User roles
- Full access to all pages
- Manage users, connectors, settings
- View all monitoring data
- All monitoring pages
- Devices, Cyber Essentials, Reports, Alerts
- No settings or connector config
- SLT View and Cyber Essentials only
- Read-only, plain-English view
- No technical detail or config
Current users
Loading...
+ Add user
Change your password
Your recovery email
Used only for the "Forgot password?" link on the sign-in page. Requires SMTP to be configured under Notifications.
AI features Master switch
Turns all AI-powered features on or off. Your provider configuration below is kept even when this is off.
AI provider
Choose how Groundskeeper accesses AI.
Added to every AI answer as background the model can rely on. Keep it short and factual — a few lines work better than a page, especially for a small local model. With a cloud provider these notes leave your network with the events, so write nothing here you would not send to that provider; names are masked the same way event text is.
Model library
One-click download for recommended local Ollama models.
Loading...
Ollama on this server
Installs or updates Ollama on this Groundskeeper server. If your AI settings point at Ollama on another machine, update it there.
Installed: checking...
Latest: ...
Email & SMTP
Teams and Slack webhook
Teams: in the channel, choose Workflows, then “Post to a channel when a webhook request is received”, and paste the address it gives you. Slack: an incoming webhook address.
Teams / Copilot Studio — Ask Groundskeeper
Term dates
Define your school's term dates. During holidays, offline alerts for client devices are suppressed automatically. Server and infrastructure alerts are always active.
School identity
Enter your school URN (UK) or your US district ID (LEAID) and look it up.
Data source: DfE Get Information About Schools (GIAS) — public register, no sign-in neededAcademy trust
Trust affiliation is read automatically from GIAS.
Groundskeeper updates
Current version: loading...
Update channel
Where the update check looks. On every channel the Download link fetches the installer through this server, and Update now downloads, verifies and runs it in one click. Nothing installs without that click unless you allow automatic updates below.
When a newer version is found, a one-time notice appears in the Dashboard feed. A check also runs shortly after every service start.
When the scheduled check finds a newer version, download, verify and install it without asking. The installer is signed by RSJ Software Ltd and its checksum is checked against the release notes before it runs; the service restarts itself; every automatic update (and any failure) is recorded in the Dashboard feed. Machines follow the server: each release bundles a version of the RSJ Agent, and every machine's agent updates itself to it at a following check-in, with its Groundskeeper module kept at the version this server serves. Agent Settings → Devices shows each machine's version, and the reason if an update failed.
Once a day, download RSJ's signed list of published software security fixes and end-of-support dates. It is one plain download of a public file; nothing about your school is sent. Switched off, Groundskeeper uses the list that came with this version and the last one it downloaded, and makes no request.
Once a week, Groundskeeper reads the list of installed programs from the registry of each domain computer that does not run the RSJ Agent, so software advisories cover those computers too. It only reads, and never changes anything. It needs Remote Registry running on those computers and an account with administrator rights on them. Off unless you switch it on.
Ollama
Installed on this server: checking...
Log settings
Takes effect immediately.
Live log viewer
Support bundle
Collects a diagnostics package — version, environment, connector status, and recent log lines and events — into a single .zip you can attach to a support request or forum post. It is built locally and downloaded straight to this machine; nothing is sent anywhere automatically.
Theme
Follows your account wherever you sign in.
Navigation
Hide menu items you don't use. This only changes the menu — the pages still work by their address, so it is not a way to restrict access. The Dashboard and the settings pages are always shown. Follows your account.
Accessibility
A circle for OK, a diamond for a warning, a triangle for a critical. Red, amber and green look alike to about one man in twelve, and to everyone on a projector or a black-and-white printout; the shapes keep the feed readable without the colour. On by default.
Database backup
A nightly, verified copy of the Groundskeeper database — every alert, incident, device and check-in. A copy of your settings (config.yaml) is saved beside each one. Backup and restore below makes a password-protected settings file you can download and keep elsewhere.
Backup and restore
Service account
The Windows account Groundskeeper runs under determines whether remote monitoring works.
System prerequisites
Windows features some connectors and scans need. A missing one shows its install command and an Install button whether or not anything enabled needs it yet, so a server can be prepared before its connectors are switched on.
Deploying the RSJ Agent to a discovered device over WinRM (Agent Settings → Unregistered → Deploy selected) requires WinRM enabled on that target device — off by default on Windows 10/11 clients. Devices without it will fail with a clear WinRM-unreachable message; use the manual Deploy-RSJAgent.ps1 script for those instead.
If the target device runs an EDR with application-control or zero-trust features (confirmed with WatchGuard EPDR), it may block RSJAgentSetup.exe outright, via push-deploy or a manual download alike (seen on WatchGuard EPDR before the installers were signed). The installers have been code-signed by RSJ Software Ltd since October 2026; if a deploy still fails without a clear WinRM or credentials reason, add an exception for RSJAgentSetup.exe in the EDR's authorised-software settings.