Why the server runs on your hardware
Remote support software is unusually privileged. It can watch any screen, drive any
keyboard, move files on and off any machine, and run scripts across the estate. It
is worth being deliberate about where something with that reach lives.
Ours installs on your own servers. Not because hosted software is wrong, but
because for this particular category the trade is different: the data passing
through it is every screen your staff look at, including the ones with payroll and
patient records and contracts on them.
What that changes in practice
Sessions do not leave your network unless you choose a route that takes them out
of it. When an engineer connects to a machine on the same site, the connection can
go directly between the two rather than out to a relay and back – which is faster,
and also means the pixels never leave the building.
Your audit trail is in your database, on your hardware, under your retention
policy. When somebody asks who connected to a machine in March, the answer is
yours to produce and does not depend on anybody else’s log retention.
Agents authenticate, and so does enrolment
An agent does not simply announce itself and get adopted. Enrolling a machine
requires a secret that is written into the installer, and re-registering an
existing machine requires that machine’s own token. Without both, anyone who could
guess a hostname could claim to be one of your PCs.
Every agent channel is encrypted with a key issued to that device and to no
other.
Licensing without phoning home for permission
The licence is a signed file your server holds. It checks in to report what it is
using and to collect a renewal, but a network problem between you and us does not
stop your engineers working – the file it already holds stays valid until it
expires on its own terms.
Software that stops working because a licence server was unreachable is software
that has made its vendor’s uptime your problem.
Someone is connected to that PC. Who, and from where?
Session history is for afterwards. The question that comes up in a hurry is
different: there is a screen open on the finance PC right now, who is on it, where
are they, and how do I end it?
Two usernames, and they are often different people
Every live session shows both the portal account whose credentials opened it and
the Windows account signed in to the PC those credentials were typed on. On a
shared engineering workstation those are routinely different people, and knowing
which is which is the difference between calling the right person and the wrong
one.
We label which facts are observed and which are reported. The addresses and the
portal account come from the connection itself. The machine name and the Windows
user are reported by the client, so they are a lead rather than proof, and the
page says so rather than presenting all five as equally solid.
Both addresses
The public address is what the server sees. The private one is what the engineer’s
machine reports about its own network. Behind NAT a dozen engineers share one
public address, and the private one is what identifies the desk.
Stopping it means choosing what was wrong
Ending the session closes the screen. If the person can simply reconnect, that has
not solved anything – so the same panel offers three kinds of block, and they are
genuinely different:
- The address stops everyone behind it, colleagues included. Right when the
traffic looks wrong and you do not yet know who is behind it.
- The account stops one person wherever they connect from, and signs them out
everywhere immediately. Right for credentials you think have been stolen.
- The machine stops one PC without touching the person. Right for a laptop that
has gone missing.
Picking the wrong one is the usual mistake. Disabling an account because the
traffic looked odd punishes an engineer whose password was stolen; blocking an
address does nothing about somebody who moves. The page says what each costs so
the choice is made deliberately.
What a device licence actually counts
Per-device licensing is simple until you ask what a device is. A laptop that was
returned when somebody left. A machine that was rebuilt and re-enrolled. A server
that was decommissioned but whose history you still need for an audit. Count those
and the invoice stops matching the estate.
Removed machines stop counting
When a device is removed it is marked as removed rather than deleted. The row
stays, its session history stays, and the audit trail of who connected to it stays
– because a deleted device takes the record of everything that was ever done to it
along with it.
What it stops doing is counting toward your licence. The same applies to
engineers: an account that has been deactivated is not a seat you are paying for.
A rebuilt machine is the same machine
Re-enrol an agent on a PC that was previously removed and it finds its old record
rather than creating a second one. Without that, a reinstall silently grows the
fleet by a duplicate, splits the machine’s history in two, and bills you for both
halves.
The cap does not strand a fleet
The device limit applies to machines the server has never seen. A machine already
on the books re-registers freely even when the fleet is over its cap, because
re-registration is also how an agent rotates its encryption key and recovers after
a server move.
Refusing that would turn “you bought too few devices” into “your existing fleet
went dark”, which is a far worse failure than the one being prevented. A licence
should stop you adding the next machine, not take away the ones you have.
You can see the count
The figure the licence checks is the one shown in the portal, derived the same
way. A number you are billed against and cannot reproduce is a number you end up
arguing about.
Unattended access should be an appointment, not a licence
Ask most remote support tools who can connect to a particular PC without anybody
agreeing at the keyboard, and the honest answer is “everyone with the unattended
permission, on every machine, forever”. That is not an answer anybody can act on.
It is also the wrong shape for how the access is actually used. The common case
is narrow and temporary: a contractor who needs one server for one afternoon, an
engineer covering a site while a colleague is away, somebody finishing a migration
over a weekend. A permanent, fleet-wide capability is a poor fit for all three.
Two different questions
We split it. The permission answers “is this person trusted to work unattended at
all”. A grant answers “which machines, and until when”. They are checked together,
and both must hold.
That means holding the permission on its own reaches nothing. It also means a
grant handed to somebody without the permission does nothing at all – so an
administrator cannot accidentally give away unattended control by ticking one box
on one device. The two rights are deliberately not the same right.
Expiry is a moment, not a duration
Every grant runs out on a stated date and time. Not “two hours from first use”,
which cannot be shown on a grid, cannot be queried, and cannot be audited later
without replaying events. A moment can be read straight off the row by a person
and by a report.
There is a hard ceiling on how long a single grant can run. “Until 2099” is how
temporary access quietly becomes permanent and nobody revisits it.
A code every time, not once a day
Each unattended connection asks for a current authenticator code. Being signed in
proves who started the session that morning; it does not prove who is at the
keyboard now. An unattended session is precisely the case where nobody at the far
end will notice the difference, so it is the case where asking again is worth the
friction.
The check happens on the server, not in the browser. A check the interface
performs is a check the API route does not, and both open the same session.
The refusals are the useful part
Every attempt is recorded, including the ones that were turned away. A refused
connection never becomes a session, so without recording it, somebody working
through machines they hold no grant for leaves no trace anywhere. A log of
successes cannot show you that.
Withdrawn grants are kept rather than deleted, for the same reason: “who could
reach that machine last Tuesday” has to stay answerable after somebody has tidied
up.
Hello world!
Welcome to WordPress. This is your first post. Edit or delete it, then start writing!
