Secure remote access

[jmak]

We have some windows PCs which are essentially the control panel for machines. To run the machine, there is a local account and the control software runs in that user context. Users interact with it using TeamViewer or AnyDesk so that they are effectively remotely controlling the local account.

 

I accept that this is how the machines work - but I don't accept that the solution is to just allow "unsupervised access" remotely.

 

I'm looking for a solution which offers similar facilities, but we can lock it down so that you can only connect from a domain or Entra managed device and requires MFA.

 

Any suggestions?

 

TIA

[Scrambles]

A remote desktop gateway server with MFA / Conditional Access rules set through Entra Application Proxy Server?

Users then need to authenticate through entra and it will tunnel it's way back into your systems.

[jmak]

Realistically it's beyond my level of knowledge, so I might have misunderstood something.

 

I think the requirement is slightly different to remote desktop: the users need to remotely access the machine in another user's context, i.e. the account that the equipment is signed in with. A similar function to when you're giving remote support to someone.

[MatthewL]

Who is accessing it and can is be done on the LAN without the need for internet remote desktop services?

 

Could VNC be an alternative?

[NegativeKillDeath]

AnyDesk has password protection, MFA and access control list to allow only certain AnyDesk clients access to a remote session.If you have multiple people who will need access then MFA maybe a problem unless the device with the authentication app is also shared around.

[dmj]

Login as the student with MFA, then impersonate the service account. i.e. create a script to the application that would run the app in the service accounts context.

[jmak]

Login as the student with MFA, then impersonate the service account. i.e. create a script to the application that would run the app in the service accounts context.

That might have legs

[jmak]

AnyDesk has password protection, MFA and access control list to allow only certain AnyDesk clients access to a remote session.If you have multiple people who will need access then MFA maybe a problem unless the device with the authentication app is also shared around.

Anydesk would do exactly what we want. Unfortunately the quote we got was £30k/year based on it estimate of 100 users needing the facility.

 

I think I'll struggle to get budget authorisation for that.

[jmak]

Who is accessing it and can is be done on the LAN without the need for internet remote desktop services?

 

Could VNC be an alternative?

We might be able to combine @Scrambles' suggestion with that to achieve what we need. Edited March 22, 2024 by jmak

[dmj]

The only other thing I can think of is to serve the remote session over http ( see guacamole ) and then put an identity aware http proxy infront of that ( eg nginx with saml/oidc/ldap/whatever). Student would login to the http proxy which would then forward to the rdp session which they would also login to with the shared user account. Sounds like a PITA implement though.

[Mr.Ben]

Connectwise Screen Connect has the features you need I think (the online version allows auto updating).

 

We use it for 3rd party server access - the screen itself is recorded in the audit trail, so 3rd parties can't wriggle out of things when they break them.