Christopher Engelhardt
You shouldn’t have to email your IT provider to find out whether last week’s updates installed, which laptop is which, or where your ticket stands. That should be one click away.
The Client Portal is where our clients see their computers, tickets, invoices and shared files. This fall it got its biggest round of changes since launch. The headline feature is automatic weekly updates: you pick a time, and Windows and app updates install themselves, with a reminder the day before and a summary afterwards.
This post covers what’s new, how the update scheduling works behind the scenes, and what’s coming next.
🔄 Automatic weekly updates
Missed updates are one of the most common ways small offices get breached. They usually don’t fail loudly. A laptop that was asleep on update night, a restart nobody clicked, or a policy that quietly stopped running can all leave a machine weeks behind without anyone noticing.
The new Updates page puts the schedule in the client’s hands and the bookkeeping in ours:
- You choose the window. Pick a day, a time (during the workday or after hours) and your time zone. The status shows “Saving to our patching system…” and turns Active within about five minutes.
- You choose how restarts work. Restart automatically with a 15-minute warning, never restart during the day, or let staff postpone.
- Waiting periods. Windows updates wait 5 days and app updates wait 2, so a bad patch has time to surface before it reaches you.
- Machines that were off catch up. A computer that was off at update time picks up its updates the next time it’s turned on, for up to 6 days.
- No surprises. We email a reminder the day before (what’s being installed and anything staff need to do) and a short summary after each run. On update day, the Overview page shows a banner too.
Big Windows version upgrades and hardware drivers are not automatic. We schedule those with you, because they’re the updates most likely to need someone in the room.
How it works behind the scenes
The portal stores each client’s choices as a simple policy. A small service we call patch-watch runs every five minutes on our monitoring server. It turns each policy into a schedule in our patching platform, sends the reminder and results emails, and watches each run as it happens.
Client Portal ─► patch policy ─► patch-watch (every 5 min)
│
┌───────────────┼────────────────┐
▼ ▼ ▼
patching schedule reminder email run watch
(exact update list) (day before) ─► results email
─► portal historyThe key design choice: patch-watch owns every schedule. It doesn’t just create the schedule once and hope. Each tick, it compares what the patching platform has against what the policy says, and puts it back if someone changed it by hand. It also sends an explicit list of approved updates rather than “install everything,” so the waiting periods are enforced by us, not by a vendor default.
The timer is plain systemd, the same pattern we use for our other integrations:
# /etc/systemd/system/patch-watch.timer
[Unit]
Description=Run patch-watch every 5 minutes
[Timer]
OnBootSec=2min
OnUnitActiveSec=5min
RandomizedDelaySec=30s
[Install]
WantedBy=timers.targetPicking the update list is the part that has to be right. Here is an excerpt of the actual rule in patch-watch: which kinds of Windows update are allowed, what’s never automatic, and how long each kind waits:
WAIT = {"windows": timedelta(days=5), "app": timedelta(days=2)}
# Windows updates we install; drivers, firmware and OEM updates are skipped.
WINDOWS_ALLOW = re.compile(
r"^\d{4}-\d{2} (Security Update|Cumulative Update|Servicing Stack Update"
r"|\.NET)"
r"|^Security Intelligence Update for Microsoft Defender"
r"|^Windows Malicious Software Removal Tool")
NEVER = re.compile(r"Preview|Extended Security Updates \(ESU\)"
r"|Feature update|Enablement Package")
# ...later, for each missing update:
if now - since < WAIT[kind]:
continue # too new: it waits for a later runTime zones turned out to be the trickiest part. “Thursday at 7 PM” has to mean 7 PM in the client’s time zone, through daylight saving changes, even though the platform underneath stores times its own way. That got its own set of tests, including the spring-forward hour that doesn’t exist.
We also keep an eye on patch-watch itself. If it stops running, or can’t sync a client, an alert fires in our monitoring before a missed update window could slip by unnoticed.
🎫 Support tickets in one place
Tickets have their own pages now. From Support:
- Open a ticket with a subject, a description and an urgency (Normal, High or Urgent).
- View all your tickets, switch between Open, Closed and All, and search by subject or ticket number.
- Reply at the bottom of any ticket. Replying to our emails still works and lands in the same conversation.
💻 A page for every computer
Click any computer under Devices and you get its own page, in six sections:
| Section | What you see |
|---|---|
| Overview | Online status, last seen, last reboot, who’s signed in, operating system |
| Hardware | Make, model, serial number, processor and memory |
| Storage | Space used on each drive; the bar turns amber, then red, as it fills |
| Network | IPv4, IPv6 and MAC address of the main connection |
| Security | Microsoft Defender, Windows Firewall and Huntress status |
| Patches | Updates waiting, when the last ones went in, restart pending |
It’s handy when we ask “which computer is this?”, and for warranty calls, where the serial number is right there.
📊 Your environment at a glance
The Overview page now opens with a live summary of your company’s computers. The headline says how many are online right now, and four cards sit underneath it. Each card is a link to the list behind the number:
| Card | What it tells you |
|---|---|
| Computers | How many we manage, how many are online now and how many checked in today |
| Restart due | Computers with updates waiting on a restart |
| Not seen 30+ days | Machines that have gone quiet. Retired one? Tell us and we’ll remove it |
| Open tickets | What’s open now, plus how many were opened and closed in the last 30 days |
Under the cards are charts: computers online over the last 7 days, tickets over the last 30, when each computer last checked in, and how up to date they are. The cards at the top of the other pages, like Devices and Account, are clickable now too.
Where the numbers come from
The charts need history, and our remote management platform only knows what’s true right now. So a small exporter on our monitoring server asks it, and our patching platform, about each client every five minutes. It writes one line per number, labeled with the client it belongs to. Prometheus keeps the history, and the portal asks only for your company’s lines. These are our own, from the live file:
rit_client_devices{trmm_client_id="1",client="Rainier IT"} 7
rit_client_devices_online{trmm_client_id="1",client="Rainier IT"} 3
rit_client_devices_restart_due{trmm_client_id="1",client="Rainier IT"} 1
rit_client_devices_stale{trmm_client_id="1",client="Rainier IT"} 1If the exporter stops writing, an alert fires, the same way it does for patch-watch.
🔑 Passwords, managed from the portal
For clients on our managed password manager, Bitwarden, there’s a new Passwords page. Everyone gets a card on the Overview showing how many people have two-step login turned on. Client admins get the whole page:
- People. Everyone in your company’s Bitwarden, with their role, status, two-step login, account recovery and when they were last active. Anything that needs a look is listed at the top.
- Add a person. Enter a name, work email, role and groups. Bitwarden emails them an invite, they create their account, and you confirm them with one click. We email you when it’s time.
- Out of seats? The invite waits in a queue instead of failing. We add the seat and it goes out on its own.
- Who sees what. Shared folders and groups, so you can see which people reach which folders.
- Activity. Sign-ins, sharing, people and settings changes, with a “risky only” filter and a CSV download.
Admins can change roles and remove people, but never an owner’s account or their own.
The rule we designed around: Rainier IT can’t see anything stored in your vault, and neither can the portal. Bitwarden encrypts every item on your own devices. What its API gives us is the bookkeeping: who’s a member, which groups exist, and a log of events. When the portal saves an event, it keeps what happened, when, and who was involved. An item only ever shows up as an id, and Activity names the shared folder, never the item:
function eventRow(e) {
const k = (v) => v || '';
return {
event_key: `${e.date}|${e.type}|${k(e.actingUserId)}|${k(e.itemId)}|` +
`${k(e.memberId)}|${k(e.groupId)}|${k(e.collectionId)}|${k(e.policyId)}`,
type: e.type,
date: e.date,
acting_user_id: e.actingUserId || null,
member_id: e.memberId || null,
collection_id: e.collectionId || null,
group_id: e.groupId || null,
policy_id: e.policyId || null,
};
}Each client’s Bitwarden API key is stored encrypted (AES-256-GCM), with the encryption key kept outside the database. And if anyone exports a vault, we get a ticket so we can check it was expected.
⚡ Smaller things that add up
- A quicker Overview. The tiles at the top are now links: Open tickets goes to your tickets, Outstanding balance to your invoices, Devices protected to your computer list.
- Search everything. Press Ctrl+K (⌘K on a Mac), or click Search, to jump to any device, ticket or help article.
- “Get help with this computer.” A button on every device page opens a ticket with the computer name, serial number and last-seen time already filled in.
- No more “Loading…”. Pages show grey placeholders while your data arrives, and on a phone you can add the portal to your home screen so it opens like an app.
- Feels right on a phone. Buttons and links react the moment you tap them, and wide tables scroll inside their box instead of pushing the page sideways.
- Choose which emails you get. Under Settings → Notifications, switch ticket updates, invoices, security events and the Monday digest on or off.
- Security work behind the scenes. We tightened how the portal checks who can see what, and nothing changes in how you sign in.
How we ship portal changes
Every change goes to a separate staging copy of the portal first, and has to pass a regression suite before it reaches production. The suite signs in as our own company, Rainier IT, and checks every page. It also makes sure one client can never see another client’s tickets, devices or files:
== Client Portal regression: staging
-- tenant isolation (must be refused)
PASS #1 other client's ticket 404
PASS #2 reply on other client's ticket 404
PASS download-agent other client's site 404
PASS #6 alerts scoped (no foreign/orphan) 200It runs again against production after each release. Our own company is always the first client a new feature is tried on. Bigger features ship behind a switch, so on day one only we see them in production, and we widen it once we’ve used it ourselves. The new Overview went out like this:
# Client Portal settings: who sees the new Overview
P7_CLIENT_IDS=1 # day one: Rainier IT only
P7_CLIENT_IDS=1,35,37 # an hour later, after our own review: every client🚀 Coming next
The next wave is designed and going through the same staging-first process, a few features at a time:
- Same-day urgent fixes. When a flaw is on CISA’s list of vulnerabilities being actively exploited, the fix skips the waiting period and goes out that day, without forcing a restart.
- Drive encryption status. BitLocker on or off for every computer. Recovery keys are backed up by us and never shown in the portal: a stolen portal password shouldn’t unlock a stolen laptop.
- Hardware age and warranty. Age, warranty end date and a suggested replace-by quarter for each machine, plus a CSV export for budget planning.
- Better tickets. A status timeline, the response-time target next to the actual time, drag-and-drop screenshots, and a quick rating when a ticket closes.
- Forgot your password? A self-service reset link on the sign-in page. Lost your phone or authenticator app? That still goes through a phone call to us, on purpose.
- Monthly health reports. One PDF per month in the portal: updates installed, security incidents, tickets closed and anything that needs attention.
- Offboarding. When someone leaves, a client admin can remove their access from one screen: sign-in blocked everywhere, their computer locked, their files handed to a colleague, with a signed record of every step for HR.
🧭 Why we build this ourselves
Most of what’s in the portal comes from tools we already run: remote management, endpoint security, ticketing, billing and file sharing. Each has its own dashboard, and a client shouldn’t need to learn five of them. The portal pulls the parts that matter into one place, in plain English, with each client seeing only their own data.
If you’re a Rainier IT client, sign in at portal.rainier-it.com to try it. If you’re not yet, and want IT that shows its work, get in touch or email [email protected].
Protected by reCAPTCHA. Google's Privacy Policy and Terms apply.