---
title: "Troubleshoot remote access"
description: "Fix remote desktop sessions that will not start, will not connect, show a black screen, lose the picture at sign-in, or end unexpectedly."
url: "https://support.outpostplatform.com/remote-access/troubleshooting/"
product: "depot"
type: "troubleshooting"
status: "draft"
ai_summary: "Troubleshooting remote desktop: Remote tab unavailable, access mode Off, consent denied or unavailable, connection timeouts and direct versus relayed connections, the relayed-not-in-plan message, black screen on headless servers, switching at sign-in, Ctrl+Alt+Del, macOS RD_PERMISSION_REQUIRED, Linux Wayland and uinput limits, idle pauses, and the 1-hour limit."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/remote-access/troubleshooting.md"
license: "CC BY 4.0"
---

# Troubleshoot remote access

This page covers remote desktop sessions that do not start, do not connect,
show no picture, or end when you did not expect them to. The viewer shows the
reason in a banner across the top of its window, usually starting with a code
in brackets such as `[RD_MEDIA_CONNECT_TIMEOUT]`. Search this page for the
code.

## Symptom

You see one of these:

- The endpoint's **Remote** tab is unavailable, or **Connect** is unavailable.
- The viewer stays on **Connecting...** or **Negotiating...**, or shows an
  error such as:

  ```text
  [RD_MEDIA_CONNECT_TIMEOUT] Media negotiation did not complete. Check direct connectivity and TURN configuration.
  ```

- The session is **Active** but the screen is black.
- The session ends, pauses, or keeps reconnecting.

## Check first

- **Is the endpoint online?** **Remote** > **Overview** shows **Offline** when
  it is not. Wake it or wait for it.
- **What is the access mode?** **Access mode** on the same page shows **Off**
  when policy allows no remote access.
- **Did the viewer open?** If nothing happened when you selected **Connect**,
  your browser blocked the pop-up. Allow pop-ups from your Outpost address.
- **What does the viewer's support detail say?** After a failure, select
  **Details** on the notice under the viewer's toolbar, or open
  **Statistics** and expand **Details for support**. It holds the exact code
  and the stage that failed.

## Cause: the endpoint cannot capture its screen {#cause-no-capture}

The **Remote** tab is unavailable, and its tooltip gives the agent's reason.
The agent has found no way to capture the screen: a FreeBSD or OpenBSD
endpoint, or a Linux server with no display.

### Resolution

Use the remote console instead. See
[Live metrics and the remote console](/endpoints/live-and-console/). On Linux,
the tooltip names what is missing, such as a running X server or the
framebuffer device.

## Cause: policy does not allow a session {#cause-policy}

**Access mode** reads **Off**, or the viewer reports one of these:

```text
remote access is turned off by policy
mode not permitted by policy
```

The profiles that apply to the endpoint, to the person signed in at it, or to
you allow no access mode between them. An attempt refused for its mode shows
**Denied** in the endpoint's **Remote** > **History**.

### Resolution

Open **Profiles** > **Effective config** for the endpoint, find
`remote_access.allowed_modes`, and see which profile allows only `none`. See
[Configure access modes and consent](/remote-access/access-modes/).

## Cause: consent was denied or could not be asked {#cause-consent}

In a **Consent required** session, the status reads **Denied** when the person
selected **Deny** or did not answer before the consent timeout. The viewer does
not retry a denied session, so the person is not asked over and over.

The session also fails when nobody can be asked:

```text
[RD_CONSENT_UNAVAILABLE] Tray is disabled or not registered by endpoint policy
[RD_CONSENT_UNAVAILABLE] The tray cannot run here: the Microsoft Edge WebView2 Runtime is not installed
[RD_CONSENT_NO_USER] Nobody is signed in at this endpoint to approve the session
```

### Resolution

Ask the person to watch for the prompt and connect again. Where the tray app is
turned off or cannot run, turn it on or install the WebView2 Runtime, or allow
a mode that needs no prompt for those endpoints.

## Cause: the network blocks a direct connection {#cause-network}

The viewer reports one of these:

```text
[RD_MEDIA_CONNECT_TIMEOUT] Media negotiation did not complete. Check direct connectivity and TURN configuration.
[RD_AGENT_MEDIA_FAILED]
[RD_BROWSER_MEDIA_FAILED]
```

A session needs a network path from the endpoint to your Outpost, and from
your browser to your Outpost. A direct path uses UDP. Firewalls that block
outbound UDP, strict NAT, and some guest, hotel, and corporate networks stop
it. `RD_AGENT_MEDIA_FAILED` is the endpoint's leg, and
`RD_BROWSER_MEDIA_FAILED` is yours.

### How to confirm it

Try from a different network on the side that failed, such as a phone hotspot
for your own computer. If the session connects there, the original network is
blocking it.

### Resolution

- On Enterprise and MSP, a blocked direct path falls back to a relayed
  connection. Check **Statistics** > **Transport** on a session that does connect
  from the same place: **Relayed** confirms the relay is in use.
- On Home Lab and Essentials, sessions use direct connections only. Allow
  outbound UDP from the endpoint's or your network, or move to a plan with
  relayed connections. See
  [Direct and relayed connections](/remote-access/#direct-and-relayed).

## Cause: relayed connections are not on your plan {#cause-relay-plan}

The viewer reports:

```text
Relayed remote desktop is not included in your plan.
```

Your Outpost is set to connect remote sessions only through a relay, and your
plan does not include relayed connections. Relayed remote desktop is included
in Enterprise and MSP.

### Resolution

Change to Enterprise or MSP. See [Upgrade or change your plan](/account/change-plan/) and
[Plans and limits](/account/plans-and-limits/).

## Cause: the endpoint does not answer {#cause-endpoint}

The viewer reports one of these:

```text
endpoint is not connected
[RD_SIGNAL_TIMEOUT] Depot did not initialize the session within 30 seconds.
[RD_AGENT_OFFER_TIMEOUT] The endpoint did not offer media before the connection deadline.
[RD_HELPER_UNAVAILABLE]
```

The endpoint dropped offline, your browser could not reach your Outpost, or
the agent's desktop helper did not start in the chosen session.

### Resolution

Check that the endpoint is online, select **Reconnect**, and choose the session
again. If `RD_HELPER_UNAVAILABLE` repeats on Windows, collect the details in
[Still stuck](#still-stuck).

## Cause: the screen is black or never appears {#cause-black-screen}

The session connects, but the picture stays black, or the viewer reports one of
these:

```text
[RD_AGENT_FIRST_FRAME_TIMEOUT] Media connected but the endpoint sent no video. Check the Windows display/capture and encoder logs.
[RD_AGENT_DISPLAY_NO_FRAMES] The endpoint display produced no image after it was woken.
[RD_NO_DISPLAY] No usable desktop display
```

The agent wakes a sleeping display before it captures. These messages mean it
found nothing to capture: a server with no monitor and no display adapter
output, a monitor that was unplugged, or a virtual machine with no display
device.

### Resolution

- Give the endpoint a display output: connect a monitor or a display emulator
  plug, or add a display adapter to the virtual machine.
- On a headless Windows server, `remote_display.enabled` lets the Outpost
  Recovery Display component keep a virtual console monitor, once the
  component's Windows driver package is available for your endpoints. See
  [Remote access policy settings](/remote-access/policy-settings/#remote-display-enabled).
- On Windows Server Core, the agent builds the picture from the open windows,
  at a lower frame rate. That is expected.

`[RD_BROWSER_FIRST_FRAME_TIMEOUT]` instead means video reached your browser but
it could not decode a frame. Check that your browser supports the video codec
shown in **Statistics**, or try another browser.

## Cause: the picture disappears at sign-in or sign-out {#cause-switching}

The screen hides and reads **Switching sessions...** when someone signs in,
signs out, or switches user at the endpoint. That is expected: the session is
following the console, and it checks policy and, in a **Consent required**
session, asks the next user for consent before showing their desktop. The
overlay's second line says what it is waiting for, such as
**Waiting for the console**.

It becomes a failure when the wait runs out:

```text
[RD_SESSION_RECONNECT_TIMEOUT] The user session did not return within 2 minutes
[RD_TARGET_CHANGED] The pinned session ended
```

### Resolution

Select **Reconnect**, and choose the session again from the list. A Remote
Desktop session that a different user took over cannot be followed, and has to
be chosen again.

## Cause: Ctrl+Alt+Del does nothing {#cause-ctrl-alt-del}

Selecting **Ctrl + Alt + Del** and **Send** has no effect on a Windows
endpoint, or the viewer reports:

```text
[RD_SAS_UNAVAILABLE] Ctrl+Alt+Del is not available on this endpoint (Windows Server Core has no software Ctrl+Alt+Del)
```

Windows accepts the combination from the agent only when the
`SoftwareSASGeneration` policy allows services to send it. The agent sets it
when it is not set, but leaves an existing value alone, so a Group Policy that
sets it to `0` blocks it. Server Core has no way to send it at all.

### Resolution

- Change the Group Policy that sets `SoftwareSASGeneration` so that it allows
  services.
- On Server Core, turn on `remote_logon.disable_cad_on_server_core` for the
  endpoint, so its sign-in screen does not ask for
  <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>Del</kbd>. See
  [Remote access policy settings](/remote-access/policy-settings/#disable-cad).

## Cause: a macOS privacy permission is missing {#cause-macos-permissions}

On a Mac, the session does not open and the viewer reports:

```text
[RD_PERMISSION_REQUIRED] Screen Recording permission is not granted to Outpost on this Mac
```

or the session opens view only, with:

```text
[RD_PERMISSION_REQUIRED] Accessibility permission is not granted to Outpost on this Mac
```

macOS protects the screen and input with privacy permissions. Screen Recording
can be granted only by someone at the Mac. macOS support is a preview.

### Resolution

The viewer says what to do: someone at the Mac must open System Settings,
Privacy and Security, then Screen Recording (Screen and System Audio Recording
on newer macOS) or Accessibility, and turn on `outpost-agent`. Then select
**Reconnect**. The viewer does not retry on its own while a permission is
missing. See
[macOS agent](/agent/macos/).

## Cause: Linux session limits {#cause-linux}

On Linux, what works depends on the session:

| What you see | Cause | Resolution |
| --- | --- | --- |
| **Clipboard sync is not available for this session type** | The session is Wayland, a text console, or the sign-in screen. Clipboard sync works on X11 sessions only. | Use **Type clipboard** for text, and file transfer for files. |
| The picture shows but input does nothing, or the tooltip mentions `/dev/uinput` | Wayland sessions, the sign-in screen, and text consoles take input through the kernel's uinput device, which is missing or cannot be opened. | Load the `uinput` kernel module on the endpoint. |
| `[RD_CAPTURE_UNSUPPORTED]` | No capture method works for that session. The message gives the reason. | Fix what the message names, or use the remote console. |
| **Install ffmpeg on this endpoint for faster H.264 video** | The agent is encoding with its slower software encoder. | Install ffmpeg on the endpoint. |

## Cause: the session paused or ended for inactivity {#cause-idle}

Before the pause, the viewer shows an **Are you still there?** notice. The
status reads **Paused**, the viewer says **Paused for inactivity. Turn on
Control and click the screen to resume.** or **Paused for inactivity. Sign in
again to resume.**, or the session ends after a period with no input.

Your policy steps an idle session through a warning, a pause, and an end. With
no profile setting them, those come at 5, 10, and 30 minutes. A session you are
watching with **Control** off sends no input, so it counts as idle.

### Resolution

At the **Are you still there?** notice, turn on **Control** and move the
mouse over the screen, or use **Send keys**, to keep the session going. To
resume a paused session, turn on **Control** and select the screen. If the
viewer asks you to sign in again, select **Resume** and confirm your identity.
That happens where the PCI DSS baseline or a profile requires it. If your
account signs in only with a code sent by email, it cannot confirm this way:
start a new session. See [Confirm it is you](/depot/account-security/#confirm-it-is-you). To change
the limits, see
[Configure access modes and consent](/remote-access/access-modes/#technician-idle).

## Cause: the session reached its time limit {#cause-time-limit}

The viewer shows **Session time is up**, and the reason reads like this:

```text
[RD_SESSION_EXPIRED] Authorized session duration of 1 hour elapsed (Maximum session length in the profile "Workstations")
```

Every session has a time limit, which is 1 hour unless
`remote_access.session_max_seconds` (**Maximum session length**) sets
another. The message names the length and where it came from: a profile, the
profile that decides among several, the default, or the time left on the
session's original authorization. **Authorized for** in the viewer's
**Statistics** panel shows the same while the session runs.

### Resolution

Select **Reconnect** to start a fresh session. An expired session does not
reconnect on its own. To change the limit, edit the profile the message
names. See
[Limit session length](/remote-access/access-modes/#limit-session-length).

## Cause: the Outpost server restarted {#cause-server-restarted}

The viewer shows **The session ended. Reconnect to start a new one.**, and
**Remote** > **History** gives this reason for the session:

```text
[RD_DEPOT_RESTARTED] The Outpost server restarted, so this session ended.
```

A session cannot outlive the Outpost server that relays it. After a restart,
Outpost closes the session's record and tells the endpoint to stop capturing,
so the endpoint is free again within seconds of reconnecting.

### Resolution

Select **Reconnect**. If the session list still shows **Another operator is
connected** in the first minute after a restart, select **Refresh sessions**
and try again.

## Cause: another technician is connected {#cause-busy}

The session is grayed out in the list with **Another operator is connected**,
or the viewer reports:

```text
[RD_SESSION_BUSY] Another operator is supporting this session
```

Only one technician at a time can connect to the same session on an endpoint.
**Remote** > **Overview** shows **In session** while one is running.

### Resolution

Check **Remote** > **History** for who is connected, and coordinate with them,
or choose another session on the endpoint.

## Still stuck {#still-stuck}

Collect these before you ask for help:

- The endpoint's operating system and agent version, from the endpoint's
  **Overview**.
- The exact message from the viewer, and its details, copied with **Copy**
  on the notice.
- The **Session** ID from the viewer's **Statistics** panel, and the time.
- Whether the session connects from another network.

Do not send screenshots of tokens, passwords, or browser developer tools
network captures. Then see [Get help](/support/).