Docs / Obsidian Remote / Administrators
Devices, users, groups and address books
Devices
A device is a PC with Obsidian Remote that has connected to your server. It gets its 9-digit ID the first time it connects and keeps it.
The Devices page lists them all. Search by name, ID, user, address, owner or note; show only one group; or show All, Online or Offline devices. Each row shows the device's name, its system and Obsidian Remote version, who is signed in at it, its owner and group, its address and when it was last seen.
| Action | What it does |
|---|---|
| Connect | Opens the device in the web viewer (online devices). |
| Wake on LAN | For an offline device: asks another online device on the same network to wake it (see Local network and Wake-on-LAN). |
| Edit | Display name (shown instead of the name the PC reports), Group (its group policy then applies), Owner (the owner sees it under My devices), Note, and Disabled (the device cannot register or be reached). It also shows the reported name, the key fingerprint and when it registered. |
| Reset key | Forgets the device's key. Only the same installation of the app can register this ID again. |
| Release ID | The next computer that registers as this ID takes it over, whatever its key. |
| Delete | Forgets the device. Its ID is retired and never used again; if the app is still installed there, it registers again under a new ID. |
Why IDs are tied to keys
Every installation of Obsidian Remote has its own secret key. The first time a PC registers, the server ties its ID to that key, and afterwards refuses anyone who presents a different key for the same ID. That stops another computer from taking over a PC's ID and receiving the connections meant for it.
Sometimes the key changes legitimately:
- The app was reinstalled and its data removed, or Windows was reinstalled: right before that, use Release ID, so the reinstalled PC can keep its ID. Make sure no other computer can register in the meantime.
- The key was lost but the installation is the same: use Reset key.
- The PC is gone for good: use Delete.
Until you do one of these, the PC shows The server refused this PC: id_key_mismatch. A disabled device is refused everywhere until you clear Disabled.
Users
People who sign in to the console, the app or the web viewer. Add user: user name, display name, email, group, a password of at least 8 characters, and whether they are an Administrator.
Edit changes any of these, sets a new password, or Disabled (they can't sign in). Reset two-factor clears their two-factor sign-in when they lost their phone. Delete removes them. Disabling or deleting a user ends their sign-ins at once.
The server always keeps at least one active administrator, so you can't disable or delete the last one.
Groups
A group ties users and devices together: the members of a group see and may connect to the group's devices, and a group policy applies to its devices. Groups are optional; a common choice is one per customer or per site.
Add group with a name and note, then put users in it on the Users page and devices in it on the Devices page.
Who can reach which device
| Who | Sees, may connect to, may wake |
|---|---|
| An administrator | every device |
| Another user | the devices they own and the devices in their group |
| Someone not signed in | can connect by ID only while Require sign-in before connecting is off |
Even then, the PC itself always has the last word: whoever connects still needs its password or the Accept of the person sitting at it, plus a two-factor code if it uses one. The server can let someone try; it can never let them in on its own.
A device gets an owner when you set one under Edit, or when someone signs in to the app on that PC with Register this PC under my account ticked.
Address books
Address books are saved lists of devices, with a name, tags and a note for each. They show up in the app's Address book tab when people sign in.
- Every user has a personal book, made the first time they use it.
- New shared book makes a book you can share with users or groups, to read only or to change (Sharing).
- Add device adds an entry by its device ID.
- Entries in a personal book can keep a Saved password. It is kept encrypted on the server, and the app fills it in when you connect from your address book. Copy saved password copies it.
- Administrators can tick Show every address book (administrator).
An address book is only a list for convenience: an entry doesn't give anyone access to a device, and shows only what its owner typed, nothing of the device itself. Access comes only from ownership, groups or being an administrator.