Start a remote desktop session

This page takes you from an endpoint in the console to its screen under your control, and back out. For how sessions work and why the access mode is not yours to choose, see Remote access.

Before you begin

• You need the remote:initiate permission and the permission for the endpoint’s access mode, such as remote:attended. A Consent required session to the sign-in screen also needs remote:unattended. See Permission for each mode. Reading the session history afterwards needs remote:read.
• The endpoint must be online, and it must be able to capture its screen. On an endpoint that cannot, the Remote tab is unavailable and its tooltip gives the agent’s reason.
• Allow pop-up windows from your Outpost address in your browser. The viewer opens in a window of its own.
• Know the access mode. If it is Consent required, someone has to be at the endpoint to select Allow. If it is Escorted, your escorts have to join before you can send input.
• Sessions are recorded only where a profile turns recording on, on Enterprise and MSP. Home Lab and Essentials do not record sessions. See Record remote sessions.

Connect

1. Open the endpoint, and select Remote > Overview.

   The status chip says whether you can connect: Available, In session when another session is running there, Offline, Enrolling, or Retired. Access mode shows the mode the session will open in, and the line under it says what the person at the endpoint will see.

   A Metered connection warning means the endpoint is on a connection that costs money per byte, such as a phone hotspot. A session streams video, so it uses the endpoint’s data plan. You can still connect.

   To skip this tab, select Connect in the endpoint’s page header, which is there on every tab, or the connect icon in the endpoint’s row in Endpoints > All endpoints. Both open the viewer directly, so you continue at step 3. They appear only while the endpoint is connected.

2. Select Connect.

   The viewer opens in its own window. Selecting Connect again for the same endpoint brings that window to the front rather than opening a second session.

3. Choose what to connect to.

   When the endpoint has one console and it is free, the viewer connects to it without asking. Otherwise it lists what it found under Select a Windows session on Windows, or Select a screen on Linux and macOS:

   Endpoint	What is listed
   Windows	The console, as Console · Session and its number, and each Remote Desktop session, as RDP · Session and its number, with the user signed in to each.
   Linux	Console (or Sign-in screen when nobody is signed in) with its session type, such as X11 or Wayland, and any other X display, as X display and its number.
   macOS	Console, or Sign-in screen at the login window. A user switched out by fast user switching is listed as Switched-out session and cannot be selected until they switch back.

   An entry marked Another operator is connected is in use by another technician and cannot be selected. Select Refresh sessions to read the list again.

4. Wait for the session to start.

   Beside the endpoint’s name, the status reads Connecting…, then Negotiating…, and disappears once the session is active. In a Consent required session it reads Awaiting consent, and the screen says Waiting for the user’s name to approve. If the person selects Deny, or does not answer before the consent timeout, the status reads Denied. In an Escorted session it reads Awaiting escort until enough escorts are present.

5. Take control.

   Sessions start in view only, unless you set Control on in Viewer settings. The status bar at the bottom of the window says View only. Turn on Control to send mouse and keyboard input to this endpoint. Select Control in the toolbar, then select the endpoint’s screen to give it keyboard focus. Your choice holds through automatic reconnects in this window. The next session starts from your viewer settings again.

Use the viewer

The toolbar runs along the top of the window, or the bottom if you choose so in Viewer settings. Its buttons are icons, and each one shows its name when you point at it. The names below are those names.

Control	What it does
Endpoint name and Endpoint information	The endpoint you are connected to and the session you chose. Endpoint information opens a window with the endpoint’s details. See Endpoint information.
Control	Whether your mouse and keyboard reach the endpoint. While it is off, the icon is struck through and nothing you do with the mouse or keyboard is sent.
Send keys	Sends a key combination your browser or your own computer would otherwise keep. See Send keys your browser keeps.
Screens	Chooses which monitor to view, or all of them at once. It appears only when the endpoint has more than one. See Multiple monitors.
Zoom	The level between Zoom out and Zoom in opens a menu with Fit to window and fixed levels from 25% to 300%. Fit to window scales the endpoint’s screen to the window and is the default. Viewer settings can start sessions at Actual size instead. When the picture is larger than the window, Ctrl+drag pans and Ctrl+wheel zooms.
Clipboard	A menu with Sync clipboard, which turns clipboard sync on and off for this window, and Type clipboard. The icon is struck through while sync is off. See Clipboard and file transfer.
File transfers	Opens the Transfers panel, with a count of transfers in progress. See Clipboard and file transfer.
Terminal	Opens a shell on the endpoint in a drawer inside the viewer. It appears only with the command:execute permission. See Use the terminal in the remote viewer.
Statistics	Opens the Connection panel. A count on the icon is the number of notices. See Connection statistics.
Full screen / Exit full screen	Fills your screen with the endpoint’s. In full screen the toolbar always hides when inactive; move the pointer to its edge of the screen to reveal it.
End	Ends the session after you confirm. See End the session. After a session ends, Reconnect takes its place.
Pioneer AI	Opens a Pioneer AI drawer in the viewer, where Pioneer AI can control the session for a task you approve. If it cannot, a dialog says why. See Let Pioneer AI control a session.
Viewer settings	Opens your viewer preferences. It sits beside the signal bars. See Viewer settings.
Signal bars	Four bars for the health of the connection. Selecting them opens Statistics. See Signal bars.

The clipboard and file transfer controls appear only when the endpoint’s agent supports them. If it does not, the status bar says Update the agent to use clipboard and file transfer.

The status bar at the bottom of the window says what to do next, such as turning on Control, and shows a live readout: frame rate, bandwidth, round trip, resolution, and codec. When the endpoint reports its load, the readout also shows CPU and Mem, updated every 5 seconds. Either one is highlighted when every reading in the last 30 seconds was 90% or more. Load is reported only where monitoring.live_metrics_enabled is on for the endpoint, and turning off Show endpoint CPU and memory in the status bar in Viewer settings hides it. See Live metrics policy.

In full screen in Chrome or Edge, the viewer asks the browser to pass reserved keys such as Esc, Tab, and the function keys to the endpoint. Other browsers keep those keys, so use Send keys for them. To keep those keys on your own computer, turn off Send system keys to the endpoint in full screen in Viewer settings.

Send keys your browser keeps

Select Send keys, and choose a combination. It is sent as soon as you choose it, whether or not Control is on, so you do not have to hand over the mouse to send one key combination. The list depends on the endpoint:

Endpoint	Combinations offered
Windows	Ctrl + Alt + Del, Ctrl + Shift + Esc, Alt + Tab, Alt + F4, Windows key, Win + D, Win + E, Win + R, Win + L, Ctrl + Alt + Esc, Print Screen, Delete, Escape
Linux	The Windows list without Ctrl + Alt + Del, with Super in place of Win
macOS	Cmd + Tab, Cmd + Space, Cmd + Option + Esc, Ctrl + Cmd + Q, Cmd + Q, Cmd + W, Command key, Option key, Cmd + Shift + 3, Delete, Escape

Ctrl + Alt + Del opens the Windows security screen, which you need to sign in at a locked endpoint. Windows accepts it from the agent only when the SoftwareSASGeneration policy allows services to send it. The agent sets that policy when it is not set, and leaves an existing value alone, including one from Group Policy. Windows Server Core has no software Ctrl+Alt+Del; to sign in there, turn on remote_logon.disable_cad_on_server_core. See Remote access policy settings.

Multiple monitors

When the endpoint has more than one monitor, Screens lists them as Screen 1, Screen 2, and so on, with (main) beside the primary monitor and each one’s resolution. The button shows the number of the screen you are viewing. Choose another, and the picture goes blank for a moment while the endpoint switches.

All screens shows every monitor in one picture, arranged as they are on the endpoint, and the button reads All. Your clicks land where you aim them on any monitor. All screens is offered on Windows, macOS, and Linux X11 sessions. It is not offered on Wayland, where the endpoint does not reveal how the monitors are arranged.

Notices

Anything the viewer needs to tell you appears as a notice under the toolbar, such as Connection failed, The last connection attempt failed, Permissions needed, Software encoding (a Linux endpoint without ffmpeg, which uses a slower video encoder), or a message from the agent.

• Select Details to show the exact code and stage that failed, and Copy to put them on your clipboard for a support request.
• Select the dismiss button to clear a notice from the screen. A notice whose text changes comes back.

The Statistics panel keeps listing every current notice, including the ones you dismissed.

When you are idle

After a while with no input from you, 5 minutes unless a profile sets another time, the viewer shows an Are you still there? notice, and the status bar says This session will pause for inactivity soon. Turn on Control and move the mouse over the screen to keep it going. Turn on Control and move the mouse over the screen, or choose a combination in Send keys, which works with Control off. If you do neither, the session pauses, 10 minutes after your last input unless a profile sets another time. To resume a paused session, turn on Control and select the screen. See Limit technician idle time.

Where the PCI DSS baseline or a profile requires it, a paused session waits for you to confirm your identity. The warning adds that you will have to sign in again, and the paused screen says how long you were idle, Sign in again to resume., and what requires it. Select Resume, and confirm your identity with a passkey, your password, an authenticator code, or a recovery code. See Confirm it is you. Until then, input does nothing. See Require a sign-in to resume.

Signal bars

The signal bars rate the round trip from the endpoint, through your Outpost, to your browser, averaged over the last 60 seconds, so one slow reading does not change them. Point at them to see the average in milliseconds.

Bars	Rating	Average round trip
4	Excellent	80 ms or less
3	Good	81 to 150 ms
2	Fair	151 to 250 ms
1	Poor	More than 250 ms
0	No signal	No reading in the last 5 seconds

All four bars are dimmed while the session is still measuring. The bars use the round trip only. A still screen sends few frames, and that is not a sign of a bad link. The first change after a still stretch, such as a menu opening after a click, is sent and shown as soon as it is captured, without waiting for later frames.

Connection statistics

Select Statistics to open the Connection panel. It shows:

• Graphs of Bandwidth and Round trip.
• Codec, Encoder, Decoder, Resolution, and Frame rate.
• The round trip of each leg: Endpoint to server and Server to browser.
• Packet loss, Jitter, Jitter buffer, Decode, Estimated downlink, Frames dropped, Freezes, Keyframes, NACK / PLI, and Received.
• Transport (see Direct and relayed connections), Mode, Duration, Authorized for (the session’s time limit and where it came from), and the Session ID.
• Endpoint: the endpoint’s CPU and Memory, when it reports them.
• Notices: every current notice, each with Details for support and Copy details when it has details.

Freezes counts stalls while the endpoint’s picture was changing. A screen that is not changing is not counted as frozen.

Endpoint information

Select Endpoint information beside the endpoint’s name to see its details without leaving the session. The window has these tabs:

Tab	Shows	Permission
Overview	Device details, including the operating system, uptime, and agent version, with Copy, and System health: live CPU and memory meters with graphs of the last 5 minutes	endpoint:read
Hardware	Memory, Storage with how full each volume is, and Graphics	endpoint:read
Network	The network adapters	endpoint:read
Software	Installed software, with Search installed software	software:read
Updates	Pending updates	patch:read

A tab your role does not allow is hidden, and the window says Some details are hidden by your role. Without endpoint:read, Endpoint information does not appear. The live meters show Live and update every 5 seconds, under the same policy as the status bar’s CPU and Mem.

When the person at the endpoint signs in or out

On Windows and macOS, a session to the console follows it when someone signs in, signs out, or switches user, without dropping your connection. While it switches, the screen is hidden and reads Switching sessions…, with the reason underneath, such as Waiting for the console.

Before any of the next user’s screen is shown, your Outpost checks the policy for that user again, and in a Consent required session asks that user for consent again, even when the same person signs back in. A session to the sign-in screen, with nobody signed in, does not ask for consent, because there is nobody to ask.

A Remote Desktop session target waits up to 2 minutes for its user to reconnect. If a different user takes that session, the viewer reports that the selected RDP logon ended, and you choose a session again.

Viewer settings

Select Viewer settings, the gear beside the signal bars, to choose how the viewer looks and behaves. Your settings are saved to your console account, so they follow you to any browser and, on the MSP plan, to every client. Changes apply and save as you make them. There is no save button. Reset to defaults puts every setting back. The defaults match how the viewer behaves when nothing is set.

Settings marked “next session” take effect the next time a session starts. The rest apply at once.

Section	Setting	Default	What it does
Toolbar	Position: Top or Bottom	Top	Where the toolbar sits. At the bottom, it sits above a terminal docked at the bottom, and its menus open upward.
Toolbar	Hide when inactive	Off	Hides the toolbar 3 seconds after the pointer leaves it, so the picture fills the window. Move the pointer to the toolbar’s edge of the window, or press Tab into it, to bring it back. It never hides while one of its menus or panels is open. In full screen the toolbar always hides when inactive, whatever this setting says.
Session start	Control: Control on or View only	View only	Whether sessions start with your mouse and keyboard reaching the endpoint. Next session.
Session start	Zoom: Fit to window or Actual size	Fit to window	The zoom a session starts at. Next session.
Session start	Screen: Main screen or All screens	Main screen	The monitor a session starts on. Where All screens is not offered, the main screen opens. Next session.
Session start	Sync the clipboard	On	Whether clipboard sync starts on. The endpoint’s remote access policy can still turn it off. Next session.
Terminal	Dock: Bottom, Left, or Right	Bottom	Where the terminal drawer opens. Applies when the drawer next opens.
Terminal	Size (px)	The dock’s own size	The drawer’s height at the bottom, or width at a side, kept within the window. Applies when the drawer next opens.
Terminal	Open the terminal when a session starts	Off	Opens the terminal drawer as each session starts. Next session.
Terminal	Confirm before closing a terminal tab	On	Asks before you close a tab whose shell is running, because the shell ends. Don’t ask again in that dialog turns this off.
Terminal	Terminal background: Default or Custom	Default	Default is the PowerShell console blue for PowerShell tabs and a dark background for other shells. Custom applies the color you choose to every tab, with black or white text for contrast. Reset to default returns to Default.
Display	Show the endpoint’s cursor	On	Draws the endpoint’s own pointer over the picture, placed by its click point, so an I-beam or a hand lines up with where a click lands.
Display	Show endpoint CPU and memory in the status bar	On	The CPU and Mem readout.
Display	Open statistics when a session starts	Off	Opens the Connection panel as each session starts. Next session.
Display	Dismiss information notices after 8 seconds	Off	Clears information notices on their own. Warnings and errors stay until you dismiss them.
Cursor	Style: Cross, Arrow, Ring, Dot, or None	Cross	Your own pointer over the endpoint’s screen while Control is on. None hides it, so the endpoint’s cursor shows where you are.
Cursor	Size: Small, Medium, Large, or Extra large	Medium	The size of your pointer.
Cursor	Color: White, Black, Yellow, Olive, Red, Magenta, or Green	White	The color of your pointer.
Cursor	Contrasting outline	On	Outlines your pointer so it stays visible on any background.
Keyboard	Send system keys to the endpoint in full screen	On	Passes Esc, Tab, and the function keys to the endpoint in full screen, in Chrome and Edge. Applies the next time you enter full screen.
Keyboard	Ask before ending a session	On	Shows the confirmation when you select End. Off, End ends the session at once.

The Cursor section has a preview. Point at it to try your choices before you return to the session.

The Terminal settings have no effect without the command:execute permission, and the window says so.

End the session

1. Select End.
2. In End the session with the endpoint’s name, select End session. Cancel, or Esc, keeps the session. If you turned off Ask before ending a session in Viewer settings, the session ends without this step.

The session closes for you and for the person at the endpoint. If the terminal is open, or has output, its shells end too, and the dialog says so. Closing the viewer window also ends the session and the terminal.

A session also ends when:

• it reaches its time limit, which is 1 hour unless a profile sets another limit or no limit. The viewer shows Session time is up, with the length and the profile or default it came from. See Limit session length.
• you have sent no input for the technician idle time your policy sets. See Configure access modes and consent.
• the endpoint goes offline, or an escort leaves an escorted session and nobody rejoins within 60 seconds.

When a session ends without you asking it to, for example after a network drop, the viewer tries to reconnect up to five times and shows Reconnecting with the attempt number. A denied or expired session is not retried. After the last attempt, select Reconnect to start a fresh session, which is authorized again from policy.

Verify

Open the endpoint, and select Remote > History. Remote access history lists every attempt on the endpoint with Date / time, Technician, Signed in as, Mode, Result, Length, and Recording. Your session shows Completed with its length. Result can also read In progress, Paused, Awaiting consent, Awaiting escort, Denied, Error, or Never started.

Each change of signed-in user during a session is its own row, so one connection can appear as several rows.

If something goes wrong

Symptom	Cause	Fix
Nothing opens when you select Connect	The browser blocked the pop-up window.	Allow pop-ups from your Outpost address, and select Connect again.
Connect is unavailable and Access mode reads Off	The profiles that apply to the endpoint allow no access mode.	See Configure access modes and consent.
The session never starts	Usually the network between the endpoint, your Outpost, and your browser.	See Troubleshoot remote access.
Screens has no All screens	The endpoint is a Wayland session, or its agent does not offer it.	View one screen at a time.

Next steps

• Use the terminal in the remote viewer
• Clipboard and file transfer
• Record remote sessions
• Troubleshoot remote access