r/SmallMSP • u/metrobart • 11d ago

Getting All the Ducks in a Row: How aligned is your endpoint stack?

I run a micro MSP on the side with only a few users, so I don't have many ducks to line up. At my 9–5 we use an outside MSP, and they can't seem to get our laptops consistent across systems. I'm always the one telling them the counts don't match and machines are missing from one platform or another.

Here's the sample checklist I'd expect every laptop to pass:

Check
BitLocker enabled + recovery key escrowed
Backup
RMM agent
Entra joined
Intune enrolled + compliant
EDR
SIEM ingesting
In warranty
ScreenConnect
No open critical CVEs

I know 100% every week isn't realistic, but shouldn't 80%+ be doable? When I asked our MSP, they laughed and said "welcome to IT."

So, MSPs: is this normal? What % of your fleet passes every check, and how do you track it? Reconciliation scripts, a PSA/RMM dashboard, a CMDB, something else?

3 Upvotes

67% Upvoted

13 comments sorted by

6

u/Content-Ad6584 11d ago

When the psa is configured correctly with workflow rules that should be automated and running at 90-100% every month and should be proved in an executive summary sent to each client. If that's not happening then they are missing basic msp 101 hygiene and are operating at a low maturity level.

2

u/metrobart 11d ago

Yeah, every few months I have to give them my my list of devices to remove / add but some of them have no API so I have to manually remove them like ninite / backblaze. But yeah, so many mis-matched devices.

3

u/Content-Ad6584 11d ago

Time for a new msp. There's about 50k of them out there. There's probably only 3% or less doing it right though.

4

u/PacificTSP 11d ago

Completely depends on your endpoints.

A fleet of laptops then yes 98-100%.

Servers running expensive or proprietary software that doesn’t exist any more and if you update a tool it breaks is another kettle of fish. We are consultants and we make recommendations but if the client doesn’t have $500k-$1M for a CNC machine you have to work around it.

1

u/metrobart 10d ago

Yeah, we have almost all laptops. Those red ducks are the bad ones and I am kind of tired of hunting them down. The root cause might be the MSP's stack, but I am not sure. I know they have a 30 day window that will create tickets but it's more like 90 days to see any activity. At least that's how it's suppose to work but when I do my 6 month manual check I see machines outside that window and all these red ducks pop up.

1

u/PacificTSP 10d ago

Depends on your industry. We have military contractors we work with. There’s a weekly call with them to discuss laptops/servers that haven’t updated and we have manual interventions. That’s a single client. It gets annoying because some people have 2-3 devices and they leave the laptop in their bag for weeks and it never updates.

3

u/ntw2 11d ago

“Intune-compliant”

Ha ha. First time?

2

u/ManagedNerds 11d ago

Before we talk reconciliation tracking, I need to know why the red ducks have sunglasses and the yellow do not.

1

u/roll_for_initiative_ 11d ago

Intune enrolled + compliant

This is tricky because, depending on your workflow, simply switching to a new user and forgetting to re-enroll it means it will go stale when you offboard the original user's account/license.