Troubleshoot remote access

This page covers remote desktop sessions that do not start, do not connect, show no picture, or end when you did not expect them to. The viewer shows the reason in a banner across the top of its window, usually starting with a code in brackets such as [RD_MEDIA_CONNECT_TIMEOUT]. Search this page for the code.

Symptom

You see one of these:

• The endpoint’s Remote tab is unavailable, or Connect is unavailable.

• The viewer stays on Connecting… or Negotiating…, or shows an error such as:

  [RD_MEDIA_CONNECT_TIMEOUT] Media negotiation did not complete. Check direct connectivity and TURN configuration.

• The session is Active but the screen is black.

• The session ends, pauses, or keeps reconnecting.

Check first

• Is the endpoint online? Remote > Overview shows Offline when it is not. Wake it or wait for it.
• What is the access mode? Access mode on the same page shows Off when policy allows no remote access.
• Did the viewer open? If nothing happened when you selected Connect, your browser blocked the pop-up. Allow pop-ups from your Outpost address.
• What does the viewer’s support detail say? After a failure, select Details on the notice under the viewer’s toolbar, or open Statistics and expand Details for support. It holds the exact code and the stage that failed.

Cause: the endpoint cannot capture its screen

The Remote tab is unavailable, and its tooltip gives the agent’s reason. The agent has found no way to capture the screen: a FreeBSD or OpenBSD endpoint, or a Linux server with no display.

Resolution

Use the remote console instead. See Live metrics and the remote console. On Linux, the tooltip names what is missing, such as a running X server or the framebuffer device.

Cause: policy does not allow a session

Access mode reads Off, or the viewer reports one of these:

remote access is turned off by policy
mode not permitted by policy

The profiles that apply to the endpoint, to the person signed in at it, or to you allow no access mode between them. An attempt refused for its mode shows Denied in the endpoint’s Remote > History.

Resolution

Open Profiles > Effective config for the endpoint, find remote_access.allowed_modes, and see which profile allows only none. See Configure access modes and consent.

Cause: consent was denied or could not be asked

In a Consent required session, the status reads Denied when the person selected Deny or did not answer before the consent timeout. The viewer does not retry a denied session, so the person is not asked over and over.

The session also fails when nobody can be asked:

[RD_CONSENT_UNAVAILABLE] Tray is disabled or not registered by endpoint policy
[RD_CONSENT_UNAVAILABLE] The tray cannot run here: the Microsoft Edge WebView2 Runtime is not installed
[RD_CONSENT_NO_USER] Nobody is signed in at this endpoint to approve the session

Resolution

Ask the person to watch for the prompt and connect again. Where the tray app is turned off or cannot run, turn it on or install the WebView2 Runtime, or allow a mode that needs no prompt for those endpoints.

Cause: the network blocks a direct connection

The viewer reports one of these:

[RD_MEDIA_CONNECT_TIMEOUT] Media negotiation did not complete. Check direct connectivity and TURN configuration.
[RD_AGENT_MEDIA_FAILED]
[RD_BROWSER_MEDIA_FAILED]

A session needs a network path from the endpoint to your Outpost, and from your browser to your Outpost. A direct path uses UDP. Firewalls that block outbound UDP, strict NAT, and some guest, hotel, and corporate networks stop it. RD_AGENT_MEDIA_FAILED is the endpoint’s leg, and RD_BROWSER_MEDIA_FAILED is yours.

How to confirm it

Try from a different network on the side that failed, such as a phone hotspot for your own computer. If the session connects there, the original network is blocking it.

Resolution

• On Enterprise and MSP, a blocked direct path falls back to a relayed connection. Check Statistics > Transport on a session that does connect from the same place: Relayed confirms the relay is in use.
• On Home Lab and Essentials, sessions use direct connections only. Allow outbound UDP from the endpoint’s or your network, or move to a plan with relayed connections. See Direct and relayed connections.

Cause: relayed connections are not on your plan

The viewer reports:

Relayed remote desktop is not included in your plan.

Your Outpost is set to connect remote sessions only through a relay, and your plan does not include relayed connections. Relayed remote desktop is included in Enterprise and MSP.

Resolution

Change to Enterprise or MSP. See Upgrade or change your plan and Plans and limits.

Cause: the endpoint does not answer

The viewer reports one of these:

endpoint is not connected
[RD_SIGNAL_TIMEOUT] Depot did not initialize the session within 30 seconds.
[RD_AGENT_OFFER_TIMEOUT] The endpoint did not offer media before the connection deadline.
[RD_HELPER_UNAVAILABLE]

The endpoint dropped offline, your browser could not reach your Outpost, or the agent’s desktop helper did not start in the chosen session.

Resolution

Check that the endpoint is online, select Reconnect, and choose the session again. If RD_HELPER_UNAVAILABLE repeats on Windows, collect the details in Still stuck.

Cause: the screen is black or never appears

The session connects, but the picture stays black, or the viewer reports one of these:

[RD_AGENT_FIRST_FRAME_TIMEOUT] Media connected but the endpoint sent no video. Check the Windows display/capture and encoder logs.
[RD_AGENT_DISPLAY_NO_FRAMES] The endpoint display produced no image after it was woken.
[RD_NO_DISPLAY] No usable desktop display

The agent wakes a sleeping display before it captures. These messages mean it found nothing to capture: a server with no monitor and no display adapter output, a monitor that was unplugged, or a virtual machine with no display device.

Resolution

• Give the endpoint a display output: connect a monitor or a display emulator plug, or add a display adapter to the virtual machine.
• On a headless Windows server, remote_display.enabled lets the Outpost Recovery Display component keep a virtual console monitor, once the component’s Windows driver package is available for your endpoints. See Remote access policy settings.
• On Windows Server Core, the agent builds the picture from the open windows, at a lower frame rate. That is expected.

[RD_BROWSER_FIRST_FRAME_TIMEOUT] instead means video reached your browser but it could not decode a frame. Check that your browser supports the video codec shown in Statistics, or try another browser.

Cause: the picture disappears at sign-in or sign-out

The screen hides and reads Switching sessions… when someone signs in, signs out, or switches user at the endpoint. That is expected: the session is following the console, and it checks policy and, in a Consent required session, asks the next user for consent before showing their desktop. The overlay’s second line says what it is waiting for, such as Waiting for the console.

It becomes a failure when the wait runs out:

[RD_SESSION_RECONNECT_TIMEOUT] The user session did not return within 2 minutes
[RD_TARGET_CHANGED] The pinned session ended

Resolution

Select Reconnect, and choose the session again from the list. A Remote Desktop session that a different user took over cannot be followed, and has to be chosen again.

Cause: Ctrl+Alt+Del does nothing

Selecting Ctrl + Alt + Del and Send has no effect on a Windows endpoint, or the viewer reports:

[RD_SAS_UNAVAILABLE] Ctrl+Alt+Del is not available on this endpoint (Windows Server Core has no software Ctrl+Alt+Del)

Windows accepts the combination from the agent only when the SoftwareSASGeneration policy allows services to send it. The agent sets it when it is not set, but leaves an existing value alone, so a Group Policy that sets it to 0 blocks it. Server Core has no way to send it at all.

Resolution

• Change the Group Policy that sets SoftwareSASGeneration so that it allows services.
• On Server Core, turn on remote_logon.disable_cad_on_server_core for the endpoint, so its sign-in screen does not ask for Ctrl+Alt+Del. See Remote access policy settings.

Cause: a macOS privacy permission is missing

On a Mac, the session does not open and the viewer reports:

[RD_PERMISSION_REQUIRED] Screen Recording permission is not granted to Outpost on this Mac

or the session opens view only, with:

[RD_PERMISSION_REQUIRED] Accessibility permission is not granted to Outpost on this Mac

macOS protects the screen and input with privacy permissions. Screen Recording can be granted only by someone at the Mac. macOS support is a preview.

Resolution

The viewer says what to do: someone at the Mac must open System Settings, Privacy and Security, then Screen Recording (Screen and System Audio Recording on newer macOS) or Accessibility, and turn on outpost-agent. Then select Reconnect. The viewer does not retry on its own while a permission is missing. See macOS agent.

Cause: Linux session limits

On Linux, what works depends on the session:

What you see	Cause	Resolution
Clipboard sync is not available for this session type	The session is Wayland, a text console, or the sign-in screen. Clipboard sync works on X11 sessions only.	Use Type clipboard for text, and file transfer for files.
The picture shows but input does nothing, or the tooltip mentions /dev/uinput	Wayland sessions, the sign-in screen, and text consoles take input through the kernel’s uinput device, which is missing or cannot be opened.	Load the uinput kernel module on the endpoint.
[RD_CAPTURE_UNSUPPORTED]	No capture method works for that session. The message gives the reason.	Fix what the message names, or use the remote console.
Install ffmpeg on this endpoint for faster H.264 video	The agent is encoding with its slower software encoder.	Install ffmpeg on the endpoint.

Cause: the session paused or ended for inactivity

Before the pause, the viewer shows an Are you still there? notice. The status reads Paused, the viewer says Paused for inactivity. Turn on Control and click the screen to resume. or Paused for inactivity. Sign in again to resume., or the session ends after a period with no input.

Your policy steps an idle session through a warning, a pause, and an end. With no profile setting them, those come at 5, 10, and 30 minutes. A session you are watching with Control off sends no input, so it counts as idle.

Resolution

At the Are you still there? notice, turn on Control and move the mouse over the screen, or use Send keys, to keep the session going. To resume a paused session, turn on Control and select the screen. If the viewer asks you to sign in again, select Resume and confirm your identity. That happens where the PCI DSS baseline or a profile requires it. If your account signs in only with a code sent by email, it cannot confirm this way: start a new session. See Confirm it is you. To change the limits, see Configure access modes and consent.

Cause: the session reached its time limit

The viewer shows Session time is up, and the reason reads like this:

[RD_SESSION_EXPIRED] Authorized session duration of 1 hour elapsed (Maximum session length in the profile "Workstations")

Every session has a time limit, which is 1 hour unless remote_access.session_max_seconds (Maximum session length) sets another. The message names the length and where it came from: a profile, the profile that decides among several, the default, or the time left on the session’s original authorization. Authorized for in the viewer’s Statistics panel shows the same while the session runs.

Resolution

Select Reconnect to start a fresh session. An expired session does not reconnect on its own. To change the limit, edit the profile the message names. See Limit session length.

Cause: the Outpost server restarted

The viewer shows The session ended. Reconnect to start a new one., and Remote > History gives this reason for the session:

[RD_DEPOT_RESTARTED] The Outpost server restarted, so this session ended.

A session cannot outlive the Outpost server that relays it. After a restart, Outpost closes the session’s record and tells the endpoint to stop capturing, so the endpoint is free again within seconds of reconnecting.

Resolution

Select Reconnect. If the session list still shows Another operator is connected in the first minute after a restart, select Refresh sessions and try again.

Cause: another technician is connected

The session is grayed out in the list with Another operator is connected, or the viewer reports:

[RD_SESSION_BUSY] Another operator is supporting this session

Only one technician at a time can connect to the same session on an endpoint. Remote > Overview shows In session while one is running.

Resolution

Check Remote > History for who is connected, and coordinate with them, or choose another session on the endpoint.

Still stuck

Collect these before you ask for help:

• The endpoint’s operating system and agent version, from the endpoint’s Overview.
• The exact message from the viewer, and its details, copied with Copy on the notice.
• The Session ID from the viewer’s Statistics panel, and the time.
• Whether the session connects from another network.

Do not send screenshots of tokens, passwords, or browser developer tools network captures. Then see Get help.