Recast Right Click Tools Update: Remote Agent Enrollment and ARM64, macOS App Patching

The announcement leaves out version numbers and setup details. Recast's own documentation fills in some of those gaps, and those details are covered below.

What Recast announced​

The November 5 announcement groups the changes into three areas:

• Remote and cloud-only device management. Recast says its Agent Gateway supports internet-based enrollment and remote management. It is aimed at endpoints that are not reliably connected to the corporate network. Recast says administrators can investigate and fix device issues without arranging a session with the user.
• Application visibility. Right Click Tools Insights adds what Recast calls new and expanded inventory awareness. It is meant to show which applications are installed and where outdated versions may create risk.
• Patching. Right Click Tools Patching finds outdated application versions and pushes updates to targeted devices. Recast says the latest version adds support for ARM64 and macOS applications.

Recast says the features were developed with existing customers. CEO Will Teevan described the release as answering requests for "broader reach, clearer application visibility, and faster ways to act." That is the company's own framing. No independent testing of the product's results has been published.

Summary: This is a single vendor announcement carried by three outlets, not three separate news events. It covers remote reach, inventory and patching for organizations running Intune, ConfigMgr or both.

Agent Gateway enrollment and the minimum version​

The phrase "internet-based enrollment" in the press release refers to a feature with a specific starting version. According to Recast's 5.12 release notes, Right Click Tools Version 5.12.2607.2401, released July 27, 2026, includes new features for Right Click Tools Patching, Insights, Privileged Access, Recast Management Server, and Right Click Tools Enterprise & Community. The relevant addition is that you can now enroll Recast Agents via Agent Gateway, meaning that you can register devices with Recast Agent installed without the need for direct line of sight to your self-hosted Recast Management Server.

Recast's "What's New" page says that this feature resolves a significant challenge for remote or internet-based devices and lists the minimum Right Click Tools version as 5.12.2607.

Enrollment works through keys. Recast says the method also works for Recast Proxies and Recast Agent Gateways, and requires the use of enrollment keys, which allow for secure authentication without relying on same-domain trust or manual approval in RMS. Admins with existing deployments do not have to switch right away: the existing Recast Agent/Proxy/Agent Gateway enrollment method, which requires a connection to your Recast Management Server, will continue to function as usual, and you can switch to enrolling these Recast components via Agent Gateway whenever it suits.

What sits behind the gateway​

This is not a native Intune or ConfigMgr feature. It runs on Recast's own infrastructure, which you have to deploy and maintain:

• A Recast Agent Gateway is an on-premises component that connects your Recast Management Server to your Recast Agents.
• A single Agent Gateway is automatically deployed and authorized when you install Recast Management Server. You can also install additional Agent Gateways to accommodate all of your Recast Agents. Each Agent Gateway must be installed on a different server.
• Recast's sizing guidance says an Agent Gateway is required for every 20K Recast Agents deployed.
• The endpoint component is a service running on a computer that acts as a Right Click Tools client. When the Agent service is running, Right Click Tools actions can run under the system account, which means that Local Admin is not required to run actions.

For example, an organization with 50,000 endpoints would need at least three gateways, each on its own server. Each one would also need firewall rules, certificates and patching. Recast's troubleshooting documentation includes topics on firewall requirements and on testing a TCP 444 connection, which shows that network configuration is part of the job.

Deployment parameters​

Recast documents MSI switches for silent installs. The agent install string can include an RMS URL (RCTENTERPRISESERVER), a gateway URL (AGENTGATEWAY) and an ENROLLMENTKEY value. The documentation shows this pattern:

msiexec.exe /qn /i "Recast Agent.msi" RCTENTERPRISESERVER="https://<RMS FQDN>:<Port>" AGENTGATEWAY="https://<Agent Gateway FQDN>:<Port>" ENROLLMENTKEY="AGENTENROLLMENTKEY" /L*V "%temp%\RecastAgentMSI.log"

Two upgrade points are worth knowing before you start:

1. If you have a standalone Recast Proxy and/or Agent Gateway installed on a different device than RMS, you'll need to update them separately before updating Right Click Tools.
2. After upgrading to new Recast Software versions, you may need to re-authorize your Right Click Tools server as an Agent Gateway. In RMS, this is done from the Agent Gateways page by editing the server and enabling the Authorized checkbox.

To check that it worked, open the RMS Agents view. It shows whether each agent is connected, when it last connected and which gateway it uses. Recast notes that an agent can appear disconnected if the agent is not connected to an agent gateway (even if the gateway is connected to RMS) or if it is connected to a gateway that has lost its own connection to RMS.

Summary: Agent Gateway enrollment arrived in Right Click Tools 5.12.2607. It depends on enrollment keys and on gateway servers you run yourself, with one gateway per 20,000 agents. The older enrollment method that connects directly to RMS still works.

ARM64 and macOS patching​

For Windows administrators, ARM64 support is the most notable patching change. Windows on Arm laptops are increasingly common in corporate fleets, and third-party patching tools that only handle x64 installers leave those machines out. Recast says Patching now covers both ARM64 and macOS applications, which it describes as extending centralized maintenance to more kinds of endpoints.

The announcement does not say which release added each capability, which deployment modes are supported, or whether macOS support covers ConfigMgr or only Intune. Recast's documentation lists a 5.13.2610 release as its newest. Since Macs are not normally managed through ConfigMgr, assume Intune is the macOS path until Recast's release notes say otherwise. Before planning a rollout, check the "What's New in Patching" notes for your version.

Recast's CVE figures​

To explain the urgency, Recast says its proprietary database recorded a 438% increase in CVEs and a 44% increase in software versions released between the first and third quarters of 2026.

These numbers come from Recast's own database. The announcement does not explain what that database covers, how it counts, or which software it tracks. A vendor that sells patching tools has an obvious interest in describing a growing patch backlog. The general point, that third-party application updates are frequent and need regular inventory and prioritization, is well established. The 438% figure itself has not been independently verified and should not be cited as an industry-wide measure.

Who should care​

• Organizations running both ConfigMgr and Intune while they move to the cloud. They are the main audience, because Right Click Tools works across both.
• Teams supporting remote workers who have relied on Cloud Management Gateway or VPN to reach endpoints. Gateway enrollment is another option, but it adds servers you have to run.
• Organizations adding Windows on Arm devices that need third-party application patching to cover those machines.

Some questions are still open. Recast's materials do not give pricing, per-feature licensing, or a full mapping of each announced feature to a release. Recast's own documentation does note that a Right Click Tools Enterprise license alone gives access to Patching to deploy Recast Agents. Patching other applications appears to need its own Patching license.

Verdict​

This is mostly an incremental update. The most concrete change is Agent Gateway enrollment with enrollment keys, which has been available since 5.12.2607 and solves a real problem: getting agents onto devices that cannot reach an internal management server. ARM64 and macOS patching broadens coverage, but check the version notes for details. Treat Recast's CVE figures as vendor marketing data.

If you run a mixed Intune and ConfigMgr environment, check which Right Click Tools version you have, plan how many gateway servers you will need, and read the release notes before relying on the new features in production.