Documentation

Connectors

This page is also in the Groundskeeper wiki: https://github.com/rsjsoftwareltd/groundskeeper/wiki/Connectors

Connectors are how Groundskeeper reads from the systems your school already runs. Each one pulls status into the dashboard, the feed, and the SLT view.

Every connector is read-only. Groundskeeper never writes to, changes, or controls anything on a monitored system -- it only reads status. Credentials are stored encrypted at rest on your server (Windows DPAPI) and never leave your network except as the direct API call to the service being monitored.

Connectors are enabled and configured on the Connector Settings page (in the left-hand menu). Each connector card has a Test connection button so you can confirm the credentials work before relying on it, and inline help on every field. On the free Community edition you can enable up to 5 connectors; Pro lifts the limit.

Most connectors take a poll interval (how often to check). The defaults below are sensible starting points -- shorter for fast-moving things (device status), longer for slow ones (warranty, certificates, licence counts).

A note on the Windows-infrastructure connectors (Windows Servers/Clients, Hyper-V, DNS & DHCP, Active Directory, Endpoint Reports, AD-based discovery): these reach the servers over WMI (DCOM -- WinRM is not needed) and query AD, so Groundskeeper should run on a domain-joined Windows Server, and the relevant RSAT feature must be installed (noted per connector).

Infrastructure & hardware #

Cisco Meraki #

• What it shows: Wi-Fi access point health, switch status, and MT sensor readings across one or more Meraki organisations.
• What you need: a Meraki Dashboard API key, and your organisation ID (or a list of organisations for multi-site).
• Where to find it: in the Meraki Dashboard, your profile icon (top right) -> API access -> Generate API key. The organisation ID is under Organisation > Settings. For multiple schools, add one row per Meraki org -- the name label feeds through to events.
• Firmware upgrades: Meraki publishes when it will upgrade each network's firmware and reboot its devices. The connector reads that schedule on every poll and shows it at the bottom of its own settings (Connector Settings -> Cisco Meraki). A newly scheduled upgrade is announced on the dashboard feed, and again if Meraki moves or cancels it; the devices it reboots are covered by an automatic maintenance window so their outage on the night is recorded as expected (see Maintenance Windows). Untick Treat Meraki's scheduled firmware upgrades as maintenance windows on the connector to turn all of this off.
• Default poll: 5 minutes.

Aruba Central (Beta) #

• What it shows: access point, switch and gateway health from Aruba Central's classic API Gateway. Beta: built from Aruba's API documentation and not yet tested against a live Aruba Central account -- please tell us how it goes in Discussions.
• What you need: a classic API Gateway client (Aruba Central > Account Home > API Gateway): your region's API Gateway host as the base URL (for example apigw-eucentral3.central.arubanetworks.com, no https://), the client ID and secret, and the initial refresh token issued when you authorise the client. Aruba's refresh tokens are single-use and rotate, so you paste it once; Groundskeeper keeps the current one. If it later reports an authentication error, generate a fresh refresh token and paste it again.
• Several schools on one tenant (a trust): list this school's group(s) or site(s), one per line, so this install only sees its own; leave blank for the whole tenant.
• Default poll: 5 minutes.

Veeam #

• What it shows: backup job status, failures and warnings.
• What you need: one row per Veeam Backup & Replication server, with an account that has the Veeam Restore Operator role. Supports Veeam B&R 12 and 13. Each row says How to read Veeam: the REST API (the default), or Veeam PowerShell (see below).
• Default poll: 30 minutes.

If Veeam says "License restrictions apply". Veeam opens its REST API only on Enterprise Plus, or a Universal Licence, for socket licences, so on other editions the poll fails with "refused the REST API because of its licence". Change that server's How to read Veeam to Veeam PowerShell (any edition; needs remote PowerShell to the backup server), save, and press Test connection. Groundskeeper then reads the jobs through Veeam's own read-only PowerShell cmdlets on the backup server, which work on every edition. The backup server needs:

• Remote PowerShell (WinRM) turned on and reachable from the Groundskeeper server (Enable-PSRemoting -Force in an administrator PowerShell on the backup server; its firewall must allow Windows Remote Management, port 5985). Use the backup server's name, not an IP address.
• An account allowed to sign in remotely: a member of Remote Management Users, or a local administrator, on the backup server. Leave the user name blank to use the Groundskeeper service account.
• A Veeam role that can read jobs. Backup Viewer is Veeam's read-only role.
• The Veeam console installed, which provides the PowerShell module (Veeam.Backup.PowerShell). Veeam 13's module needs PowerShell 7 (pwsh.exe) on the backup server; install it from Microsoft if it is missing.

Hyper-V #

• What it shows: VM state, replication health, and VM-count changes on Hyper-V hosts.
• What you need: one row per Hyper-V host. Requires Add-WindowsFeature RSAT-Hyper-V-Tools on the Groundskeeper server. Hosts must be reachable on TCP 135 (WMI over DCOM; WinRM is not needed). Leave a row's username and password blank for a domain-joined host (the service account is used). You can list VMs that are intentionally switched off so they don't raise alerts.
• A host that is not on the domain: fill in that row's username and password with an account that exists on the host itself, written as HOSTNAME\username, with admin rights there. Its firewall is often on the Public profile: enable the Windows Management Instrumentation (WMI) inbound rules for whichever profile is active (they open TCP 135 and the dynamic RPC ports). If a local account other than the built-in Administrator is refused, that is Windows' remote UAC filtering of local accounts; the built-in Administrator avoids it.
• Clusters (optional): set the failover cluster's name to add node and Cluster Shared Volume checks; this also needs RSAT-Clustering-PowerShell.
• Default poll: 5 minutes.

DNS & DHCP #

• What it shows: DHCP scope utilisation (warns as scopes fill) and DNS resolution health.
• What you need: your Windows DHCP server hostname/IP, and optionally a DNS server and test hostnames to resolve. Requires Add-WindowsFeature RSAT-DHCP.
• Two or more DHCP servers: list them one per line. Each is checked on its own, so one going down is reported by name. A scope the servers share through Windows DHCP failover (load balance or hot standby) is counted once, as both hold every lease, and a warning says when the two partners lose touch with each other. An older split scope (80/20) has its two parts added up, and is not judged on one part alone while the other server cannot be reached.
• Default poll: 15 minutes.

Switches (SNMP) #

• What it shows: port status, uplink-vs-device-port classification, interface errors and uptime for any managed switch via SNMP v2c. Tested on HP ProCurve and Aruba; any switch that speaks the standard interface MIB works, and LLDP on the switch improves the port classification. (Called "HP Switches" before v0.105.0 -- the name changed, nothing else did; an existing configuration carries over automatically.)
• What you need: one row per switch (management IP/hostname) and the read-only SNMP community string (often public).
• Default poll: 5 minutes.
• On the Devices page (v0.109.0 and later): open a switch and the drawer lists every monitored port with its kind (uplink, device port, unclassified), what was last seen at the other end -- the neighbouring switch or access point, or the maker and DHCP name of the device -- and when. The same evidence the feed events use, in one place.
• Naming the device (v0.106.0 and later): with the DNS & DHCP connector enabled and its "remember which device has which address" box ticked (the default), a port event also says which machine was on the port by the name DHCP knows it by -- "1 device seen behind it (a Dell called LIB-PC-07)". The name is remembered for 30 days after DHCP last saw the device, so a PC that was switched off yesterday is still named today.
• New and moved devices (v0.183.0 and later): each switch remembers what it has seen on each port (LLDP) for 30 days, and the feed gets an information line when something new appears on a switch or moves to another port. "New" means not seen on that switch in the last 30 days, so a PC coming back on in the morning is not news. A drop-down chooses which devices count: switches, access points and routers only (the default -- a device counts when it says so itself, or when Groundskeeper already knows it as one), every device, or none. On "every device", a PC or phone is named by the name DHCP knows it by, with its address. The Devices page lists every neighbour whichever you choose.
• Uplinks vs device ports (v0.103.0 and later): Groundskeeper works out which ports lead to another switch or access point and which have a single PC, printer or phone on them, from what the switch reports at the other end (LLDP) and how many devices it has seen behind each port. A port-down event says which kind it was and what was last seen there. Two tick boxes choose whether each kind raises a warning: uplinks are on by default; device ports are on for installs upgrading from an earlier version and off for new installs, because a device port going down is usually just a machine being switched off. Untick a box and that kind of port stays OFF the feed entirely (v0.107.1 and later) -- the port is still tracked, it just says nothing. Ports Groundskeeper cannot classify always warn, as they always have.
• Throughput history (v0.110.0 and later): each monitored port's traffic counters are read every poll and kept as a rate -- 5-minute detail for 48 hours, hourly for 7 days, daily for 90 days -- along with every switch reboot and outage. This adds up to about 90 MB to the database on a 40-switch estate and far less on a small one; the "Keep throughput history" tick box on the connector turns it off. The per-port charts that read this history arrive in a later release.
• Which ports (v0.118.0 and later): two lists on the connector, one name per line. Only monitor these ports limits monitoring to the named ports (leave it empty to monitor every enabled port, the usual choice); Ignore ports whose name contains skips the switch's own virtual and management interfaces, and is shown pre-filled with the defaults so you can see and edit what is skipped. Both could previously be set only by editing config.yaml.

UPS #

• What it shows: battery capacity, estimated runtime, load, and on-battery detection for APC and Eaton UPS units via SNMP v2c.
• What you need: one row per UPS network management card (NMC IP/hostname) and its read-only SNMP community string.
• Default poll: 5 minutes.

Dell iDRAC #

• What it shows: server hardware health via the iDRAC Redfish API -- CPU, memory, storage and power supplies.
• What you need: one row per iDRAC (the iDRAC management IP, not the server OS address). Leave SSL verification off for self-signed iDRAC certs.
• Tuning: Warn on Degraded components is on by default. Untick it on older hardware that reports Degraded all the time; Critical is always reported.
• Default poll: 10 minutes.

WatchGuard Firebox #

• What it shows: firewall reachability and branch-office VPN (BOVPN) tunnel status, polled directly from the Firebox via SNMPv3.
• What you need: SNMPv3 enabled on the Firebox (Fireware Web UI -> System > SNMP, or for cloud-managed devices, WatchGuard Cloud > Configure > Devices > [Firebox] > Device Configuration > Device Settings > SNMP) with a username, authentication password (SHA or MD5) and privacy password (AES or DES, or none), plus an SNMP management station entry or packet filter policy allowing the Groundskeeper server to poll UDP 161.
• Default poll: 5 minutes.

WatchGuard's REST API doesn't expose live reachability or VPN tunnel status (the Management API is configuration-only; the Reports API is historical traffic analytics), so this connector polls the Firebox directly over SNMPv3 instead. Alarm traps aren't implemented yet -- that would need a separate always-on trap listener and is tracked as a possible future connector.

FortiGate (Beta) #

• What it shows: each Fortinet FortiGate's reachability, its CPU and memory, and every FortiGuard and FortiCare subscription that is running out -- a warning a month before each one expires (each unit can renew on a different date), and again if one lapses. Read-only: it only reads the FortiGate's REST API and never changes anything on it.
• What you need: on each FortiGate, a REST API admin with a read-only profile:
  1. System > Admin Profiles > Create New: a profile with Read access
  2. System > Administrators > Create New > REST API Admin: give it that
  3. Copy the API key it shows once (it is not shown again).
• In Groundskeeper: add one row per FortiGate -- a name, its admin address (add :port if the admin HTTPS port is not 443) and its API key. The key is stored encrypted and never shown again; leave the box blank on a later save to keep it. A FortiGate on an internal address is read with its own (self-signed) certificate; a public address is always checked properly.
• Tuning: the warning period (default 30 days), CPU and memory warning levels (90%, on two polls running, so a short spike is not an alert), and any subscriptions you don't want watched. A subscription you never bought is not warned about, and FortiConverter (the one-off migration service some units show as "expiring") is never watched.
• Default poll: 10 minutes.
• Beta: built from FortiOS 7.x's documented API replies; it has not yet run against a school's own units.

Synology NAS (Beta) #

• What it shows: each Synology NAS's reachability; a storage pool or volume that is degraded, crashed, or repairing; a volume filling (with a rough "days to full" once it has a few days of history); a disk with a health warning, bad sectors or little life left; a DSM update waiting; and what Security Advisor finds. The main reason to use it: backups -- for every Hyper Backup and Active Backup for Business task, by name, a warning if the last run failed or if it has not succeeded in two days (you can change that). Read-only: it only reads, and signs out again after every check.
• What you need: a DSM account made just for Groundskeeper, not an administrator's:
  1. Control Panel > User & Group > Create: a user such as gk-monitor
  2. Under Applications, allow only DSM (nothing else needs to be
  3. Optionally, under Control Panel > Security > Account (or the user's
• If DSM will not let that account read something, Groundskeeper says so ("could not read storage", "could not read Hyper Backup") and the connector shows an error. It never carries on and looks healthy. Storage Manager's information in particular is something DSM may answer only for accounts allowed to open Storage Manager; if yours is refused, tell us -- this is part of what the Beta is for.
• In Groundskeeper: add one row per NAS -- a name, its DSM address (add :port if the HTTPS port is not 5001), and the account's user name and password. The password is stored encrypted and never shown again; leave the box blank on a later save to keep it. A NAS on an internal address is read with its own (self-signed) certificate; a public address is always checked properly.
• Tuning: how many days without a successful backup (default 2), the volume full warning (default 85%), and any backup tasks you don't want watched. A backup package that isn't installed on the NAS is simply not checked.
• Default poll: 15 minutes.
• Beta: built from DSM's documented sign-in and the replies used by open-source integrations; Hyper Backup and Active Backup for Business are not in Synology's published guides. It has not yet run against a school's own NAS.

HPE iLO (Beta) #

• What it shows: the hardware health of HPE ProLiant servers, read from each server's iLO (the management controller, which works even with the server's operating system off). The main reason to use it: disk drives. A drive the Smart Array controller expects to fail, or one that has failed, is reported by bay and model -- including a drive that is not part of any RAID volume ("unassigned"), which many other tools never mention. It also reports a RAID volume that is degraded or failed, a failed fan or power supply, a temperature over its limit, memory or processor health, and the server's overall health. Each alert appears once when the problem starts and once when it ends. The Devices page lists each server with its model, serial number, its drives and the firmware list the iLO holds (system ROM, iLO, controllers, drives) -- useful when checking whether a BIOS is years old. Read-only: it only reads, and never sends a command to the iLO.
• What you need: an iLO account made just for Groundskeeper, with no extra privileges (never an administrator's):
  1. In the iLO web page: Administration > User Administration > New; give
  2. The iLO must be reachable from the Groundskeeper server on HTTPS (port 443).
  3. iLO 4 needs firmware 2.30 or later (it has the Redfish interface); iLO 5
• In Groundskeeper: add one row per server -- a name, its iLO address (the management port, not the server's own address), and the account's user name and password. Each row has its own account. The password is stored encrypted and never shown again; leave the box blank on a later save to keep it. An iLO on an internal address is read with its own (self-signed) certificate; a public address is always checked properly.
• If the iLO will not let the account read something, Groundskeeper says so and the connector shows an error. It never carries on and looks healthy.
• Warnings: a Warning on a drive usually means the controller expects it to fail. Turn off "Warn on Warning-level components" only for a server that reports a Warning that cannot be cleared; Critical is always reported.
• Default poll: 10 minutes.
• Beta: built from HPE's documented replies for iLO 4 and iLO 5. How a predictive-failure drive is spelled in a real iLO's reply has not been checked against a real unit, so any drive Warning is reported (as "predicted to fail" where the iLO says so). It has not yet run against a school's own servers.

Ping checks #

• What it shows: devices on your network that should always answer a ping -- door controllers such as Paxton Net2, cameras, switches, anything without a connector of its own. A device that stops answering is reported once, and once again when it answers.
• What you need: the devices, one per line, as Name|address or just the address -- for example Net2 main entrance|10.0.0.50. The address can be an IP address or a host name. The Groundskeeper server must be allowed to ping them (ICMP echo through any firewall in between).
• How a check is made: 3 pings from the Groundskeeper server, a second each. One reply is enough, so a single dropped packet is not an alert. A router answering "Destination host unreachable" does not count as the device answering.
• Default poll: 5 minutes.

Cloud & online services #

Setting up the Microsoft 365 app registration (once, for all three) #

The Microsoft 365 connectors (Service Health, Licence Usage, Public SharePoint sites) share one app registration in your tenant. It only reads, and you choose which permissions it has. You need a Global Administrator (or Privileged Role Administrator) for step 4.

1. In the Microsoft Entra admin centre (or Azure portal), go to Applications > App registrations > New registration. Name it Groundskeeper, choose Accounts in this organizational directory only, leave the redirect URI empty, and click Register.
2. On the app's Overview, copy the Application (client) ID and the Directory (tenant) ID.
3. Open API permissions > Add a permission > Microsoft Graph > Application permissions and tick only the ones for the connectors you will use: ServiceHealth.Read.All (Service Health), Organization.Read.All (Licence Usage), Group.Read.All (Public SharePoint sites). Click Add permissions. (Application permissions, not Delegated.)
4. Click Grant admin consent for your organisation. Each permission's status should turn to a green tick. Until it does, Test connection for Service Health and Licence Usage says the permission is missing. The Public SharePoint sites test checks the sign-in only, so a missing Group.Read.All shows on that connector's first poll instead.
5. Open Certificates & secrets > Client secrets > New client secret, give it a description and an expiry (at most 24 months), and copy its Value straight away -- it is shown only once. The Secret ID beside it is not the secret.
6. In Groundskeeper's Connector Settings, paste the tenant ID, client ID and secret value into each Microsoft 365 connector and click Test connection.

Put the secret's expiry date in your calendar: when it expires the connectors report "the client secret has expired" until you add a new one (step 5) and paste its value in.

Microsoft 365 -- Service Health #

• What it shows: M365 service incidents and advisories via Microsoft Graph. What Microsoft classes as an incident ("Exchange mailbox service is down") is critical and turns the SLT card red; an advisory ("users may see delays") is a warning. Each service is reported once, at its worst open issue, and again when that changes or clears.
• What you need: an Azure app registration (tenant ID, client ID, client secret) with the ServiceHealth.Read.All application permission, with admin consent granted. Test checks the permission as well as the sign-in.
• When it stops working: a client secret expires (after 24 months at most). The connector then reports "the client secret has expired": create a new secret in the Azure portal and paste its Value into the connector's settings. The Licence Usage and Public SharePoint sites connectors use the same secret and say the same.
• Where to find it: tenant/directory ID is in Azure Portal > Microsoft Entra ID > Overview; the client ID and secret come from App registrations > [your app] > Certificates & secrets.
• Default poll: 15 minutes.

Microsoft 365 -- Licence Usage #

• What it shows: licence seat consumption -- warns when a SKU approaches or exceeds its purchased count.
• What you need: the same tenant as Service Health, plus the Organization.Read.All permission. You can reuse the Service Health app registration -- just add this permission alongside the existing one.
• Tuning: warning threshold (default 95% of purchased seats), and an optional ignore-list for free/trial SKUs that create noise.
• Default poll: 60 minutes.

Public SharePoint sites (Beta) #

• What it shows: Teams and Microsoft 365 groups (and their SharePoint sites) that are shared public -- anyone in the organisation can join and read them. Read-only: it never changes sharing. Beta: checked against Microsoft's Graph documentation, not yet against a live school tenant.
• What you need: the same app registration as the Microsoft 365 connectors, with the Group.Read.All application permission added (read-only), with admin consent granted. Test checks the sign-in only; if consent for Group.Read.All is missing, the first poll reports it.
• Deliberately public groups: list their group IDs (comma-separated) under Acknowledged public groups -- for example a whole-school announcements Team -- and they are not flagged. A group's ID is in the event's details or the Microsoft 365 admin centre.
• Default poll: 1440 minutes (once a day).

Adobe -- Licence Usage #

• What it shows: seat use per Creative Cloud / Document Cloud product profile -- warns when a profile approaches or exceeds the seats you bought.
• What you need: an Enterprise or ETLA Adobe plan (Adobe's User Management API is not available on Adobe Teams), an Adobe Developer Console OAuth Server-to-Server credential with User Management API access (its client ID and secret), and your Adobe Org ID (...@AdobeOrg, on the project's overview).
• Your seat counts: Adobe's API does not reliably give purchased seats, so enter them, one profile per line, as Profile Name|seats -- for example All Apps|50. Only profiles you list are alerted on.
• Tuning: warning threshold (default 90% of the seats you entered). Optionally, Detect reclaim candidates cross-references seats with Active Directory to flag disabled, dormant or departed accounts; it assumes Adobe sign-ins match AD user principal names, and needs RSAT-AD-PowerShell on the Groundskeeper server.
• Default poll: 1440 minutes (once a day; Adobe's rate limits are tight).

School Services #

• What it shows: uptime checks for common school cloud services -- ParentPay, Wonde, Arbor, Bromcom, SIMS Online, RM Unify, Smoothwall Cloud, CEDAR, eduLink One, Firefly, MCAS, Lightspeed, Senso, Azure, Google Workspace, and any custom services you add.
• What you need: nothing but the list of services to watch -- tick the ones you use. Custom entries take the form Name|address, or just the address (it is named by its host). A line that is neither is reported by the Test button, not skipped.
• Your own address: for Arbor, Bromcom, CEDAR, Firefly, Lightspeed and Google Workspace you can enter your school's own address. It is worth doing: left blank, Groundskeeper checks the vendor's public website, which can be up while your school's service is down.
• Devices with their own certificate: switches, door controllers and printers often answer https with a certificate they made themselves, which a normal check rejects. With Accept a device's own certificate on internal addresses ticked (the default), an internal address -- a private IP such as 10.x or 192.168.x, a name with no dots, or one ending .local, .lan, .internal, .home.arpa or .localdomain -- is checked without checking its certificate, including when it redirects http to https. Public addresses are always checked properly. The Test connection button follows the same setting.
• Default poll: 10 minutes.

Internet Health #

• What it shows: outbound connectivity checks over HTTPS (port 443).
• What you need: nothing by default (it checks Google, Microsoft 365 and GitHub). You can add your own target URLs and set a timeout.
• Default poll: 5 minutes.

Security & compliance #

Domain Security #

• What it shows: SPF, DMARC, DKIM, TLS, HTTPS redirect and security-header checks for your email/web domains. A direct replacement for the retired NCSC Mail Check / Web Check.
• What you need: just the list of domains to monitor, one per line.
• Default poll: 1440 minutes (once a day).

SSL Certificates #

• What it shows: TLS certificate expiry monitoring -- alerts before certs expire.
• What you need: the hostnames to check, one per line (append :port for non-443). Set warning (default 30 days) and critical (default 7 days) thresholds.
• Default poll: 1440 minutes (once a day).

WatchGuard Endpoint #

• What it shows: AV/EDR coverage across enrolled endpoints, and new security event alerts (malware, PUPs, exploits, blocked programs, network attacks) from the last 30 days.
• What you need: an Access ID and password (read-only recommended), an API Key, and your Account ID, all from WatchGuard Cloud > Administration > Managed Access. Account ID format varies by account type (ACC-XXXXXX or WGC-1-xxxxxxx) -- it's on the same Managed Access page. UK schools use the deu region (WatchGuard's EMEA data region).
• Tuning: coverage warning threshold (default 95% of enrolled endpoints), and a critical threshold (default 80%) for a bigger failure, such as the agent no longer deploying.
• Duplicate endpoints: when a computer is re-imaged, WatchGuard often keeps the old entry beside the new one, and the old one may still use a licence seat. If WatchGuard lists two or more endpoints with the same name (capitals and the domain suffix are ignored), Groundskeeper raises one warning per name, says which entry connected most recently and when each older one last connected, and which to delete in the WatchGuard Cloud console. The warning closes when WatchGuard holds one entry again. Groundskeeper never deletes anything. Untick Warn about duplicate endpoints to switch it off.
• Not connected for a while: one warning lists endpoints that have not contacted WatchGuard for 30 days or more (change Warn when an endpoint has not connected for (days); 0 switches it off). An older copy already reported as a duplicate is not listed twice.
• Default poll: 60 minutes.

Windows Event Log #

• What it shows: security events -- account lockouts, failed-logon bursts, and changes to sensitive groups.
• What you need: the domain controller to query (or leave blank for the local machine), and optionally the sensitive groups to watch. Tune the failed-logon burst threshold (default 10 in the lookback window).
• Default poll: 60 minutes.

Active Directory #

• What it shows: AD replication health, FSMO role holder reachability, SYSVOL/NETLOGON shares, and sensitive-group membership changes.
• What you need: the AD domain FQDN (or leave blank to auto-detect). Uses repadmin and standard AD tooling on a domain-joined server. Choose which checks to run and which groups to watch.
• Default poll: 60 minutes.

Endpoints (agentless) #

These connectors read endpoint data over the network from a domain-joined Groundskeeper server, without the optional RSJ Agent. (For richer per-device detail -- BitLocker, Defender, SMART, battery health and more -- deploy the RSJ Agent to your endpoints; see Getting Started.)

Windows Servers #

• What it shows: CPU, RAM, disk, services and uptime for Windows Server infrastructure.
• What you need: either auto-discovery from Active Directory (with a re-discovery schedule) or a manual server list -- or both. Set thresholds for CPU, RAM and disk, and list any Windows services to watch (e.g. DNS, NTDS, W32Time, Spooler). CPU and RAM must stay over the line for two polls in a row before they warn, so a short burst is not reported. A server must miss two polls in a row (Alert unreachable after) before it is reported unreachable, so a reboot for updates stays quiet.
• Test connection tests the servers in your list, or those found in Active Directory. With neither set, it tests nothing and says what to add.
• Permissions: the Groundskeeper service account needs administrator rights on each server it checks -- the Service Account page shows how, without Domain Admin. Active Directory discovery needs RSAT-AD-PowerShell on the Groundskeeper server.
• Default poll: 5 minutes.

Windows Clients #

• What it shows: endpoint health for Windows 10/11 PCs -- BitLocker status, pending reboots, antivirus, update age and disk space.
• What you need: AD discovery (auto-detects the search base) or a manual host list. Tune the BitLocker requirement, pending-reboot warning age (default 7 days, for KCSIE compliance), update-age warning, and disk threshold. Requires RSAT-AD-PowerShell.
• Switched-off computers: these do not get a warning each. The feed shows one line, such as "412 of 700 computers did not answer", and a warning only if none of them answered. At most 40 computers are checked at once, so a large school's scan takes a while and does not strain the server.
• Default poll: 1440 minutes (once a day).

Endpoint Reports #

• What it shows: disk-space and Windows 11 readiness scans across the estate, surfaced on the Reports page.
• What you need: nothing more by default -- left blank, the AD search base is the whole domain; set it (e.g. OU=Computers,DC=school,DC=local) to scan one part. Requires Add-WindowsFeature RSAT-AD-PowerShell.
• Default poll: 1440 minutes (once a day).

Printers / MFDs #

• What it shows: toner/ink levels, paper-tray state and error conditions for network printers via SNMP v2c.
• What you need: one row per printer (IP/hostname) and the read-only SNMP community string. Set toner warning/critical thresholds and choose whether empty trays raise alerts.
• Default poll: 60 minutes (toner changes slowly).

AD hygiene & school-specific #

AD Account Health #

• What it shows: service-account password expiry and stale user accounts -- the things that quietly cause MIS-sync failures.
• What you need: AD search base (auto-detects). Set the service-account warning window (default 30 days; critical at 7), the stale-user threshold (default 90 days), and the alert count. Requires RSAT-AD-PowerShell.
• Default poll: 1440 minutes (once a day).

Devices Left On Overnight #

• What it shows: client machines running 14+ hours -- for energy saving and security hygiene.
• What you need: AD search base (auto-detects). Tune the overnight threshold, the morning check window (default scan 06:00--10:00), and the per-machine WMI timeout. Requires RSAT-AD-PowerShell.
• Default poll: every 4 hours (the scan only fires inside the check window).

Exam Marking Software #

• What it shows: detects teacher-side exam-marking applications on domain endpoints -- RM Assessor and Scoris Assessor today -- so IT gets early warning of exam-season support demand.
• What you need: the Groundskeeper server joined to the domain, and an account with administrator rights on the clients, with the Remote Registry service running on them. AD search base (auto-detects); tick the products to look for. No RSAT module is needed.
• Default poll: 10080 minutes (once a week).

MIS Status #

• What it shows: live service status for Arbor. SIMS, Bromcom and SEEMiS publish no status page Groundskeeper can read, so choosing one of those posts a one-off note saying so rather than a green light over nothing.
• What you need: just select your MIS provider.
• Default poll: 10 minutes.

Patch management #

Action1 #

• What it shows: endpoint patch status, missing updates and device inventory across one or more Action1 organisations.
• What you need: an Action1 API client ID and secret, your region, and one row per school (org ID).
• Where to find it: Action1 > Configuration > API Credentials. UK schools are almost always on the Europe region (app.eu.action1.com); the org ID UUID is in the dashboard URL.
• Weekly summary: once a week the feed shows one information line per organisation -- endpoints covered and pending patches -- so you can see a quiet Action1 is still working. Untick Weekly summary on the feed to stop it.
• Default poll: 60 minutes.

Adding more later #

You can enable, disable or reconfigure connectors at any time on the Connector Settings page -- nothing here is locked in at setup. New connectors are added in Groundskeeper releases; see the Releases page and Discussions to request one.

Last updated: 2026-11-05 (v0.195.0)