Remote control

Remote control opens a device's screen in your browser. The picture, keyboard, mouse and clipboard go directly between your browser and the device, peer to peer, and fall back to a relay only when a direct route is not possible. Your Tenvara server carries only the set-up messages and never sees the screen. An agent opens its screen only for a request signed by your own server, with the key the agent learnt when it enrolled, and the consent the person at the device must give is part of what is signed.

You need the remote access permission, and the device needs an online agent with the Remote control module on. Access rules can limit you to viewing or controlling some customers' devices. If the device is asleep, Wake up in its ... menu wakes it through another computer on the same network.

You can also remote in from your phone or tablet with the Tenvara app.

Start a session#

1. Open the device.
2. Click Remote in, or press R. The R key first asks Connect to ...? with who is at the device (for example Sam Taylor is idle (no input for 6 days)): Connect has the focus, so Enter goes ahead and Esc cancels. The button itself goes straight in. The session opens where you prefer: in the browser or in the desktop app (below). Shift-click Remote in to open the other one once. A device with no screen opens a terminal instead.
3. For other options, click the arrow beside the button:
   • Screen (browser): full control in the browser viewer.
   • Screen (desktop app): the session in the desktop viewer, with the whole keyboard. See The desktop viewer.
   • Terminal: a terminal on the device in each shell it has, for example Terminal (PowerShell) and Terminal (Command Prompt), without taking the screen.
   • View only: watch the screen without sending any input.
   • Open in a new window: the viewer in its own browser window, handy on a second monitor.
   • Desktop app, a window per screen: one desktop viewer window for each of the device's screens.
   • Remember as my default: Browser, Desktop app or Ask each time.

Remote in is also on each row of the device list, on a ticket's device and in Cmd+K. Beside it, Toolbox opens the background tools, Run a script... and quick actions without a session. See Toolbox, terminal and your default viewer.

Where Remote in opens#

Each technician chooses under Remote sessions in Settings > Profile: Open remote sessions in the Browser, the Desktop app or Ask each time. The choice follows you to any computer you sign in on. If the desktop app is not installed, the session opens in the browser. For technicians who have not chosen, an administrator sets Where Remote in opens in Settings > Remote access, on the Desktop viewer tab.

Before it connects, the viewer says who is at the device, the same line as on the device page. It then shows where it has got to: Checking you can remote in, Contacting the agent, Waiting for approval (when the user or an approver must say yes), Connecting to the screen, then Live.

If someone left a warning on the device, it is shown before you connect, and a Stop warning must be ticked as read first.

In the viewer#

The toolbar gives you:

• Control or view: switch between controlling the device and watching only. A view-only session cannot be stepped up to control; start a new session instead.
• Picture and display: pick which screen to show on a device with more than one, the Picture quality (Faster, Balanced or Sharper, with an optional Frame rate limit for slow lines), the device's Resolution (put back when the session ends), Pause the picture (keys and mouse still go through), Lock the computer, Scale to fit or Actual size, and Full screen.
• Keys: every key goes to the device while the screen has the focus, Tab, Alt, the F keys and Esc included, and Ctrl+Alt+Home moves the keyboard to the toolbar. Physical keys sends key codes, so the device's own layout decides what is typed. Typed characters sends what your keyboard shows, so a UK keyboard types " and @ correctly on a server set to a US layout, while shortcuts, arrows and function keys stay as keys. The choice is remembered per device. Send Ctrl+Alt+Del, the system shortcuts, Type text and Type my clipboard are here too; typing goes character by character in the device's keyboard layout, with progress and Cancel. See The keyboard in a remote session. The Ctrl+Alt+Del button tells you what happened each time, and shows a warning sign when a Windows policy on the device blocks it. See Ctrl+Alt+Del in a remote session.
• Clipboard: Send my clipboard to the device and Copy the device's clipboard for text, Send a picture from my clipboard and Copy the device's picture for images, Copy files to the device's clipboard... so they paste on the device, and, when someone copies files on the device, a way to download them. If your browser blocks clipboard access, allow it for your Tenvara site and try again.
• Sessions: the console and every signed-in user's session on the device, so you can move the picture to another one without reconnecting. See Switching sessions and Remote Desktop users.
• Connection details: round trip, frame rate, bitrate, resolution, the encoder, how far the picture is behind, what is setting the quality and whether the route is Direct, peer to peer or Through the relay, with Copy diagnostics. The picture adapts to a slow link by itself and sharpens within a second when the screen is still. See Picture quality on slow links and the connection details.
• Files: browse the device and send or fetch files. You can also drop files on the screen to send them to the signed-in user's Desktop.
• At the computer: Blank the screen or Block their keyboard and mouse while you work, where the session policy allows it (Windows). Blanking shows the person at the desk a black screen with a line saying who is working, while you still see the desktop. Both switch off by themselves when the session ends, however it ends.
• Ticket and notes: link the session to a ticket and write notes as you go (below).
• Record this session and Stop recording, when the session policy lets the technician choose. When the policy records every session, recording starts by itself and cannot be stopped.
• End session, and Back to device once it has ended.

What you did in the session (quality changes, pausing, locking, clipboard pictures and files, blanking) is listed on the session's details.

In full screen the toolbar hides until you move the pointer to the very top edge of the screen (or tap the top strip on a touch screen), so it never covers the device's own title bars.

By default a device can have two live sessions at once (a third is refused as busy) and a session lasts at most 12 hours. Both limits can be changed under Session limits in Settings > Devices and agent.

Sessions and tickets#

Remote in on a ticket's device (in the ticket's details panel, or Remote in to PC-01 in Cmd+K on the ticket) links the session to that ticket. From anywhere else, open Ticket and notes beside the screen to link it: the device's open tickets come first, or search the customer's. Your notes are Saved as you type.

When a session that connected ends, Wrap up the session asks once:

1. Log time on #1234: a time entry for how long it was connected, with your notes as the description, billable as the ticket's contract says.
2. Add notes to the ticket: your notes as an internal note.
3. Not now.

Either way, a finished session linked to a ticket goes on the ticket's activity, for example Remote session on PC-01 14:02 to 14:26 by Sam, 24 min. Devices > Remote sessions has Ticket and Notes columns. Sessions without a ticket are still picked up by timesheet suggestions. See Logging time.

Approval for sensitive devices#

Some machines should never be remoted into on a whim: the finance director's laptop, a production server. Turn on Sessions need our approval under Our approval in the session policy for everyone, a customer, a site, a device group or one device.

1. The technician clicks Remote in and is asked why, for example the ticket number and what they will change.
2. They ask for This session or The next few hours (4 by default).
3. The approvers named in Settings > Approvals for remote sessions are asked. The viewer shows Waiting for approval with who it waits for, and connects the moment someone says yes.

With Also ask the customer's approver, a contact at the customer (by contact role, such as Approver, or a named contact) is asked after you, by email with a one-click link or in the portal's My approvals. The session starts once both have said yes, and a refusal by either tells the technician with the comment.

How long approvals last is under Remote access approvals in Settings > Device management: "For the next hours" lasts and An approval "for this session" must be used within (60 minutes by default). Administrators may go in without approval in an emergency lets an administrator go straight in with a reason; the session is flagged in the audit log and the approvers are told. How each session was allowed is kept on its details. See Approvals.

The device page's Remote access policy card says whether sessions on that device need approval and what set it.

Remote into your own computer from the portal#

People at your customers can reach their own office computer from the customer portal, for example when working from home.

1. On the device's page, find Portal access and click Let someone connect.
2. Choose the contact (from the device's customer), the hours they may connect each day (or any time), whether the session may use the clipboard and send files, whether they may wake the computer, an end date and a note.
3. Save.

The contact then sees Connect to my PC in the portal, with their computers, whether each is on, when they may connect, Connect and, when allowed, Wake. The session opens full screen in the portal with Ctrl+Alt+Del, the clipboard and files as their access allows, and Disconnect. Nobody at the computer is asked, because it is their own, but its banner shows someone is connected. They never get the screen controls (blank, block input), and the hours, the grant and the device are checked every time. Removing their access ends a session they have open. The last connections to their computers, theirs and your technicians', are listed under it. See The customer portal.

What the user sees: consent#

How the person at the device is involved is set by the session policy in Settings > Remote access, on the Session policy tab. The policy applies to every device, and a customer, site, device group or one device can have stricter or looser values of its own. Where a device is in several groups, the strictest value wins; a device's own policy wins over all of them. See Policies and where settings come from.

Attended access goes further: someone must be signed in and accept every session. While a session is live, a "being viewed" banner shows on the user's screen, with an extra line such as your phone number if you add one. The policy also sets whether sessions are recorded, whether files can be transferred, and the hours sessions may start. See File transfer, recording and background tools.

The remote session prompt, the banner and the tray wear the customer's brand when the customer has a brand profile.

A session that starts by asking the person at the device connects as soon as they agree.

Signing in, signing out and switching user#

Signing in at a Windows sign-in screen during a session, signing out, switching user, or Ctrl+Alt+Del on a locked server moves Windows to a new desktop. The session follows it: the viewer dims the last picture and says "Following the sign-in...", then "Connecting to the new desktop", and carries on within about 30 seconds. It stays the same session, with the same recording and audit trail, and the device's activity says the session followed the console into a new desktop. Nothing for you to do.

The session policy applies to the new desktop:

• Nobody signed in (the sign-in screen after a sign-out): the session carries on, unless the policy needs someone signed in.
• Someone else signed in, and the policy is Ask them: they are asked first ("Waiting for ... to allow the session..."). They are not asked when you signed in yourself, by typing the password or a credential from the vault into the session moments before.
• Tell them or Neither: the session carries on as at the start.

If it cannot follow, the viewer says why and offers Reconnect, a new session to the device in one click: "The new desktop didn't start.", "Someone else took over the console." (someone connected to that desktop over Remote Desktop and the policy tells or asks the person at the device), or "The device went back to its sign-in screen, and the session policy needs someone signed in." A recorded session keeps the last seconds before someone signs out.

Administrator prompts (UAC)#

When something on a Windows device asks for administrator rights, the prompt shows in the viewer and you can answer it with the mouse or the keyboard. The toolbar says Secure desktop while it is up, and the picture is back at once after Yes. See Ctrl+Alt+Del in a remote session.

macOS permissions#

macOS only lets an app see and control the screen once someone allows it. Someone at the Mac allows Screen Recording and Accessibility for the agent in System Settings, and the device page's macOS permissions card shows whether each is granted. Without Screen Recording the session fails with a message saying so. See Installing the agent.

When a session will not start#

The viewer says why and offers Try again or Reconnect. Common reasons:

• the device is offline, or its Remote control module is off;
• the user declined, or did not answer, when the policy asks them first;
• the session policy's allowed hours do not include now, or an access rule does not allow you on this device;
• two sessions are already live on the device;
• nobody is signed in to the device, or macOS has not granted Screen Recording;
• the device needs approval and nobody has said yes yet;
• the device is asleep: wake it first with Wake up;
• the device's user is on Remote Desktop, or several people are signed in: the viewer lists their sessions to pick from (see Switching sessions and Remote Desktop users);
• the session cannot connect directly and the relay is not reachable, or the relay could not connect the two ends (the viewer says which). The Relay tab in Settings > Remote access says whether the relay is working and, when it is not, why. A relay over TLS on port 443 needs a DNS record turn.<your domain> pointing at your server: the tab checks the name against public DNS, the way viewers outside your network see it, and shows the last test from the server beside it.

Older Windows#

A device on the Lite agent (Windows 7, 8.1 and older servers) opens a basic remote screen in the browser instead: the main screen only, at a lower frame rate, with Ctrl+Alt+Del but without sound or the clipboard. See Older Windows and the Lite agent.

Remote sessions#

Devices > Remote sessions opens on the Sessions tab, which lists every session, newest first: who connected, to which device and customer, the ticket and notes, the mode (Control or View only), the status (Ended, Failed or Declined), when it started, how long it lasted and the route (Direct or Relayed).

Filter by Who, Device, Customer, Status, Started or Mode, and click a session to see its details. Each device's page also shows its latest sessions in the side column, with a History link, and every start and end is written to the device's activity timeline.

The Quick support tab starts a one-off session with someone whose computer has no agent, the Device web pages tab lists the device web pages you opened (see Opening device web pages and forwarding ports), and sessions that were recorded are on the Recordings tab, where you can play them back. See File transfer, recording and background tools.