---
title: "Remote access policy settings"
description: "Every remote_access, remote_display, and remote_logon profile setting, with its values, default, merge rule, platforms, and framework floors."
url: "https://support.outpostplatform.com/remote-access/policy-settings/"
product: "depot"
type: "reference"
status: "draft"
ai_summary: "The remote access profile settings in Depot 0.4.1: remote_access.* (modes, consent timeout, escort quorum, session cap, idle thresholds, recording, clipboard and file transfer directions and caps, audit detail, code verification, AI control), remote_display.enabled, and remote_logon.disable_cad_on_server_core. Types, defaults, merge rules, what 0 means, platforms, and framework floors."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/remote-access/policy-settings.md"
license: "CC BY 4.0"
---

# Remote access policy settings

This page lists every profile setting that governs remote desktop sessions:
the `remote_access`, `remote_display`, and `remote_logon` settings. It does not
cover the remote console, which no profile setting governs. Values are from
Depot 0.4.1.

## Scope

- Every setting here can be set in any profile and made mandatory. See
  [Profiles and policies](/automation/profiles/).
- The `remote_access` settings apply to remote desktop sessions on Windows,
  Linux, and macOS endpoints. Your Outpost resolves them when a session opens,
  and again at each change of signed-in user, and signs them into the session.
  FreeBSD and OpenBSD have no remote desktop.
- `remote_display.enabled` and `remote_logon.disable_cad_on_server_core` act on
  Windows endpoints only, and take effect only from device scopes: the whole
  client, a site, a device group, or an endpoint.
- The full catalog of every profile setting is in
  [Policy settings](/automation/policy-settings/).

## Remote access {#remote-access}

| Key | Type | Default | Merge | What it does |
| --- | --- | --- | --- | --- |
| `remote_access.ai_control` | Boolean | `true` | Off wins | Lets Pioneer AI see the screen and use the mouse and keyboard during a remote session a technician opened, after the technician approves each task. Your Outpost checks it before each task and before every step, and the agent never reads it. See [Let Pioneer AI control a session](/remote-access/pioneer-control/). |
| `remote_access.allowed_modes` | List | `unattended`, `attended`, `consent`, `escorted` | Common values, strictest | The access modes a session may open in. Options, least to most restrictive: `unattended`, `attended`, `consent`, `escorted`, `none`. A session opens in the least restrictive mode allowed. `none` alone turns remote desktop off. |
| `remote_access.audit_file_hash_to_endpoint` | Choice | `keyed` | Least revealing | How the audit log records the hash of each file sent to the endpoint. Options: `plain` (SHA-256), `keyed` (HMAC-SHA256 under a key that stays on the endpoint), `none`. |
| `remote_access.audit_file_hash_to_technician` | Choice | `keyed` | Least revealing | The same, for files copied from the endpoint. |
| `remote_access.audit_file_names_to_endpoint` | Choice | `full_path` | Least revealing | How the audit log records the names of files sent to the endpoint. Options: `full_path`, `file_name`, `path_hash`, `name_hash`. |
| `remote_access.audit_file_names_to_technician` | Choice | `full_path` | Least revealing | The same, for files copied from the endpoint. |
| `remote_access.audit_file_sizes_to_endpoint` | Choice | `exact` | Least revealing | How the audit log records sizes of files and clipboard content sent to the endpoint. Options: `exact`, `summary` (rounded, such as 2.1 MB). |
| `remote_access.audit_file_sizes_to_technician` | Choice | `exact` | Least revealing | The same, for content copied from the endpoint. |
| `remote_access.clipboard_images` | List | `to_endpoint`, `to_technician` | Common values | Directions images may sync through the clipboard. Empty turns image sync off. |
| `remote_access.clipboard_text` | List | `to_endpoint`, `to_technician` | Common values | Directions plain and rich text may sync through the clipboard. `to_endpoint` also governs **Type clipboard**. Empty turns text sync off. |
| `remote_access.consent_timeout_seconds` | Seconds | `120` (2 minutes) | Smallest above 0 | How long the person at the endpoint has to answer a consent prompt before the session is denied. |
| `remote_access.e2e_require_verification` | Boolean | `false` | On wins | Require the technician to confirm the six-digit secure transfer code before any clipboard or file transfer, at every change of signed-in user. Off, the browser checks the endpoint's remembered key and asks only when it changes. |
| `remote_access.escort_quorum` | Integer | `1` | Largest | How many escorts must be present before the technician's input reaches the endpoint in an escorted session. |
| `remote_access.file_transfer` | List | `to_endpoint`, `to_technician` | Common values | Directions files and folders may be copied. Also gates the **Files** browser, which needs `to_technician`. Empty turns file transfer off. |
| `remote_access.file_transfer_max_file_mb` | Integer | `0` | Smallest above 0 | Largest single file, in MiB, in either direction. `0` means no limit. |
| `remote_access.file_transfer_max_session_mb` | Integer | `0` | Smallest above 0 | Total file data per session, both directions together, in MiB. `0` means no limit. |
| `remote_access.idle_resume_requires_reauth` | Boolean | `false` | On wins | A session paused for technician idle resumes only after the technician confirms their identity again. Off, the next input resumes it. See [Require a sign-in to resume](/remote-access/access-modes/#idle-reauth). |
| `remote_access.recording_pauses_on_idle` | Boolean | `true` | On wins | Stop recording while a session is paused for technician inactivity. |
| `remote_access.recording_required` | Boolean | `false` | On wins | Record every session on the endpoint. Off until a profile turns it on. Available on Enterprise and MSP. See [Recording on other plans](#recording-plans). |
| `remote_access.session_max_seconds` | Seconds | `3600` (1 hour) | Smallest above 0 | Longest a session may run. `0` means no time limit. |
| `remote_access.tech_idle_pause_minutes` | Integer | `10` | Smallest above 0 | Technician idle time before input is held and the session pauses, counted from the technician's own input. `0` turns the pause off. |
| `remote_access.tech_idle_terminate_minutes` | Integer | `30` | Smallest above 0 | Technician idle time before the session ends. `0` turns the idle end off. |
| `remote_access.tech_idle_warn_minutes` | Integer | `5` | Smallest above 0 | Technician idle time before the session shows a warning. `0` turns the warning off. |

## Remote display {#remote-display}

| Key | Type | Default | Merge | Platforms | What it does |
| --- | --- | --- | --- | --- | --- |
| `remote_display.enabled` | Boolean | `false` | Off wins | Windows | Let the Outpost Recovery Display component keep one 1920x1080 console monitor on an endpoint that has no usable physical display output, so the console can be seen. Requires a released Windows driver package for the component. |

## Remote logon {#remote-logon}

| Key | Type | Default | Merge | Platforms | What it does |
| --- | --- | --- | --- | --- | --- |
| `remote_logon.disable_cad_on_server_core` | Boolean | `false` | Off wins | Windows Server Core | Open the Server Core sign-in screen without <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>Del</kbd>, so a remote technician can sign in. Server Core has no software <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>Del</kbd> to send. |

## Notes on individual values

### `remote_access.allowed_modes` {#allowed-modes}

A mode is allowed only where every applicable profile allows it, so a profile
can narrow access and never widen it. Where two profiles share no mode at all,
the stricter of the two wins rather than nothing. With no profile setting it,
every mode is allowed and sessions open unattended. See
[Configure access modes and consent](/remote-access/access-modes/).

### Session and idle time limits {#time-limits}

A time limit that no profile sets uses the default in the table. A profile that
sets `0` turns that limit off. Because the merge takes the smallest value above
`0`, a limit set by any other applicable profile, including a mandatory one,
still applies, and so do framework floors. See
[Limit session length](/remote-access/access-modes/#limit-session-length).

### `remote_access.recording_required` {#recording-plans}

Recording is off on every plan until a profile turns it on. No framework
baseline sets it. Session recording is included in Enterprise and MSP. On
Home Lab and Essentials, the setting is hidden in the profile editor, and a
profile that requires recording cannot be applied. A profile
that already required recording before a change of plan keeps working:
sessions run unrecorded, and the viewer shows **Policy requires session
recording, which is not included in this plan. This session is not being
recorded.** See [Record remote sessions](/remote-access/session-recording/).

### Merge rules {#merge-rules}

| Merge | Meaning |
| --- | --- |
| Common values | Only the values every applicable profile lists. `to_endpoint` in one profile and `to_technician` in another resolve to neither. |
| Common values, strictest | As above, but two lists with nothing in common resolve to the stricter one. |
| Smallest above 0 | The smallest positive value. A positive value always beats `0`, which means no limit. |
| Largest | The largest value. |
| Least revealing | The choice that records the least. |
| On wins, Off wins | Any applicable profile that sets the winning value decides it. |

### `remote_display.enabled` {#remote-display-enabled}

The component is installed only when a fresh check of the console finds no
usable physical display output. It stays while the endpoint is headless,
including across restarts, and is removed when a physical display returns or
the setting turns off. It never creates a Remote Desktop session and never
restarts the endpoint. A restart that Windows needs is reported instead. In
the screen list, a console on the recovery monitor is marked
**Recovery display**.

### `remote_logon.disable_cad_on_server_core` {#disable-cad}

On Windows Server Core only, the agent sets the Windows `DisableCAD` policy to
`1` and records the value it replaced. When the setting turns off, or the agent
is uninstalled, the agent restores the recorded value. A value of `1` that
something else set is left alone. A Group Policy that enforces `0` wins at its
next refresh.

## Framework floors {#floors}

Framework baselines clamp these settings. A profile can be stricter than a
floor, never weaker. A time limit set to `0` is clamped to the floor too.

| Setting | Floor | Frameworks |
| --- | --- | --- |
| `remote_access.allowed_modes` | `attended`, `consent`, `escorted` (no unattended) | CJIS, NIST 800-53, NIST 800-171, CMMC Level 2 |
| `remote_access.escort_quorum` | `2` | CJIS |
| `remote_access.tech_idle_pause_minutes` | `15` | PCI DSS |
| `remote_access.idle_resume_requires_reauth` | On | PCI DSS |
| `remote_access.clipboard_text`, `remote_access.clipboard_images` | Off | CJIS |
| `remote_access.clipboard_text`, `remote_access.clipboard_images` | `to_endpoint` | PCI DSS, ISO 27001 |
| `remote_access.file_transfer` | Off | CJIS |
| `remote_access.file_transfer` | `to_endpoint` | PCI DSS, ISO 27001, HIPAA, SOC 2, NIST 800-53, NIST 800-171, CMMC Level 2 |

The DISA STIG and Microsoft security baselines recommend `to_endpoint` for the
clipboard and file transfer settings without enforcing it. See
[Compliance framework baselines](/compliance/framework-baselines/).

## Related

- [Configure access modes and consent](/remote-access/access-modes/)
- [Clipboard and file transfer](/remote-access/clipboard-and-file-transfer/)
- [Record remote sessions](/remote-access/session-recording/)
- [Let Pioneer AI control a session](/remote-access/pioneer-control/)
- [Policy settings](/automation/policy-settings/)