General Settings
AI, notifications and system configuration

User roles

admin  IT Admin
  • Full access to all pages
  • Manage users, connectors, settings
  • View all monitoring data
technician  IT Technician
  • All monitoring pages
  • Devices, Cyber Essentials, Reports, Alerts
  • No settings or connector config
slt  SLT
  • SLT View and Cyber Essentials only
  • Read-only, plain-English view
  • No technical detail or config

Current users

Loading...

+ Add user

Change your password

Your recovery email

Used only for the "Forgot password?" link on the sign-in page. Requires SMTP to be configured under Notifications.

AI features Master switch

Turns all AI-powered features on or off. Your provider configuration below is kept even when this is off.

Enabled
Provider health, a live test prompt, the recent call log and AI errors. Open AI diagnostics →

AI provider

Choose how Groundskeeper accesses AI.

Added to every AI answer as background the model can rely on. Keep it short and factual — a few lines work better than a page, especially for a small local model. With a cloud provider these notes leave your network with the events, so write nothing here you would not send to that provider; names are masked the same way event text is.

Tier 1
Cloud AI
API key + internet. No local hardware needed.
Tier 2
Local — CPU
Runs on your existing server. No GPU required. Fully private.
Tier 3
Local — GPU
GPU-accelerated for faster responses. Fully private.

No local hardware required — API key and internet connection only

Model library

One-click download for recommended local Ollama models.

Loading...

Ollama on this server

Installs or updates Ollama on this Groundskeeper server. If your AI settings point at Ollama on another machine, update it there.

Installed: checking...

Latest: ...

Email & SMTP

Disabled
Enable STARTTLS

Teams and Slack webhook

Disabled

Teams: in the channel, choose Workflows, then “Post to a channel when a webhook request is received”, and paste the address it gives you. Slack: an incoming webhook address.

Teams / Copilot Studio — Ask Groundskeeper

Endpoint URL:
Disabled

Licence

Current plan
Loading...
Valid until
--

Community  ·  Pro  ·  Central  —  view pricing

Term dates

Define your school's term dates. During holidays, offline alerts for client devices are suppressed automatically. Server and infrastructure alerts are always active.

School identity

Enter your school URN (UK) or your US district ID (LEAID) and look it up.

Data source: DfE Get Information About Schools (GIAS) — public register, no sign-in needed

Academy trust

Trust affiliation is read automatically from GIAS.

Run a GIAS lookup above to populate trust information.

Groundskeeper updates

Current version: loading...

Update channel

Where the update check looks. On every channel the Download link fetches the installer through this server, and Update now downloads, verifies and runs it in one click. Nothing installs without that click unless you allow automatic updates below.

When a newer version is found, a one-time notice appears in the Dashboard feed. A check also runs shortly after every service start.

When the scheduled check finds a newer version, download, verify and install it without asking. The installer is signed by RSJ Software Ltd and its checksum is checked against the release notes before it runs; the service restarts itself; every automatic update (and any failure) is recorded in the Dashboard feed. Machines follow the server: each release bundles a version of the RSJ Agent, and every machine's agent updates itself to it at a following check-in, with its Groundskeeper module kept at the version this server serves. Agent Settings → Devices shows each machine's version, and the reason if an update failed.

Once a day, download RSJ's signed list of published software security fixes and end-of-support dates. It is one plain download of a public file; nothing about your school is sent. Switched off, Groundskeeper uses the list that came with this version and the last one it downloaded, and makes no request.

Once a week, Groundskeeper reads the list of installed programs from the registry of each domain computer that does not run the RSJ Agent, so software advisories cover those computers too. It only reads, and never changes anything. It needs Remote Registry running on those computers and an account with administrator rights on them. Off unless you switch it on.

Ollama

Installed on this server: checking...

Log settings

Takes effect immediately.

Live log viewer

Loading...
Loading logs...

Support bundle

Collects a diagnostics package — version, environment, connector status, and recent log lines and events — into a single .zip you can attach to a support request or forum post. It is built locally and downloaded straight to this machine; nothing is sent anywhere automatically.

Review before sending. Sensitive values are scrubbed automatically, but this is best-effort — usernames, device names, and similar identifiers can still slip through. Open the .zip and check the contents before sharing it.

Theme

Follows your account wherever you sign in.

Light
Dark
Slate
Forest

Navigation

Hide menu items you don't use. This only changes the menu — the pages still work by their address, so it is not a way to restrict access. The Dashboard and the settings pages are always shown. Follows your account.

Accessibility

Show a shape as well as a colour for each severity

A circle for OK, a diamond for a warning, a triangle for a critical. Red, amber and green look alike to about one man in twelve, and to everyone on a projector or a black-and-white printout; the shapes keep the feed readable without the colour. On by default.

Database backup

A nightly, verified copy of the Groundskeeper database — every alert, incident, device and check-in. A copy of your settings (config.yaml) is saved beside each one. Backup and restore below makes a password-protected settings file you can download and keep elsewhere.

Loading…

Backup and restore

About Groundskeeper

Self-hosted school IT operations intelligence.

Version loading... — GitHub

Service account

The Windows account Groundskeeper runs under determines whether remote monitoring works.

⌛
Checking…

System prerequisites

Windows features some connectors and scans need. A missing one shows its install command and an Install button whether or not anything enabled needs it yet, so a server can be prepared before its connectors are switched on.

⌛
Checking…
Push-deploy prerequisites (not live-checked — per target device)

Deploying the RSJ Agent to a discovered device over WinRM (Agent Settings → Unregistered → Deploy selected) requires WinRM enabled on that target device — off by default on Windows 10/11 clients. Devices without it will fail with a clear WinRM-unreachable message; use the manual Deploy-RSJAgent.ps1 script for those instead.

If the target device runs an EDR with application-control or zero-trust features (confirmed with WatchGuard EPDR), it may block RSJAgentSetup.exe outright, via push-deploy or a manual download alike (seen on WatchGuard EPDR before the installers were signed). The installers have been code-signed by RSJ Software Ltd since October 2026; if a deploy still fails without a clear WinRM or credentials reason, add an exception for RSJAgentSetup.exe in the EDR's authorised-software settings.