---
title: "Start a remote desktop session"
description: "Connect to an endpoint's screen from the console, take control, use the viewer's controls, and end the session."
url: "https://support.outpostplatform.com/remote-access/start-a-session/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Connect in the endpoint header, on Remote > Overview, or on a list row opens the viewer. Choose a session, wait for consent or escorts, turn on Control. Toolbar: Endpoint information, Control, Send keys, Screens, zoom, clipboard, File transfers, Terminal, Statistics, Full screen, End. Signal bars, notices, endpoint CPU and memory, Viewer settings, reconnects, and session history."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows", "linux", "macos"]
  permission: "remote:initiate"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/remote-access/start-a-session.md"
license: "CC BY 4.0"
---

# Start a remote desktop session

This page takes you from an endpoint in the console to its screen under your
control, and back out. For how sessions work and why the access mode is not
yours to choose, see [Remote access](/remote-access/).

## Before you begin

- You need the `remote:initiate` permission and the permission for the
  endpoint's access mode, such as `remote:attended`. A **Consent required**
  session to the sign-in screen also needs `remote:unattended`. See
  [Permission for each mode](/remote-access/access-modes/#mode-permissions).
  Reading the session history afterwards needs `remote:read`.
- The endpoint must be online, and it must be able to capture its screen. On
  an endpoint that cannot, the **Remote** tab is unavailable and its tooltip
  gives the agent's reason.
- Allow pop-up windows from your Outpost address in your browser. The viewer
  opens in a window of its own.
- Know the access mode. If it is **Consent required**, someone has to be at the
  endpoint to select **Allow**. If it is **Escorted**, your escorts have to
  join before you can send input.
- Sessions are recorded only where a profile turns recording on, on
  Enterprise and MSP. Home Lab and Essentials do not record sessions. See
  [Record remote sessions](/remote-access/session-recording/).

## Connect

1. Open the endpoint, and select **Remote** > **Overview**.

   The status chip says whether you can connect: **Available**, **In session**
   when another session is running there, **Offline**, **Enrolling**, or
   **Retired**. **Access mode** shows the mode the session will open in, and
   the line under it says what the person at the endpoint will see.

   A **Metered connection** warning means the endpoint is on a connection that
   costs money per byte, such as a phone hotspot. A session streams video, so
   it uses the endpoint's data plan. You can still connect.

   To skip this tab, select **Connect** in the endpoint's page header, which
   is there on every tab, or the connect icon in the endpoint's row in
   **Endpoints** > **All endpoints**. Both open the viewer directly, so you
   continue at step 3. They appear only while the endpoint is connected.

2. Select **Connect**.

   The viewer opens in its own window. Selecting **Connect** again for the same
   endpoint brings that window to the front rather than opening a second
   session.

3. Choose what to connect to.

   When the endpoint has one console and it is free, the viewer connects to it
   without asking. Otherwise it lists what it found under **Select a Windows
   session** on Windows, or **Select a screen** on Linux and macOS:

   | Endpoint | What is listed |
   | --- | --- |
   | Windows | The console, as **Console · Session** and its number, and each Remote Desktop session, as **RDP · Session** and its number, with the user signed in to each. |
   | Linux | **Console** (or **Sign-in screen** when nobody is signed in) with its session type, such as **X11** or **Wayland**, and any other X display, as **X display** and its number. |
   | macOS | **Console**, or **Sign-in screen** at the login window. A user switched out by fast user switching is listed as **Switched-out session** and cannot be selected until they switch back. |

   An entry marked **Another operator is connected** is in use by another
   technician and cannot be selected. Select **Refresh sessions** to read the
   list again.

4. Wait for the session to start.

   Beside the endpoint's name, the status reads **Connecting...**, then
   **Negotiating...**, and disappears once the session is active. In a
   **Consent required** session it reads **Awaiting consent**, and the screen
   says **Waiting for** the user's name **to approve**. If the person selects
   **Deny**, or does not answer before the consent timeout, the status reads
   **Denied**. In an **Escorted** session it reads **Awaiting escort** until
   enough escorts are present.

5. Take control.

   Sessions start in view only, unless you set **Control on** in
   [Viewer settings](#viewer-settings). The status bar at the bottom of the
   window says **View only. Turn on Control to send mouse and keyboard input
   to this endpoint.** Select **Control** in the toolbar, then select the
   endpoint's screen to give it keyboard focus. Your choice holds through
   automatic reconnects in this window. The next session starts from your
   viewer settings again.

## Use the viewer

The toolbar runs along the top of the window, or the bottom if you choose so
in [Viewer settings](#viewer-settings). Its buttons are icons, and each one
shows its name when you point at it. The names below are those names.

| Control | What it does |
| --- | --- |
| Endpoint name and **Endpoint information** | The endpoint you are connected to and the session you chose. **Endpoint information** opens a window with the endpoint's details. See [Endpoint information](#endpoint-information). |
| **Control** | Whether your mouse and keyboard reach the endpoint. While it is off, the icon is struck through and nothing you do with the mouse or keyboard is sent. |
| **Send keys** | Sends a key combination your browser or your own computer would otherwise keep. See [Send keys your browser keeps](#special-keys). |
| **Screens** | Chooses which monitor to view, or all of them at once. It appears only when the endpoint has more than one. See [Multiple monitors](#multiple-monitors). |
| Zoom | The level between **Zoom out** and **Zoom in** opens a menu with **Fit to window** and fixed levels from 25% to 300%. **Fit to window** scales the endpoint's screen to the window and is the default. [Viewer settings](#viewer-settings) can start sessions at **Actual size** instead. When the picture is larger than the window, <kbd>Ctrl</kbd>+drag pans and <kbd>Ctrl</kbd>+wheel zooms. |
| Clipboard | A menu with **Sync clipboard**, which turns clipboard sync on and off for this window, and **Type clipboard**. The icon is struck through while sync is off. See [Clipboard and file transfer](/remote-access/clipboard-and-file-transfer/). |
| **File transfers** | Opens the **Transfers** panel, with a count of transfers in progress. See [Clipboard and file transfer](/remote-access/clipboard-and-file-transfer/). |
| **Terminal** | Opens a shell on the endpoint in a drawer inside the viewer. It appears only with the `command:execute` permission. See [Use the terminal in the remote viewer](/remote-access/terminal/). |
| **Statistics** | Opens the **Connection** panel. A count on the icon is the number of notices. See [Connection statistics](#statistics). |
| **Full screen** / **Exit full screen** | Fills your screen with the endpoint's. In full screen the toolbar always hides when inactive; move the pointer to its edge of the screen to reveal it. |
| **End** | Ends the session after you confirm. See [End the session](#end). After a session ends, **Reconnect** takes its place. |
| **Pioneer AI** | Opens a Pioneer AI drawer in the viewer, where Pioneer AI can control the session for a task you approve. If it cannot, a dialog says why. See [Let Pioneer AI control a session](/remote-access/pioneer-control/). |
| **Viewer settings** | Opens your viewer preferences. It sits beside the signal bars. See [Viewer settings](#viewer-settings). |
| Signal bars | Four bars for the health of the connection. Selecting them opens **Statistics**. See [Signal bars](#signal-bars). |

The clipboard and file transfer controls appear only when the endpoint's agent
supports them. If it does not, the status bar says **Update the agent to use
clipboard and file transfer.**

The status bar at the bottom of the window says what to do next, such as
turning on **Control**, and shows a live readout: frame rate, bandwidth, round
trip, resolution, and codec. When the endpoint reports its load, the readout
also shows **CPU** and **Mem**, updated every 5 seconds. Either one is
highlighted when every reading in the last 30 seconds was 90% or more. Load is
reported only where `monitoring.live_metrics_enabled` is on for the endpoint,
and turning off **Show endpoint CPU and memory in the status bar** in
[Viewer settings](#viewer-settings) hides it.
See [Live metrics policy](/endpoints/live-and-console/#live-metrics-policy).

In full screen in Chrome or Edge, the viewer asks the browser to pass reserved
keys such as <kbd>Esc</kbd>, <kbd>Tab</kbd>, and the function keys to the
endpoint. Other browsers keep those keys, so use **Send keys** for them. To
keep those keys on your own computer, turn off **Send system keys to the
endpoint in full screen** in [Viewer settings](#viewer-settings).

### Send keys your browser keeps {#special-keys}

Select **Send keys**, and choose a combination. It is sent as soon as you
choose it, whether or not **Control** is on, so you do not have to hand over
the mouse to send one key combination. The list depends on the endpoint:

| Endpoint | Combinations offered |
| --- | --- |
| Windows | **Ctrl + Alt + Del**, **Ctrl + Shift + Esc**, **Alt + Tab**, **Alt + F4**, **Windows key**, **Win + D**, **Win + E**, **Win + R**, **Win + L**, **Ctrl + Alt + Esc**, **Print Screen**, **Delete**, **Escape** |
| Linux | The Windows list without **Ctrl + Alt + Del**, with **Super** in place of **Win** |
| macOS | **Cmd + Tab**, **Cmd + Space**, **Cmd + Option + Esc**, **Ctrl + Cmd + Q**, **Cmd + Q**, **Cmd + W**, **Command key**, **Option key**, **Cmd + Shift + 3**, **Delete**, **Escape** |

**Ctrl + Alt + Del** opens the Windows security screen, which you need to sign
in at a locked endpoint. Windows accepts it from the agent only when the
`SoftwareSASGeneration` policy allows services to send it. The agent sets that
policy when it is not set, and leaves an existing value alone, including one
from Group Policy. Windows Server Core has no software
<kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>Del</kbd>; to sign in there, turn on
`remote_logon.disable_cad_on_server_core`. See
[Remote access policy settings](/remote-access/policy-settings/#remote-logon).

### Multiple monitors {#multiple-monitors}

When the endpoint has more than one monitor, **Screens** lists them as
**Screen 1**, **Screen 2**, and so on, with **(main)** beside the primary
monitor and each one's resolution. The button shows the number of the screen
you are viewing. Choose another, and the picture goes blank for a moment while
the endpoint switches.

**All screens** shows every monitor in one picture, arranged as they are on the
endpoint, and the button reads **All**. Your clicks land where you aim them on
any monitor. **All screens** is offered on Windows, macOS, and Linux X11
sessions. It is not offered on Wayland, where the endpoint does not reveal how
the monitors are arranged.

### Notices {#notices}

Anything the viewer needs to tell you appears as a notice under the toolbar,
such as **Connection failed**, **The last connection attempt failed**,
**Permissions needed**, **Software encoding** (a Linux endpoint without
ffmpeg, which uses a slower video encoder), or a message from the agent.

- Select **Details** to show the exact code and stage that failed, and
  **Copy** to put them on your clipboard for a support request.
- Select the dismiss button to clear a notice from the screen. A notice whose
  text changes comes back.

The **Statistics** panel keeps listing every current notice, including the
ones you dismissed.

### When you are idle {#idle}

After a while with no input from you, 5 minutes unless a profile sets another
time, the viewer shows an **Are you still there?** notice, and the status bar
says **This session will pause for inactivity soon. Turn on Control and move the mouse over the screen to keep it going.** Turn on **Control** and move the mouse over the screen, or choose a
combination in **Send keys**, which works with **Control** off. If you do
neither, the session pauses, 10 minutes after your last input unless a profile
sets another time. To resume a paused session, turn on **Control** and select
the screen. See
[Limit technician idle time](/remote-access/access-modes/#technician-idle).

Where the PCI DSS baseline or a profile requires it, a paused session waits
for you to confirm your identity. The warning adds that you will have to sign
in again, and the paused screen says how long you were idle, **Sign in again
to resume.**, and what requires it. Select **Resume**, and confirm your
identity with a passkey, your password, an authenticator code, or a recovery
code. See [Confirm it is you](/depot/account-security/#confirm-it-is-you). Until then, input does nothing. See
[Require a sign-in to resume](/remote-access/access-modes/#idle-reauth).

### Signal bars {#signal-bars}

The signal bars rate the round trip from the endpoint, through your Outpost,
to your browser, averaged over the last 60 seconds, so one slow reading does
not change them. Point at them to see the average in milliseconds.

| Bars | Rating | Average round trip |
| --- | --- | --- |
| 4 | Excellent | 80 ms or less |
| 3 | Good | 81 to 150 ms |
| 2 | Fair | 151 to 250 ms |
| 1 | Poor | More than 250 ms |
| 0 | No signal | No reading in the last 5 seconds |

All four bars are dimmed while the session is still measuring. The bars use
the round trip only. A still screen sends few frames, and that is not a sign
of a bad link. The first change after a still stretch, such as a menu
opening after a click, is sent and shown as soon as it is captured, without
waiting for later frames.

### Connection statistics {#statistics}

Select **Statistics** to open the **Connection** panel. It shows:

- Graphs of **Bandwidth** and **Round trip**.
- **Codec**, **Encoder**, **Decoder**, **Resolution**, and **Frame rate**.
- The round trip of each leg: **Endpoint to server** and **Server to
  browser**.
- **Packet loss**, **Jitter**, **Jitter buffer**, **Decode**, **Estimated
  downlink**, **Frames dropped**, **Freezes**, **Keyframes**, **NACK / PLI**,
  and **Received**.
- **Transport** (see [Direct and relayed connections](/remote-access/#direct-and-relayed)),
  **Mode**, **Duration**, **Authorized for** (the session's time limit and
  where it came from), and the **Session** ID.
- **Endpoint**: the endpoint's **CPU** and **Memory**, when it reports them.
- **Notices**: every current notice, each with **Details for support** and
  **Copy details** when it has details.

**Freezes** counts stalls while the endpoint's picture was changing. A screen
that is not changing is not counted as frozen.

### Endpoint information {#endpoint-information}

Select **Endpoint information** beside the endpoint's name to see its details
without leaving the session. The window has these tabs:

| Tab | Shows | Permission |
| --- | --- | --- |
| **Overview** | **Device details**, including the operating system, uptime, and agent version, with **Copy**, and **System health**: live CPU and memory meters with graphs of the last 5 minutes | `endpoint:read` |
| **Hardware** | **Memory**, **Storage** with how full each volume is, and **Graphics** | `endpoint:read` |
| **Network** | The network adapters | `endpoint:read` |
| **Software** | Installed software, with **Search installed software** | `software:read` |
| **Updates** | Pending updates | `patch:read` |

A tab your role does not allow is hidden, and the window says **Some details
are hidden by your role.** Without `endpoint:read`, **Endpoint information**
does not appear. The live meters show **Live** and update every 5 seconds,
under the same policy as the status bar's **CPU** and **Mem**.

### When the person at the endpoint signs in or out

On Windows and macOS, a session to the console follows it when someone signs
in, signs out, or switches user, without dropping your connection. While it
switches, the screen is hidden and reads **Switching sessions...**, with the
reason underneath, such as **Waiting for the console**.

Before any of the next user's screen is shown, your Outpost checks the policy
for that user again, and in a **Consent required** session asks that user for
consent again, even when the same person signs back in. A session to the
sign-in screen, with nobody signed in, does not ask for consent, because there
is nobody to ask.

A Remote Desktop session target waits up to 2 minutes for its user to
reconnect. If a different user takes that session, the viewer reports that the
selected RDP logon ended, and you choose a session again.

## Viewer settings {#viewer-settings}

Select **Viewer settings**, the gear beside the signal bars, to choose how the
viewer looks and behaves. Your settings are saved to your console account, so
they follow you to any browser and, on the MSP plan, to every client. Changes
apply and save as you make them. There is no save button. **Reset to
defaults** puts every setting back. The defaults match how the viewer behaves
when nothing is set.

Settings marked "next session" take effect the next time a session starts.
The rest apply at once.

| Section | Setting | Default | What it does |
| --- | --- | --- | --- |
| **Toolbar** | **Position**: **Top** or **Bottom** | **Top** | Where the toolbar sits. At the bottom, it sits above a terminal docked at the bottom, and its menus open upward. |
| **Toolbar** | **Hide when inactive** | Off | Hides the toolbar 3 seconds after the pointer leaves it, so the picture fills the window. Move the pointer to the toolbar's edge of the window, or press <kbd>Tab</kbd> into it, to bring it back. It never hides while one of its menus or panels is open. In full screen the toolbar always hides when inactive, whatever this setting says. |
| **Session start** | **Control**: **Control on** or **View only** | **View only** | Whether sessions start with your mouse and keyboard reaching the endpoint. Next session. |
| **Session start** | **Zoom**: **Fit to window** or **Actual size** | **Fit to window** | The zoom a session starts at. Next session. |
| **Session start** | **Screen**: **Main screen** or **All screens** | **Main screen** | The monitor a session starts on. Where **All screens** is not offered, the main screen opens. Next session. |
| **Session start** | **Sync the clipboard** | On | Whether clipboard sync starts on. The endpoint's remote access policy can still turn it off. Next session. |
| **Terminal** | **Dock**: **Bottom**, **Left**, or **Right** | **Bottom** | Where the terminal drawer opens. Applies when the drawer next opens. |
| **Terminal** | **Size (px)** | The dock's own size | The drawer's height at the bottom, or width at a side, kept within the window. Applies when the drawer next opens. |
| **Terminal** | **Open the terminal when a session starts** | Off | Opens the terminal drawer as each session starts. Next session. |
| **Terminal** | **Confirm before closing a terminal tab** | On | Asks before you close a tab whose shell is running, because the shell ends. **Don't ask again** in that dialog turns this off. |
| **Terminal** | **Terminal background**: **Default** or **Custom** | **Default** | **Default** is the PowerShell console blue for PowerShell tabs and a dark background for other shells. **Custom** applies the color you choose to every tab, with black or white text for contrast. **Reset to default** returns to **Default**. |
| **Display** | **Show the endpoint's cursor** | On | Draws the endpoint's own pointer over the picture, placed by its click point, so an I-beam or a hand lines up with where a click lands. |
| **Display** | **Show endpoint CPU and memory in the status bar** | On | The **CPU** and **Mem** readout. |
| **Display** | **Open statistics when a session starts** | Off | Opens the **Connection** panel as each session starts. Next session. |
| **Display** | **Dismiss information notices after 8 seconds** | Off | Clears information notices on their own. Warnings and errors stay until you dismiss them. |
| **Cursor** | **Style**: **Cross**, **Arrow**, **Ring**, **Dot**, or **None** | **Cross** | Your own pointer over the endpoint's screen while **Control** is on. **None** hides it, so the endpoint's cursor shows where you are. |
| **Cursor** | **Size**: **Small**, **Medium**, **Large**, or **Extra large** | **Medium** | The size of your pointer. |
| **Cursor** | **Color**: **White**, **Black**, **Yellow**, **Olive**, **Red**, **Magenta**, or **Green** | **White** | The color of your pointer. |
| **Cursor** | **Contrasting outline** | On | Outlines your pointer so it stays visible on any background. |
| **Keyboard** | **Send system keys to the endpoint in full screen** | On | Passes <kbd>Esc</kbd>, <kbd>Tab</kbd>, and the function keys to the endpoint in full screen, in Chrome and Edge. Applies the next time you enter full screen. |
| **Keyboard** | **Ask before ending a session** | On | Shows the confirmation when you select **End**. Off, **End** ends the session at once. |

The **Cursor** section has a preview. Point at it to try your choices before
you return to the session.

The **Terminal** settings have no effect without the `command:execute`
permission, and the window says so.

## End the session {#end}

1. Select **End**.
2. In **End the session with** the endpoint's name, select **End session**.
   **Cancel**, or <kbd>Esc</kbd>, keeps the session. If you turned off **Ask
   before ending a session** in [Viewer settings](#viewer-settings), the
   session ends without this step.

The session closes for you and for the person at the endpoint. If the terminal
is open, or has output, its shells end too, and the dialog says so. Closing the
viewer window also ends the session and the terminal.

A session also ends when:

- it reaches its time limit, which is 1 hour unless a profile sets another
  limit or no limit. The viewer shows **Session time is up**, with the length
  and the profile or default it came from. See
  [Limit session length](/remote-access/access-modes/#limit-session-length).
- you have sent no input for the technician idle time your policy sets. See
  [Configure access modes and consent](/remote-access/access-modes/#technician-idle).
- the endpoint goes offline, or an escort leaves an escorted session and
  nobody rejoins within 60 seconds.

When a session ends without you asking it to, for example after a network
drop, the viewer tries to reconnect up to five times and shows
**Reconnecting** with the attempt number. A denied or expired session is
not retried.
After the last attempt, select **Reconnect** to start a fresh session, which is
authorized again from policy.

## Verify {#verify}

Open the endpoint, and select **Remote** > **History**. **Remote access
history** lists every attempt on the endpoint with **Date / time**,
**Technician**, **Signed in as**, **Mode**, **Result**, **Length**, and
**Recording**. Your session shows **Completed** with its length. **Result** can
also read **In progress**, **Paused**, **Awaiting consent**,
**Awaiting escort**, **Denied**, **Error**, or **Never started**.

Each change of signed-in user during a session is its own row, so one
connection can appear as several rows.

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| Nothing opens when you select **Connect** | The browser blocked the pop-up window. | Allow pop-ups from your Outpost address, and select **Connect** again. |
| **Connect** is unavailable and **Access mode** reads **Off** | The profiles that apply to the endpoint allow no access mode. | See [Configure access modes and consent](/remote-access/access-modes/). |
| The session never starts | Usually the network between the endpoint, your Outpost, and your browser. | See [Troubleshoot remote access](/remote-access/troubleshooting/). |
| **Screens** has no **All screens** | The endpoint is a Wayland session, or its agent does not offer it. | View one screen at a time. |

## Next steps

- [Use the terminal in the remote viewer](/remote-access/terminal/)
- [Clipboard and file transfer](/remote-access/clipboard-and-file-transfer/)
- [Record remote sessions](/remote-access/session-recording/)
- [Troubleshoot remote access](/remote-access/troubleshooting/)