Remote access policy settings

This page lists every profile setting that governs remote desktop sessions: the remote_access, remote_display, and remote_logon settings. It does not cover the remote console, which no profile setting governs. Values are from Depot 0.4.1.

Scope

• Every setting here can be set in any profile and made mandatory. See Profiles and policies.
• The remote_access settings apply to remote desktop sessions on Windows, Linux, and macOS endpoints. Your Outpost resolves them when a session opens, and again at each change of signed-in user, and signs them into the session. FreeBSD and OpenBSD have no remote desktop.
• remote_display.enabled and remote_logon.disable_cad_on_server_core act on Windows endpoints only, and take effect only from device scopes: the whole client, a site, a device group, or an endpoint.
• The full catalog of every profile setting is in Policy settings.

Remote access

Key	Type	Default	Merge	What it does
remote_access.ai_control	Boolean	true	Off wins	Lets Pioneer AI see the screen and use the mouse and keyboard during a remote session a technician opened, after the technician approves each task. Your Outpost checks it before each task and before every step, and the agent never reads it. See Let Pioneer AI control a session.
remote_access.allowed_modes	List	unattended, attended, consent, escorted	Common values, strictest	The access modes a session may open in. Options, least to most restrictive: unattended, attended, consent, escorted, none. A session opens in the least restrictive mode allowed. none alone turns remote desktop off.
remote_access.audit_file_hash_to_endpoint	Choice	keyed	Least revealing	How the audit log records the hash of each file sent to the endpoint. Options: plain (SHA-256), keyed (HMAC-SHA256 under a key that stays on the endpoint), none.
remote_access.audit_file_hash_to_technician	Choice	keyed	Least revealing	The same, for files copied from the endpoint.
remote_access.audit_file_names_to_endpoint	Choice	full_path	Least revealing	How the audit log records the names of files sent to the endpoint. Options: full_path, file_name, path_hash, name_hash.
remote_access.audit_file_names_to_technician	Choice	full_path	Least revealing	The same, for files copied from the endpoint.
remote_access.audit_file_sizes_to_endpoint	Choice	exact	Least revealing	How the audit log records sizes of files and clipboard content sent to the endpoint. Options: exact, summary (rounded, such as 2.1 MB).
remote_access.audit_file_sizes_to_technician	Choice	exact	Least revealing	The same, for content copied from the endpoint.
remote_access.clipboard_images	List	to_endpoint, to_technician	Common values	Directions images may sync through the clipboard. Empty turns image sync off.
remote_access.clipboard_text	List	to_endpoint, to_technician	Common values	Directions plain and rich text may sync through the clipboard. to_endpoint also governs Type clipboard. Empty turns text sync off.
remote_access.consent_timeout_seconds	Seconds	120 (2 minutes)	Smallest above 0	How long the person at the endpoint has to answer a consent prompt before the session is denied.
remote_access.e2e_require_verification	Boolean	false	On wins	Require the technician to confirm the six-digit secure transfer code before any clipboard or file transfer, at every change of signed-in user. Off, the browser checks the endpoint’s remembered key and asks only when it changes.
remote_access.escort_quorum	Integer	1	Largest	How many escorts must be present before the technician’s input reaches the endpoint in an escorted session.
remote_access.file_transfer	List	to_endpoint, to_technician	Common values	Directions files and folders may be copied. Also gates the Files browser, which needs to_technician. Empty turns file transfer off.
remote_access.file_transfer_max_file_mb	Integer	0	Smallest above 0	Largest single file, in MiB, in either direction. 0 means no limit.
remote_access.file_transfer_max_session_mb	Integer	0	Smallest above 0	Total file data per session, both directions together, in MiB. 0 means no limit.
remote_access.idle_resume_requires_reauth	Boolean	false	On wins	A session paused for technician idle resumes only after the technician confirms their identity again. Off, the next input resumes it. See Require a sign-in to resume.
remote_access.recording_pauses_on_idle	Boolean	true	On wins	Stop recording while a session is paused for technician inactivity.
remote_access.recording_required	Boolean	false	On wins	Record every session on the endpoint. Off until a profile turns it on. Available on Enterprise and MSP. See Recording on other plans.
remote_access.session_max_seconds	Seconds	3600 (1 hour)	Smallest above 0	Longest a session may run. 0 means no time limit.
remote_access.tech_idle_pause_minutes	Integer	10	Smallest above 0	Technician idle time before input is held and the session pauses, counted from the technician’s own input. 0 turns the pause off.
remote_access.tech_idle_terminate_minutes	Integer	30	Smallest above 0	Technician idle time before the session ends. 0 turns the idle end off.
remote_access.tech_idle_warn_minutes	Integer	5	Smallest above 0	Technician idle time before the session shows a warning. 0 turns the warning off.

Remote display

Key	Type	Default	Merge	Platforms	What it does
remote_display.enabled	Boolean	false	Off wins	Windows	Let the Outpost Recovery Display component keep one 1920x1080 console monitor on an endpoint that has no usable physical display output, so the console can be seen. Requires a released Windows driver package for the component.

Remote logon

Key	Type	Default	Merge	Platforms	What it does
remote_logon.disable_cad_on_server_core	Boolean	false	Off wins	Windows Server Core	Open the Server Core sign-in screen without Ctrl+Alt+Del, so a remote technician can sign in. Server Core has no software Ctrl+Alt+Del to send.

Notes on individual values

remote_access.allowed_modes

A mode is allowed only where every applicable profile allows it, so a profile can narrow access and never widen it. Where two profiles share no mode at all, the stricter of the two wins rather than nothing. With no profile setting it, every mode is allowed and sessions open unattended. See Configure access modes and consent.

Session and idle time limits

A time limit that no profile sets uses the default in the table. A profile that sets 0 turns that limit off. Because the merge takes the smallest value above 0, a limit set by any other applicable profile, including a mandatory one, still applies, and so do framework floors. See Limit session length.

remote_access.recording_required

Recording is off on every plan until a profile turns it on. No framework baseline sets it. Session recording is included in Enterprise and MSP. On Home Lab and Essentials, the setting is hidden in the profile editor, and a profile that requires recording cannot be applied. A profile that already required recording before a change of plan keeps working: sessions run unrecorded, and the viewer shows Policy requires session recording, which is not included in this plan. This session is not being recorded. See Record remote sessions.

Merge rules

Merge	Meaning
Common values	Only the values every applicable profile lists. to_endpoint in one profile and to_technician in another resolve to neither.
Common values, strictest	As above, but two lists with nothing in common resolve to the stricter one.
Smallest above 0	The smallest positive value. A positive value always beats 0, which means no limit.
Largest	The largest value.
Least revealing	The choice that records the least.
On wins, Off wins	Any applicable profile that sets the winning value decides it.

remote_display.enabled

The component is installed only when a fresh check of the console finds no usable physical display output. It stays while the endpoint is headless, including across restarts, and is removed when a physical display returns or the setting turns off. It never creates a Remote Desktop session and never restarts the endpoint. A restart that Windows needs is reported instead. In the screen list, a console on the recovery monitor is marked Recovery display.

remote_logon.disable_cad_on_server_core

On Windows Server Core only, the agent sets the Windows DisableCAD policy to 1 and records the value it replaced. When the setting turns off, or the agent is uninstalled, the agent restores the recorded value. A value of 1 that something else set is left alone. A Group Policy that enforces 0 wins at its next refresh.

Framework floors

Framework baselines clamp these settings. A profile can be stricter than a floor, never weaker. A time limit set to 0 is clamped to the floor too.

Setting	Floor	Frameworks
remote_access.allowed_modes	attended, consent, escorted (no unattended)	CJIS, NIST 800-53, NIST 800-171, CMMC Level 2
remote_access.escort_quorum	2	CJIS
remote_access.tech_idle_pause_minutes	15	PCI DSS
remote_access.idle_resume_requires_reauth	On	PCI DSS
remote_access.clipboard_text, remote_access.clipboard_images	Off	CJIS
remote_access.clipboard_text, remote_access.clipboard_images	to_endpoint	PCI DSS, ISO 27001
remote_access.file_transfer	Off	CJIS
remote_access.file_transfer	to_endpoint	PCI DSS, ISO 27001, HIPAA, SOC 2, NIST 800-53, NIST 800-171, CMMC Level 2

The DISA STIG and Microsoft security baselines recommend to_endpoint for the clipboard and file transfer settings without enforcing it. See Compliance framework baselines.

Related

• Configure access modes and consent
• Clipboard and file transfer
• Record remote sessions
• Let Pioneer AI control a session
• Policy settings