Skip to content

MeshCentral Engine Integration

Jump to bottom
Tyler Hatfield edited this page Nov 6, 2026 · 3 revisions

MeshCentral 2 Remote Engine Integration

Vitrine RMM leverages MeshCentral 2 as its underlying remote execution and transport engine, pairing MeshCentral's battle-tested C/Node agent transport with Vitrine's glassmorphic orchestration portal.

1. Division of Responsibilities

graph LR
    subgraph MeshCentral["MeshCentral 2 Engine"]
        M1[C/C++ & Node Micro-Agent]
        M2[TLS WebSocket Transport]
        M3[Raw KVM Frame Scraper]
        M4[Intel AMT / vPro CIRA]
    end

    subgraph Vitrine["Vitrine RMM Frontend & API"]
        V1[Glassmorphic Web Portal]
        V2[Hierarchical Policy Engine]
        V3[LAPS & BitLocker Vault]
        V4[Tiered WoL & vPro Provisioner]
        V5[Bi-Directional Group Sync]
    end

    MeshCentral <== "WebSockets / WebRTC / RPC" ==> Vitrine
Loading

2. Interactive Screen Control (KVM), Headless Ghost Desktops & Intel AMT KVM (POST /api/devices/:id/remote-session)

  • Standard Interactive KVM (mode: 'kvm'): Low-latency hardware-accelerated WebRTC video streaming (WDDM DXGI on Windows, PipeWire / X11 SHM on Linux, ScreenCaptureKit on macOS) with multi-monitor switching and hardware Ctrl+Alt+Del SAS injection.
  • Headless Ghost Sessions (mode: 'ghost' — Zero User Interference): Spawns a full secondary graphical desktop in the background without disturbing the logged-in user's physical display, cursor, or audio:
    • Windows: Uses the Vitrine Indirect Display Driver (IddSampleDriver Virtual Adapter #99) paired with an isolated Child WTS Session (Session 2).
    • Linux: Spawns an isolated Xvfb :99 / headless wlroots Wayland virtual display output while leaving physical seat0 / :0 untouched.
    • macOS: Initializes a secondary off-screen CGSession / CGVirtualDisplay Quartz compositor session.
  • Intel AMT / vPro Hardware KVM (mode: 'amt_kvm'): Connects directly to the Intel MEI hardware framebuffer (Redfish / WS-Management Port 16994/16995 TLS), allowing pre-boot UEFI/BIOS setup, BitLocker recovery PIN entry, and OS crash inspection.
  • Server-Side Compliance Recording: Sessions are recorded into the Session Recording Audit Vault with SHA-256 integrity hashes and configurable stealth modes.

3. 5-Tier Chain of Logic for Wake-on-LAN & Intel AMT/vPro via Same-Company / Same-Network Peer Relays

Vitrine RMM guarantees offline endpoints are reachable by any means possible using online machines in the same company (tenant_id) and same network/site (site_id / CIDR subnet) via POST /api/devices/:id/wake-on-lan (POST /api/devices/:id/reachability-chain):

  1. Tier 1 — Direct Cloud CIRA Out-of-Band Tunnel Check: Checks if the endpoint has an active direct Intel AMT CIRA TLS tunnel to the RMM server (intel_amt_enabled). If cloud CIRA is sleeping or blocked by NAT, escalates to Tier 2.
  2. Tier 2 — Same-Company / Same-Subnet Peer-Relayed Intel AMT / vPro Power-On (TCP 16992/16993): Selects online managed peers in the same company and same LAN subnet to issue a local WS-Management CIM_PowerManagementService.RequestPowerStateChange(2 - Power On / Force UEFI Setup) command directly to the target's internal LAN IP, bypassing WAN/NAT boundaries.
  3. Tier 3 — Same-Subnet Multi-Peer Layer-2 WoL Magic Packet Broadcast (UDP 7 & 9): Instructs all online peers in the same company and subnet to broadcast raw Ethernet 0x0842 frames and UDP directed broadcast (x.x.x.255:9 and :7) containing the 6xFF + 16xMAC payload.
  4. Tier 4 — Historical Roaming Subnet & Cross-VLAN Peer Relay: Queries network_history for any previous subnets the endpoint visited and dispatches both WoL Magic Packets and AMT WS-Management probes via online company peers residing in those historical VLANs.
  5. Tier 5 — Peer-Assisted ARP / ICMP Link-Up & Agent TLS Handshake Verification: Has the local subnet peer verify ARP cache resolution and ICMP echo response from the target IP and transitions the endpoint status to online.
  6. Remote OS & WMI BIOS Enabler (POST /api/devices/:id/enable-wol): On online endpoints, technicians can remotely enable NIC *WakeOnMagicPacket properties, disable Windows Fast Startup (HiberbootEnabled=0), and execute Dell, HP, or Lenovo WMI BIOS commands without requiring a manual BIOS visit.

4. Zero-Touch Intel vPro / AMT CIRA Provisioning (Deduplicated)

  • Host-Based Provisioning (POST /api/devices/:id/amt-provision): Queries the Intel Management Engine Interface (MEI) driver and activates Client Initiated Remote Access (CIRA) to the MeshCentral server.
  • Unified Node Deduplication: Binds the Intel AMT management controller directly to the existing OS agent device record in Vitrine (intel_amt_enabled = 1), preventing duplicate device entries in the fleet inventory.

5. Bi-Directional MeshCentral Group Synchronization

  • Sync Engine (POST /api/meshcentral/sync): Continuously mirrors MeshCentral Device Groups with Vitrine Client Tenants, importing new groups, aligning endpoint memberships by hostname/MAC, and raising actionable notifications on group conflicts.

6. Tokenized & Authenticode-Signed Agent Installers

  • One-Liner Deployment (GET /api/agent/deploy & GET /api/agent/download): Generates tenant- and site-bound PowerShell, Linux Bash, and macOS installer scripts using a 24-hour cryptographic deployment token.
  • Automated Code Signing: When Code Signing is enabled in Settings, Windows PowerShell deployment scripts are automatically signed via the configured Cloud HSM / SignPath webhook (with Authenticode signature blocks) and logged against the required PSA ticket number.

Clone this wiki locally