-
Notifications
You must be signed in to change notification settings - Fork 0
Connectors
github-actions[bot] edited this page Sep 22, 2026
·
4 revisions
Connectors are how Groundskeeper reads from the systems your school already runs. Each one pulls status into the dashboard, the feed, and the SLT view.
Every connector is read-only. Groundskeeper never writes to, changes, or controls anything on a monitored system -- it only reads status. Credentials are stored encrypted at rest on your server (Windows DPAPI) and never leave your network except as the direct API call to the service being monitored.
Connectors are enabled and configured in Settings > Connectors. Each connector card has a Test button so you can confirm the credentials work before relying on it, and inline help on every field. On the free Community edition you can enable up to 5 connectors; Pro lifts the limit.
Most connectors take a poll interval (how often to check). The defaults below are sensible starting points -- shorter for fast-moving things (device status), longer for slow ones (warranty, certificates, licence counts).
A note on the Windows-infrastructure connectors (Windows Servers/Clients, Hyper-V, DNS & DHCP, Active Directory, Endpoint Reports, AD-based discovery): these use PowerShell remoting and AD queries, so Groundskeeper should run on a domain-joined Windows Server, and the relevant RSAT feature must be installed (noted per connector).
- What it shows: Wi-Fi access point health, switch status, and MT sensor readings across one or more Meraki organisations.
- What you need: a Meraki Dashboard API key, and your organisation ID (or a list of organisations for multi-site).
- Where to find it: in the Meraki Dashboard, your profile icon (top right) -> API access -> Generate API key. The organisation ID is under Organisation > Settings. For multiple schools, add one row per Meraki org -- the name label feeds through to events.
- Firmware upgrades: Meraki publishes when it will upgrade each network's firmware and reboot its devices. The connector reads that schedule on every poll and shows it at the bottom of its own settings (Connector Settings -> Cisco Meraki). A newly scheduled upgrade is announced on the dashboard feed, and again if Meraki moves or cancels it; the devices it reboots are covered by an automatic maintenance window so their outage on the night is recorded as expected (see Maintenance Windows). Untick Treat Meraki's scheduled firmware upgrades as maintenance windows on the connector to turn all of this off.
- Default poll: 5 minutes.
- What it shows: backup job status, failures and warnings.
- What you need: one row per Veeam Backup & Replication server, with an account that has the Veeam Restore Operator role. Supports Veeam B&R 12 and 13 (REST API).
- Default poll: 30 minutes.
- What it shows: VM state, replication health, and VM-count changes on Hyper-V hosts.
-
What you need: one row per Hyper-V host. Requires
Add-WindowsFeature RSAT-Hyper-V-Toolson the Groundskeeper server. You can list VMs that are intentionally switched off so they don't raise alerts. - Default poll: 5 minutes.
- What it shows: DHCP scope utilisation (warns as scopes fill) and DNS resolution health.
-
What you need: your Windows DHCP server hostname/IP, and optionally a DNS
server and test hostnames to resolve. Requires
Add-WindowsFeature RSAT-DHCP. - Default poll: 15 minutes.
- What it shows: port status, uplink-vs-device-port classification, interface errors and uptime for any managed switch via SNMP v2c. Tested on HP ProCurve and Aruba; any switch that speaks the standard interface MIB works, and LLDP on the switch improves the port classification. (Called "HP Switches" before v0.105.0 -- the name changed, nothing else did; an existing configuration carries over automatically.)
-
What you need: one row per switch (management IP/hostname) and the
read-only SNMP community string (often
public). - Default poll: 5 minutes.
- On the Devices page (v0.109.0 and later): open a switch and the drawer lists every monitored port with its kind (uplink, device port, unclassified), what was last seen at the other end -- the neighbouring switch or access point, or the maker and DHCP name of the device -- and when. The same evidence the feed events use, in one place.
- Naming the device (v0.106.0 and later): with the DNS & DHCP connector enabled and its "remember which device has which address" box ticked (the default), a port event also says which machine was on the port by the name DHCP knows it by -- "1 device seen behind it (a Dell called LIB-PC-07)". The name is remembered for 30 days after DHCP last saw the device, so a PC that was switched off yesterday is still named today.
- Uplinks vs device ports (v0.103.0 and later): Groundskeeper works out which ports lead to another switch or access point and which have a single PC, printer or phone on them, from what the switch reports at the other end (LLDP) and how many devices it has seen behind each port. A port-down event says which kind it was and what was last seen there. Two tick boxes choose whether each kind raises a warning: uplinks are on by default; device ports are on for installs upgrading from an earlier version and off for new installs, because a device port going down is usually just a machine being switched off. Untick a box and that kind of port stays OFF the feed entirely (v0.107.1 and later) -- the port is still tracked, it just says nothing. Ports Groundskeeper cannot classify always warn, as they always have.
- Throughput history (v0.110.0 and later): each monitored port's traffic counters are read every poll and kept as a rate -- 5-minute detail for 48 hours, hourly for 7 days, daily for 90 days -- along with every switch reboot and outage. This adds up to about 90 MB to the database on a 40-switch estate and far less on a small one; the "Keep throughput history" tick box on the connector turns it off. The per-port charts that read this history arrive in a later release.
- Which ports (v0.118.0 and later): two lists on the connector, one name per line. Only monitor these ports limits monitoring to the named ports (leave it empty to monitor every enabled port, the usual choice); Ignore ports whose name contains skips the switch's own virtual and management interfaces, and is shown pre-filled with the defaults so you can see and edit what is skipped. Both could previously be set only by editing config.yaml.
- What it shows: battery capacity, estimated runtime, load, and on-battery detection for APC and Eaton UPS units via SNMP v2c.
- What you need: one row per UPS network management card (NMC IP/hostname) and its read-only SNMP community string.
- Default poll: 5 minutes.
- What it shows: server hardware health via the iDRAC Redfish API -- CPU, memory, storage and power supplies.
- What you need: one row per iDRAC (the iDRAC management IP, not the server OS address). Leave SSL verification off for self-signed iDRAC certs.
- Default poll: 10 minutes.
- What it shows: firewall reachability and branch-office VPN (BOVPN) tunnel status, polled directly from the Firebox via SNMPv3.
-
What you need: SNMPv3 enabled on the Firebox (Fireware Web UI ->
System > SNMP, or for cloud-managed devices, WatchGuard Cloud > Configure
Devices > [Firebox] > Device Configuration > Device Settings > SNMP) with a username, authentication password (SHA or MD5) and privacy password (AES or DES, or none), plus an SNMP management station entry or packet filter policy allowing the Groundskeeper server to poll UDP 161.
- Default poll: 5 minutes.
WatchGuard's REST API doesn't expose live reachability or VPN tunnel status (the Management API is configuration-only; the Reports API is historical traffic analytics), so this connector polls the Firebox directly over SNMPv3 instead. Alarm traps aren't implemented yet -- that would need a separate always-on trap listener and is tracked as a possible future connector.
- What it shows: M365 service incidents and advisories via Microsoft Graph.
- What you need: an Azure app registration (tenant ID, client ID, client secret) with the ServiceHealth.Read.All application permission.
- Where to find it: tenant/directory ID is in Azure Portal > Azure Active Directory > Overview; the client ID and secret come from App registrations > [your app] > Certificates & secrets.
- Default poll: 15 minutes.
- What it shows: licence seat consumption -- warns when a SKU approaches or exceeds its purchased count.
- What you need: the same tenant as Service Health, plus the Organization.Read.All permission. You can reuse the Service Health app registration -- just add this permission alongside the existing one.
- Tuning: warning threshold (default 95% of purchased seats), and an optional ignore-list for free/trial SKUs that create noise.
- Default poll: 60 minutes.
- What it shows: uptime checks for common school cloud services -- ParentPay, Wonde, Arbor, Bromcom, SIMS Online, RM Unify, Smoothwall Cloud, ScholarPack, eduLink One, Firefly, MCAS, Lightspeed, Senso, Azure, Google Workspace, and any custom services you add.
-
What you need: nothing but the list of services to watch -- tick the ones
you use. Custom entries take the form
Name|https://url. - Default poll: 10 minutes.
- What it shows: outbound connectivity checks over HTTPS (port 443).
- What you need: nothing by default (it checks Google, Microsoft 365 and GitHub). You can add your own target URLs and set a timeout.
- Default poll: 5 minutes.
- What it shows: SPF, DMARC, DKIM, TLS, HTTPS redirect and security-header checks for your email/web domains. A direct replacement for the retired NCSC Mail Check / Web Check.
- What you need: just the list of domains to monitor, one per line.
- Default poll: 1440 minutes (once a day).
- What it shows: TLS certificate expiry monitoring -- alerts before certs expire.
-
What you need: the hostnames to check, one per line (append
:portfor non-443). Set warning (default 30 days) and critical (default 7 days) thresholds. - Default poll: 1440 minutes (once a day).
- What it shows: AV/EDR coverage across enrolled endpoints, and new security event alerts (malware, PUPs, exploits, blocked programs, network attacks) from the last 30 days.
-
What you need: an Access ID and password (read-only recommended), an
API Key, and your Account ID, all from **WatchGuard Cloud > Administration
Managed Access**. Account ID format varies by account type (
ACC-XXXXXXorWGC-1-xxxxxxx) -- it's on the same Managed Access page. UK schools use the deu region (WatchGuard's EMEA data region). - Tuning: coverage warning threshold (default 95% of enrolled endpoints).
- Default poll: 60 minutes.
- What it shows: security events -- account lockouts, failed-logon bursts, and changes to sensitive groups.
- What you need: the domain controller to query (or leave blank for the local machine), and optionally the sensitive groups to watch. Tune the failed-logon burst threshold (default 10 in the lookback window).
- Default poll: 60 minutes.
- What it shows: AD replication health, FSMO role holder reachability, SYSVOL/NETLOGON shares, and sensitive-group membership changes.
-
What you need: the AD domain FQDN (or leave blank to auto-detect). Uses
repadminand standard AD tooling on a domain-joined server. Choose which checks to run and which groups to watch. - Default poll: 60 minutes.
These connectors read endpoint data over the network from a domain-joined Groundskeeper server, without the optional GKAgent. (For richer per-device detail -- BitLocker, Defender, SMART, battery health and more -- deploy the GKAgent endpoint agent; see Getting Started.)
- What it shows: CPU, RAM, disk, services and uptime for Windows Server infrastructure.
- What you need: either auto-discovery from Active Directory (with a re-discovery schedule) or a manual server list -- or both. Set thresholds for CPU, RAM and disk, and list any Windows services to watch (e.g. DNS, NTDS, W32Time, Spooler).
- Default poll: 5 minutes.
- What it shows: endpoint health for Windows 10/11 PCs -- BitLocker status, pending reboots, antivirus, update age and disk space.
-
What you need: AD discovery (auto-detects the search base) or a manual
host list. Tune the BitLocker requirement, pending-reboot warning age
(default 7 days, for KCSIE compliance), update-age warning, and disk
threshold. Requires
RSAT-AD-PowerShell. - Default poll: 1440 minutes (once a day).
- What it shows: disk-space and Windows 11 readiness scans across the estate, surfaced on the Reports page.
-
What you need: your AD search base in LDAP form (e.g.
DC=school,DC=local). RequiresAdd-WindowsFeature RSAT-AD-PowerShell. - Default poll: 1440 minutes (once a day).
- What it shows: toner/ink levels, paper-tray state and error conditions for network printers via SNMP v2c.
- What you need: one row per printer (IP/hostname) and the read-only SNMP community string. Set toner warning/critical thresholds and choose whether empty trays raise alerts.
- Default poll: 60 minutes (toner changes slowly).
- What it shows: service-account password expiry and stale user accounts -- the things that quietly cause MIS-sync failures.
-
What you need: AD search base (auto-detects). Set the service-account
warning window (default 30 days; critical at 7), the stale-user threshold
(default 90 days), and the alert count. Requires
RSAT-AD-PowerShell. - Default poll: 1440 minutes (once a day).
- What it shows: client machines running 14+ hours -- for energy saving and security hygiene.
-
What you need: AD search base (auto-detects). Tune the overnight
threshold, the morning check window (default scan 06:00--10:00), and the
per-machine WMI timeout. Requires
RSAT-AD-PowerShell. - Default poll: every 4 hours (the scan only fires inside the check window).
- What it shows: detects teacher-side exam-marking applications on domain endpoints (RM Assessor, Scoris, ePEN, and others) -- so IT gets early warning of exam-season support demand.
-
What you need: AD search base (auto-detects); tick the products to look
for. Requires
RSAT-AD-PowerShell. - Default poll: 10080 minutes (once a week).
- What it shows: live service status for your management information system -- Arbor, SIMS, Bromcom or SEEMiS.
- What you need: just select your MIS provider.
- Default poll: 10 minutes.
- What it shows: endpoint patch status, missing updates and device inventory across one or more Action1 organisations.
- What you need: an Action1 API client ID and secret, your region, and one row per school (org ID).
- Where to find it: Action1 > Configuration > API Credentials. UK schools are almost always on the Europe region (app.eu.action1.com); the org ID UUID is in the dashboard URL.
- Default poll: 60 minutes.
You can enable, disable or reconfigure connectors at any time from Settings > Connectors -- nothing here is locked in at setup. New connectors are added in Groundskeeper releases; see the Releases page and Discussions to request one.
Last updated: 2026-09-22 (v0.180.23)