File Explorer - Optimize Permissions

There is currently concern that technicians who manage the RMM could potentially access systems under monitoring via File Explorer or the file manager. This would give them the ability to download files from these systems or upload files to them.

From our perspective, this creates a security vulnerability, particularly for highly sensitive endpoints such as executive devices, administrative systems, or other critical systems.

We would therefore like to see a feature that allows file access to be granularly restricted or completely disabled—ideally on a per-device, per-device-group, or per-user-role basis.

Desired Behavior:

Technicians should still be able to manage the RMM and perform monitoring tasks without automatically gaining access to the file level of all managed systems.

For particularly sensitive devices, it should be possible to restrict certain functions such as:

• File Explorer / File Manager

• File Upload

• File download

• Remote shell with file access

• other file-based actions

to specifically block or grant access only to certain authorized individuals.

In our view, a purely global permission is not sufficient, since technicians generally have to manage many systems but should not necessarily be granted access to all file systems.

In addition, comprehensive logging is essential. Every file upload, download, or access should be logged in a traceable manner, including:

• User

• Device

• File or path

• Action

• Time

• Result of the action

Especially in an MSP environment, this feature would be very important for compliance and security reasons, to better protect sensitive customer systems or internal management systems.

In short:
We need a way to control access at the file level within the RMM on a granular basis per device or device group, so that technicians cannot automatically access sensitive systems even though they administer the RMM.