BE HUBRemote control
Sometimes the fix needs your own hands on the keyboard. Remote control opens a machine's desktop in your browser, over the agent's outbound connection, and keeps a record of every session. It is on by default and any company can switch it off.
Taking control
Open the machine in Fleet. An online Windows machine shows two buttons: control takes the mouse and keyboard; watch shows the screen without touching it. The desktop opens in a new browser window; allow pop-ups for the console if your browser blocks it. End session closes it, and so does closing the window; the machine side ends within about twenty seconds of the viewer going away.
One person controls a machine at a time. A second technician is told who has it.
Where it works
- Windows Server 2016 and later, Windows 10 and 11. The session served is the one the person is actually using, including a Remote Desktop session.
- Unattended machines. When nobody is signed in, or everyone has disconnected, the console is served from the sign-in screen, so you can sign in yourself. The Ctrl-Alt-Del button appears only in those sessions, where it works.
- Not yet: macOS and Linux, and devices watched through a proxy, which have no screen.
A session started while someone is signed in cannot reach the Windows secure desktop: if a UAC prompt or the lock screen appears, the picture stops there until the person clears it. A machine whose displays run at different scalings refuses control, because clicks would land in the wrong place; watching still works.
The company switch
Companies → manage → remote control: on or off. Off refuses every request for that company, including a single screenshot, and the buttons disappear from its machines. The setting is per company, so a customer who does not want it can have it off while the others keep it.
How the picture travels
The agent starts a small screen server on the machine for the length of the session, bound to the machine's own loopback address on a random port, and bridges it over the agent's existing outbound connection to a viewer in your browser.
- no inbound port, no VPN, nothing listening on the customer's network
- Windows Firewall does not prompt, and nothing of ours appears on the person's screen unannounced
- the server runs only while a session is open; its configuration is written to a private file and removed afterwards
- if the customer already runs their own screen-sharing server on the machine, the agent leaves it alone and refuses the session rather than touching it
What is recorded
Every session is a row the company can read: who opened it, from which address, which machine, watch or control, the reason, when it started, when it ended and why. The audit trail carries the same events (requested, granted, ended, failed).
What was typed is never recorded anywhere. There is no column for it, and the audit trail strips it. There is no video recording either.
Who can open a session
- a signed-in person in the console; API keys are refused with a plain message
- never BE AI: the investigator has no tool that can see or touch a screen, and the tools that start a server are refused on the scripting path
- one controller at a time per machine
Not built, on purpose
- file transfer
- clipboard from the machine back to the technician (a one-line way to lift a password)
- blanking the person's screen or blocking their keyboard: they should be able to see what is being done and intervene
- any way for a script or the model to open a session
Try it on one machine first.
The install line takes a minute. Uninstall the agent and you are out.