Internal assessments
Read-only checks of Windows, macOS and Linux devices through the agent, optional Active Directory checks, and authorised network discovery.
Updated
An internal assessment uses the customer's devices (computers running RevoAgent) to check their configuration from the inside. Assessment jobs are read-only: they never install updates, restart or change anything.
Run one
In the customer's workspace open Assessments → New assessment → Internal. Select devices (all active devices by default), optionally include Active Directory, and optionally turn on discovery. Each device collects its own checks; the assessment completes when every job has finished.
What it checks
| Platform | Checks |
|---|---|
| Windows | Firewall profiles, Microsoft Defender (service, real-time protection, signature age), BitLocker on the OS volume, SMBv1 and SMB signing, RDP Network Level Authentication, local password and lockout policy, missing security updates |
| Linux | Firewall default-deny (nftables, UFW or iptables), SSH root and password login, security updates in cached package metadata, root volume encryption, password policy inventory |
| macOS (agent 0.7.0) | FileVault, firewall, Gatekeeper, System Integrity Protection, pending updates, automatic updates |
| Active Directory (opt-in) | Default domain password policy, Domain Admins membership, stale accounts, accounts without a password requirement, with reversible encryption or without Kerberos pre-authentication |
Active Directory checks run on a domain-joined Windows device with the RSAT ActiveDirectory module, using the service's own identity (normally the computer account). No alternate credentials are accepted or stored.
Reading coverage
A completed assessment can still have incomplete coverage: a device that was offline, RSAT missing, Windows Update timing out, stale package metadata. These are listed as not checked, never as passed, and they resolve nothing. Check the coverage notices before treating a result as clean.
Discovery
Discovery lets one device inventory which internal addresses answer on which TCP ports. It needs all of:
- an unexpired internal IP or CIDR scope that allows active testing, with an attestation (see Scope, domain verification and authorization);
- an authorization attestation on the assessment;
- administrator approval: technicians' requests wait as pending approval;
- discovery switched on locally when the agent was installed (the EXE's
install --allow-discovery; the MSI and the Linux one-liner don't enable it).
Choose one device as the discovery vantage point; other selected devices collect only their own data.
Limits: private IPv4 only, at most 256 addresses per range and 256 hosts in total, 1–16 ports (default 22, 80, 443, 445, 3389, 5985, 5986), at most 32 connections at once. From agent 0.3.0 the agent also sends one plain HTTP request to open web ports to fingerprint the product, which feeds vulnerability matching.
Scheduling
Internal assessments can be scheduled like any other (Assessments → Schedules, type Internal (agents)). A scheduled run where some devices are offline still completes, listing those devices as not checked. See Scheduled assessments and monitoring.