Remote Sessions
Diagnose and fix issues on a managed endpoint with a visible, logged remote session.
What a Remote Session Is#
A remote session lets an operator see and, when required, control a managed endpoint from the platform. It is the tool for problems that cannot be diagnosed from telemetry alone.
A session is always a deliberate, visible act. It is recorded, it is attributed to the operator, and the user can see that support is connected.
Starting a Session#
- 1Open the endpoint
Find the device in the fleet view and open its detail page. Confirm you are on the right endpoint before you connect.
- 2Start the session
Choose the session mode from the endpoint actions. A view-only session is the safest first step when you are unsure what you will find.
- 3Inform the user
Tell the user that a support session is starting. A session that appears without warning is treated as an intrusion, and rightly so.
- 4Close and record
End the session when the work is done. The session start, end, operator, and endpoint are recorded in the activity log.
Session Modes#
Choose the least powerful mode that solves the problem. Full control should be the exception, not the default:
| Mode | When to use it |
|---|---|
| View only | The operator sees the screen but cannot send input. Use it for diagnosis and for showing a user what is happening. |
| Full control | The operator can send keyboard and mouse input. Use it when a fix must be applied on the device. |
| File transfer | Move a file to or from the endpoint as part of a support action. |
| Background shell | Run a command on the endpoint without taking over the user’s screen. |
Security and Logging#
- Sessions are attributed to a named platform user; an anonymous session is not possible.
- Every session is written to the activity log with start, end, endpoint, and mode.
- Remote actions taken during a session are recorded individually, so the change history stays complete.
- Permissions decide who may start a session and which modes they may use.