The RSJ Agent
Groundskeeper, Caretaker and Courier share one small agent on each machine, with a module per product. Before you put it on every computer in a school, you should know exactly what it is. This is that, in plain English.
Each product it serves adds a module. The Groundskeeper module only reads: it collects health information such as disk space, updates and security settings, and never changes the machine. A module that can act on a machine, such as Caretaker's, which can show a message or restart a computer, is on the machine only when the school has added that product. Even then, the acting is done by a separate helper for the signed-in session, never by the service itself.
Over HTTPS, to the servers it was set up with and nothing else. It checks each server's certificate against a fingerprint it has pinned, so it will not talk to a machine pretending to be your server. A school that uses its own certificates can have it trust whatever the machine already trusts instead. It checks in every five minutes for Groundskeeper, and every minute for Caretaker so a technician is not kept waiting.
From your own server, never from the internet. When a product on your server carries a newer agent or module, the agent downloads it from that server and checks it against the fingerprint the server gives before installing it.
A folder under C:\ProgramData\RSJ Software\Agent: its identity, which products it serves, the per-product keys it uses to prove itself to your server (encrypted), and its logs. The service locks that folder to the system account and administrators every time it starts. The one exception is a small status file the tray icon reads, which lists versions and health and holds no secrets.
A small tray icon that shows which products are on the machine and whether the agent is healthy. It is information only: nothing can be changed or stopped from it.
Each product records that it needs the agent, and the agent is removed when the last product that needs it is uninstalled, so taking one product off never breaks another.
The agent and its installers are being code-signed under RSJ Software Ltd. Until that is in place, Windows may show a warning when an installer is first run.
Questions about any of this: hello@rsjsoftware.com.