The Messy Inventory Is a Configuration Problem. Here’s How to Fix It Before It Becomes Someone Else’s Audit Finding. Discovery gets you data. Configuration determines whether that data stays trustworthy.
You’ve set up agentless scanning across IP ranges, deployed agents to roaming endpoints, and connected cloud platforms through API-based actions. Assets are flowing in. The dashboard is populated. For the first time, you have a real picture of a client’s environment not a spreadsheet, not a three-month-old export, but an actual, continuously updated inventory.
And then, without the right configuration in place, it starts to drift. A device gets decommissioned but stays in the inventory as active. A former employee’s computer account remains in Active Directory and shows up in reports. A passive listener discovers something on the network at 2 am and adds it and it never gets seen again. Six months later, your client’s inventory is a mixture of current assets and historical noise that no one has cleaned up and your reporting is no longer reliable.
That’s not a discovery problem. That’s a configuration problem. And it’s entirely preventable.
In Part 6 of the Lansweeper MSP Masterclass, Thomas Van Havere walks through the general configuration settings that keep an inventory clean and manageable: cleanup rules for active and passive assets, Active Directory handling, site branding, and the full access control stack (asset scopes, roles and permissions, account groups, and user invitations). This post covers every setting in the video, with the reasoning behind each recommendation.
Part 1: Keeping Your Inventory Clean – Asset Cleanup Rules
The goal of cleanup rules is straightforward: assets that are no longer present in the environment should not appear in reports. Stale data in an active inventory produces false confidence: a count that looks right but isn’t, a report that passes an audit but misrepresents the environment. Lansweeper’s cleanup rules give you automated, configurable controls over how long an asset remains active, when it transitions to non-active, and when it gets permanently removed. These live under Assets → Settings.
Active Asset Cleanup Rules
Setting: “Set assets to non-active if not seen in the last X days”
This is the core lifecycle rule for scanned assets. When an asset hasn’t been discovered in X days – it didn’t respond to a network scan, didn’t report in as an agent, wasn’t present in Active Directory – Lansweeper flags it as non-active rather than leaving it in the active inventory.
Thomas’s advice: 15 days rather than the default 30. The reasoning is practical a shorter window surfaces potentially missing or decommissioned assets faster, prompting investigation rather than letting stale records accumulate. When an asset drops to non-active, that’s a signal: has it been decommissioned? Is something wrong? Is it simply offline temporarily? Non-active status triggers that question; leaving it active for 30 days delays it unnecessarily.
The paired setting: “Set non-active assets as active when they are re-scanned”
This is the counterpart. If a device goes non-active because it was offline for maintenance and then comes back online, the next scan automatically restores it to active status. You don’t need to manage this manually the inventory corrects itself when the asset reappears.
Setting: “Permanently delete assets if not seen in the last X days”
For assets that have been non-active long enough that permanent removal is appropriate, this rule handles the cleanup automatically. Thomas uses 60 days for the demo environment which is a reasonable window that allows non-active investigation time before deletion, without letting the inventory accumulate years of historical ghost records. The right timeframe here depends on the
client environment. Environments with frequent hardware rotations might benefit from a tighter window. Environments with seasonal or project-based equipment that comes and goes might need a longer one. Set it deliberately, not by default.
Why this matters for MSPs: Non-active assets by default don’t appear in standard reports. That means cleanup rules don’t just keep your inventory tidy; they keep your reporting accurate! A client who sees 847 assets in Lansweeper should be seeing 847 assets that are actually present and active, not 700 active assets and 147 devices nobody has touched since 2022. The cleanup rules maintain this distinction automatically, without manual quarterly inventory reviews.
Start Here
New to the series?
Start with Part 1 to understand the MSP architecture and multi-site management model before diving into installation.
Network Visibility (Passive Discovery) Cleanup Rules
Passive discovery (the network listener that identifies assets from traffic it sees passing by) can surface devices quickly, but it also picks up things that pass through the network transiently and are never seen again. For example: a contractor device, a visitor’s phone on the guest Wi-Fi, or a scanning appliance that ran for an afternoon.
These transient detections are noise if they accumulate in the inventory as though they’re permanent fixtures. Separate cleanup rules for passively discovered assets let you be more aggressive than you’d be for actively scanned assets.
Setting: “Set passive assets to non-active if not seen in X days”
Thomas recommends 5 days for passively discovered assets, which is much shorter than the 15-day window for actively scanned devices. A device that showed up in passive discovery and hasn’t been seen for five days probably isn’t a permanent part of the environment.
Setting: “Delete passively discovered assets if not seen in X days”
10 days is Thomas’s advice here. Passive assets that disappear for ten days are cleaned up automatically, preventing the inventory from filling with transient devices that were never meaningfully part of the environment.
Active Directory Cleanup Rules
Active Directory introduces a specific category of stale data: disabled computer accounts. When a device is decommissioned, its AD computer account is typically disabled rather than immediately deleted. If Lansweeper is pulling from AD and that account is still in the directory, it can show up in inventory as though the device is active even if it was physically removed from the environment months ago.
Setting: “Permanently delete computers disabled in Active Directory”
Thomas recommends enabling this. His reasoning is clear: disabled AD computer accounts create duplicates and false positives in the inventory. They don’t represent active assets. Keeping them in Lansweeper as active records misleads reports and inflates asset counts.
The alternative: setting disabled AD computers to non-active rather than deleting them, preserves the records but keeps them as non-active entries. Thomas’s view is that these are genuinely stale records, and the cleaner approach is permanent deletion. For MSPs managing clients who need to keep historical records for compliance reasons, the non-active option gives you the data without it polluting active reporting.
Part 2: Site Settings and Branding
Once cleanup rules are configured, the next stop is the Site Settings: accessible via the cogwheel in the top right corner of any site.
Authentication
Site Settings begins with your site information: site ID, hosting location, and authentication
configuration. Two authentication options are worth setting up from the start for any client site:
Multi-Factor Authentication (MFA): Adds a second authentication layer for all users logging into the site. For MSPs managing environments under compliance frameworks or security-conscious clients, this is a straightforward baseline control. Enable it via the information bulb → Learn More path for step-by-step configuration guidance.
Single Sign-On (SSO): For clients with an existing identity provider (like Microsoft Entra ID, Okta, or others), SSO integration means users access Lansweeper through their existing corporate credentials rather than a separate Lansweeper account. This simplifies access management and ties Lansweeper into the client’s existing identity governance.
Branding
The Branding tab lets you customize what users see when they access the site:
- Site name: Can be changed at any time. The name shown in the top-left corner of the interface updates immediately. Note the constraint Thomas flags: the original site name used at creation becomes part of the URL and cannot be changed, even if the display name changes. Name sites thoughtfully from the start.
- Custom image: Upload a client logo or your MSP branding to make the site feel like part of the client’s tooling environment rather than a generic third-party product.
- Disclaimer message: Displayed to all users on login. This is useful for test environments (“This is a staging environment – data may not reflect production”), compliance contexts, or any situation where you need a universal message visible to all site users before they start working.
Part 3: Access Control – The Full Stack
This is where Part 6 goes deep and where MSPs managing complex client environments with multiple user types will spend the most time. Lansweeper’s access control system is built in layers:
- Asset scopes define what can be seen
- Roles define what can be done
- Groups bundle roles for team-level management
- Accounts are individual users assigned to groups or roles directly
Thomas walks through this in a specific order. The order matters because each layer depends on the one before it.
Step 1: Asset Scopes
An asset scope is a filter that restricts what assets a user or role can see. Without asset scopes, every user with site access sees every asset in the inventory. Asset scopes let you apply data visibility limits – by asset type, domain, IP location, or physical location – so that a user only sees the portion of the environment relevant to their role.
To create an asset scope: Site Settings → Account Management → Asset Scopes → Create.
Give it a descriptive name (Thomas uses “Windows Only” as the demo). Then define conditions: up to 20 conditions per scope, combinable with AND/OR logic.
- Asset type – limit to Windows, Linux, macOS, network devices, cloud assets, etc.
- Domain – restrict to a specific Active Directory domain
- IP location – limit to a specific IP range or subnet
- Installation – filter by software or agent installation status
- Physical location – if location tags are in use, restrict by physical site or building
For the “Windows Only” example in the video: asset type equals Windows. Any user assigned this scope only sees Windows devices: Azure VMs, cloud assets, network infrastructure, Linux servers are all hidden from their view.
Why asset scopes matter for MSPs: In a multi-function client environment, different teams have different legitimate needs. IT helpdesk needs Windows and endpoint data to handle tickets. Network teams need switch and router data. Security teams need the full inventory. Rather than giving everyone full access, or maintaining separate Lansweeper sites for each team, asset scopes let you configure one site with appropriately limited views per role.
Step 2: Roles and Permissions
A role defines what a user can do within the assets they can see (as defined by their
asset scope). Lansweeper provides a comprehensive permission checklist: report viewing, inventory management (create, update, delete), diagramming, software actions, discovery configuration, and more.
To create a role: Account Management → Roles and Permissions → Create New Role.
Thomas builds a “Windows Only View” role in the demo, assigning permissions for:
- View reports
- Full inventory management (create, delete, update)
- Diagramming
- Software actions
Then attaches the “Windows Only” asset scope to the role so anyone assigned this role can do all of the above, but only against Windows assets.
Practical guidance for MSPs:
Build user roles that reflect how teams actually work, not just what’s technically possible. Common user roles worth creating from the start of any client engagement:
- Read-Only Viewer – can see asset data and run reports, cannot make changes. Suitable for management stakeholders, auditors, or security team members who need visibility into IT data without write access.
- Helpdesk Technician – full inventory management within a scoped asset view (e.g., endpoints only). Can investigate and update asset records, cannot touch network or cloud infrastructure.
- IT Administrator – broad access across inventory, discovery configuration, and reporting. Typically no asset scope restrictions.
- Network Specialist – inventory and diagramming access scoped to network device asset types.
Roles are reusable: create them once and assign them to multiple users and groups. If a role needs to change (adding a new permission, adjusting a scope), the change applies to every user assigned that role.
Step 3: Account Groups (Optional, But Recommended for Larger Teams)
Account groups bundle multiple users under a shared role assignment, making it easier to manage access at team scale rather than individual user level. If you’re setting up Lansweeper for a client with an IT team, a helpdesk team, and a network operations team, groups let you assign the right role to each team once then manage membership, not permissions, when people join or leave.
To create a group: Account Management → Account Groups → Create Group.
Give it a name (“IT Helpdesk” in the video), assign user accounts (added later as invitations are accepted), and attach the role or roles that apply to that group. Any user added to the group inherits the group’s role and, by extension, its asset scope.
Groups are optional for small client environments with just a few users. They become genuinely valuable once a client has five or more people who need Lansweeper access with different permission levels.
Step 4: Inviting Accounts
User accounts in a Lansweeper site come from two sources:
Multi-site management portal members: Anyone who is part of the MSP’s multi-site management portal is automatically an administrator or owner in every site under that portal. Their role cannot be downgraded at the site level; they have elevated access by virtue of portal membership. This is intentional: MSP technicians who manage the portal need unrestricted access to client sites.
Directly invited users: For client-side users (helpdesk staff, IT managers, department heads who need access to their own site but not to the MSP’s full portal), invite them directly from the site’s Accounts section. Click the invitation button, enter their email, assign a group or role, and send. The recipient receives an invitation email. If they already have a Lansweeper account, they accept and immediately have the access level you’ve defined. If they don’t, they create an account through the invitation flow and land in the site with the configured permissions.
Invitation status: Pending invitations are visible in the Accounts section until accepted. You can see exactly who has access and who is waiting to activate their invitation.
Multi-Site Management Portal: Roles at the Organization Level
The Configuration That Keeps Discovery Valuable
The Masterclass has now covered every major discovery type – agentless network scanning, agent-based endpoint discovery, cloud discovery – and now the general configuration that makes all of it sustainable.
Without cleanup rules, discovery accumulates noise. Without access control, the inventory is either locked to a handful of admins or exposed to everyone without appropriate limits. Without branding and authentication controls, the site doesn’t operate as a professional, secure client-facing tool.
These aren’t afterthoughts. They’re what separates a Lansweeper deployment that runs well for two years from one that slowly becomes less useful as the data drifts, the access gets messy, and the reports stop being trusted.
Configure them once, set them deliberately, and they largely run themselves.
Watch the Full Video
See Thomas walk through every setting live – including the asset scope and role creation flow in full: MSP Masterclass Part 6 – General Configuration →
Catch up on the full series:
Coming up next: With discovery running and the environment configured, the series moves into what you can do with the data – dashboards, reporting, network diagrams, and the intelligence layer that turns asset inventory into operational and security value.
Get in Touch
Book a call with the Lansweeper MSP team
No generic demo. A real conversation about your business with people who understand what you’re building and want to help you grow it.
