Unattended access: configuration

When to use it

Unattended access lets you connect to a machine with no one in front of the screen: servers, fixed workstations, kiosks, remote-work laptops. The technician authenticates, picks the device in the console and takes control without any local action.

It relies on the permanently installed agent. If the agent is not deployed yet, start with Installing and deploying the agent.

Install the agent in permanent mode

Download the package for the platform: MSI, PKG, DEB or RPM.
Install it on the target machine. On Windows and Linux the agent registers as a service; on macOS, as a session daemon.
Check that the machine appears in the console’s device list.

No extra configuration is needed: the workspace binding is embedded in the package.

Automatic reconnection

The agent keeps an outbound connection to the platform on port 443:

after a reboot, it reconnects as soon as the service comes up;
after a network drop or a network change (VPN, Wi-Fi, mobile data), it retries on its own;
in Safe Mode: the service also starts in Safe Mode with Networking, so you can repair a driver or a broken system configuration without physical access.

Wake-on-LAN

Machines that are off or asleep can be woken from the console. Two conditions:

Wake-on-LAN must be enabled in the BIOS and on the target machine’s network adapter;
a relay must be able to send the wake packet to the machine, typically another Ubidesk device on the same subnet.

Once the machine boots, the agent reconnects automatically. On laptops, Wake-on-LAN is often disabled by default: check the BIOS before relying on it.

Permissions and security

Unattended access removes none of the platform protections:

MFA stays mandatory for every technician (TOTP, passkeys or FIDO2);
every connection is written to the hash-chained audit log;
the mandatory confirmation before file transfer applies in this mode too;
data residency (EU, Canada or United States) is the same as for attended sessions.

Capacity by plan

Plan	Managed devices
Personal	3
Solo	50
Pro and above	Unlimited

Plans are detailed on the Pricing page and the product on the Unattended access page.

What unattended access is not

Unattended access does not mean invisible access. Every connection still requires a technician authenticated with MFA, appears in the device activity and is written to the hash-chained audit log. No mode bypasses these controls, and no technician can hide a connection from the log.

Attended or unattended?

Prefer attended sessions whenever a user can confirm what is happening on screen. Reserve unattended access for servers, kiosks and machines you own and maintain. Both modes share the same transport, encryption and audit guarantees.

Best practices

Reserve unattended access for machines you are responsible for.
Create device groups in the console to separate customer fleets.
Review the device list regularly and remove decommissioned machines.