
  • Define production rings and maintenance windows.
  • Agree on source-of-truth systems before integrating.
  • Create success criteria that measure work removed, not screens viewed.
Verified sourcesNinjaOne Integrations ↗

Mechanics

How it actually behaves

Each item is tagged with how far it can be trusted. Verified means checked against official documentation; field means it is our recommendation, not a vendor claim; unpublished means NinjaOne does not state it at all.

A condition is a threshold plus a duration

verified

CPU conditions trigger when utilization is above, below, or equal to a threshold across a configurable time interval. The duration parameter is what separates a console people act on from one they have muted.

Verified sourcesNinjaOne policies: condition types breakdown ↗

28 agent condition types, plus separate VM host, VM guest, and NMS families

verified

Agent conditions include CPU, Memory, Disk Free Space, Disk Usage, Disk Active Time, Disk Transfer Rate, Network Utilization, Process, Process Resource, Windows Service, Daemon, Device Down, Reboot Pending, System Uptime, Windows Event, Critical Events, SMART Status Degraded, RAID Health, Software, Antivirus Health, BitLocker Status, FileVault Status, Battery, Backup Alerts, Patch CVSS Score, Patch Last Installed, Script Result, and Custom Fields. VM host adds 7, VM guest adds 6, NMS adds 14.

Verified sourcesNinjaOne policies: condition types breakdown ↗

Device Down supports a reset interval and re-trigger

verified

'Trigger again if condition still true after reset' is the difference between one alert and a repeating reminder that something is still broken. Flapping devices are a configuration choice, not an inevitability.

Verified sourcesNinjaOne policies: condition types breakdown ↗

Script Result conditions make the catalogue extensible

verified

A custom script's result code and output text become an alertable condition, with text matching that is case sensitive. Anything you can detect in PowerShell or bash becomes first-class monitoring.

Verified sourcesNinjaOne policies: condition types breakdown ↗

RAID monitoring is vendor-specific and has a documented gap

verified

Dell via PERCCLI.exe and HP via the HPSSACLI utility, driven by Event ID. HP Mega RAID is explicitly excluded. If the customer runs it, say so before the POC rather than after.

Verified sourcesNinjaOne policies: condition types breakdown ↗

Discovery

Ask these, then listen

“How many alerts a day, and what fraction get actioned?”

Listen for: High volume with low action is alert fatigue. Your story is suppression and duration, not more coverage.

“How did you find out about your last real outage?”

Listen for: 'A user called' means the monitoring is decorative. That is the whole business case.

“Which alerts have you turned off?”

Listen for: The disabled list tells you exactly where trust broke.

Demo path

Three moves, in this order

  1. 1

    A CPU condition with and without a duration.

    “Same threshold, completely different signal quality.”

  2. 2

    A BitLocker or FileVault condition.

    “Encryption state becomes an alert, not an audit spreadsheet.”

  3. 3

    A Script Result condition.

    “Anything you can detect, you can alert on. The catalogue is a floor, not a ceiling.”

Objection handling

What they say, what you say, how you prove it

“We already have monitoring.”

Then the question is not coverage, it is trust. How many of yesterday's alerts did someone act on?

Proof method: Have them pull the muted-alert list. It is always longer than they expect.

“Our environment is too custom for a condition catalogue.”

Script Result and Custom Field conditions exist precisely for that. If you can detect it in a script, it becomes a first-class condition.

Proof method: Build one of their real checks live during the POC.

Where SEs blow it

Do not say these

  • Do not recite the condition list. Name the three that map to pain they already described.
  • Do not claim a condition count as a differentiator. Every RMM has a list. Duration semantics and Script Result extensibility are the actual argument.
  • Check RAID hardware early. HP Mega RAID is excluded and finding that mid-POC is avoidable.

From NinjaOne's channel

Watch it explained

Short clips from NinjaOne's own channel that reinforce the mechanics above. Each one says why it is here and what it backs up. These are supporting context, not product demonstrations — the sourced claims stay in the mechanics section.

Why this is here: Alert fatigue is the real problem, not coverage. Transcript-verified: 'only send what's necessary… group alerts by severity' — the same argument as threshold-plus-duration.Watch on YouTube ↗
Why this is here: Turning raw condition output into a metric somebody is accountable for.Watch on YouTube ↗
Why this is here: Baseline vocabulary for a customer whose monitoring is decorative rather than actioned.Watch on YouTube ↗

Retrieval practice

Rapid fire

Answer aloud before opening each response.

01RMM versus Remote?

RMM is continuous monitoring and management; Remote is an interactive support session.

02Why use remote tools?

They let a technician act on files, services, tasks, or registry without interrupting the user with a full desktop takeover.

03Best demo ending?

Verify the fix, show the audit trail, then turn the result into reusable automation or documentation.