Attended sessions: how they work

Principle

An attended session connects a technician with a user who is present at their computer. The technician sees the screen, controls mouse and keyboard, and can offer file transfers. Everything runs over port 443 with TLS 1.3: no inbound port is required on the user side.

Step by step

The technician creates the session in the console. A 6-digit code is generated, valid once and time-limited.
The user enters the code on the Join a session page or in the client.
The temporary client starts. It does not install: no admin rights are needed and nothing remains after it closes.
The user accepts remote control. The screen is shared and control is handed to the technician. The user can take back control and end the session at any time.
The session ends. The client closes, screen sharing stops and the session is written to the audit log.

The 6-digit code

The code is the only session secret on the user side. A few rules:

give it by voice or over a channel separate from the session itself;
it expires if unused, and a rejected code cannot be reused;
entry attempts are rate-limited server-side.

The temporary client

The temporary client is a signed executable, downloadable from Download. It:

runs without installation and without elevated rights;
never starts on its own;
ends with the session and leaves no residual service.

File transfer

File transfer is subject to mandatory user confirmation: the technician proposes, the user accepts or refuses, file by file. The technician cannot disable this confirmation, and every decision is logged.

Display quality

The stream renders at up to 4K at 60 fps when the machine and the connection allow it. Quality adapts automatically to available bandwidth.

Recording

Session recording is available from Pro. Recordings are stored in the workspace’s residency region. Tell the user before starting a recording.

After the session

Every session feeds the hash-chained audit log: technician identity, code used, device, start and end times, transfers and confirmations. The log can be exported to a SIEM. See Security model and encryption.

Requirements

an internet connection with HTTPS outbound on port 443;
a modern browser or the downloaded client;
the 6-digit code, given by the technician.

No inbound ports, no VPN and no installed software are required on the user side. If a user needs help on a machine where installing anything is blocked by local policy, the temporary client is designed for that case: it runs without installation.

Attended or unattended?

Choose attended sessions when a user can confirm actions on the spot. Choose unattended access for servers, kiosks and machines with no one in front of them. The two modes share the same encryption, MFA and audit guarantees.

Best practices

Never open a session toward a user who did not ask for one: the code is always entered on the user side.
Ask the user to close applications holding sensitive data before taking control.
For machines with no user, use unattended access instead of an attended session.