Docs / Obsidian Remote / Administrators
Policies
A policy pushes settings to PCs from the server, so you set them once for many PCs, and the people at those PCs can't change them. Policies take effect the moment you save them on every PC that is online, and on the others as soon as they connect.
Who a policy applies to
Add policy asks what it Applies to:
- Everyone (global): every PC on the server.
- A group: the PCs in that group (create the group first, see Devices, users, groups and address books).
- A device: one PC, by its ID.
A PC follows the most specific policy, setting by setting: a device policy beats its group's policy, which beats the global one. Inherit leaves a setting to the wider policy, or, if none sets it, to the PC's own setting.
Effective policy for a device, at the top of the page, shows what a PC actually obeys once all of this is combined: type its ID.
In the app on the PC, settings a policy controls are greyed out, with a note that the server policy sets them.
The settings
| Setting | Choices | What it does on the PCs |
|---|---|---|
| Accept connections by | Password, Click to accept, Password or click | How people get in: a password, the person at the PC clicking Accept, or either. |
| One-time password length | 6 to 16 | Length of the one-time password. |
| Permanent password | Allowed, Not allowed | Not allowed ignores any permanent password set on the PC. |
| Direct IP access | On, Off | Whether people may connect straight to the PC's address, without this server. |
| LAN discovery | On, Off | Whether the PC shows up in other PCs' Discovered list on the same network. |
| Require two-factor | On, Off | Password sign-ins need an authenticator code. A PC without two-factor sign-in set up then refuses every password sign-in (Accept still works), so set it up on those PCs first (see Two-factor sign-in). |
| Disconnect idle sessions after (minutes) | 0 to 1440 | End a session after that long without input from the viewer. 0 = never. |
| Only allow these networks | addresses or ranges, one per line | Viewers from anywhere else are refused, for example 203.0.113.0/24. |
| Scam warning for first-time viewers | On, Off | The warning, the 10-second wait before Accept and the confirmation of one-time passwords when someone connects to a PC for the first time. Off only for PCs your own staff connect to every day; On stops an administrator at the PC from turning it off. The "someone is controlling this PC" bar and Esc Esc stay either way. |
| Restrict what viewers may do | tick it, then untick any of Control (mouse and keyboard), Clipboard, File transfer, Audio, Restart the computer, Session recording, TCP tunnels, Terminal, Block the local user's input, Privacy mode (blank screen) | What you untick is never allowed on these PCs, whatever the person at the PC or the viewer chooses. |
Every setting can be left at Inherit (an empty box inherits too). Save the policy and the console says Policy saved and pushed to online computers.
To remove a policy, click its bin button. The PCs then fall back to the wider policy or their own settings.
Suggestions
For PCs you reach unattended (servers, kiosks):
- Accept connections by: Password
- Permanent password: Allowed
- Require two-factor: On, once two-factor sign-in is set up on each PC
- Only allow these networks: your office or VPN ranges, if technicians always come from there
- Disconnect idle sessions after: 30 minutes
- Restrict what viewers may do: untick Terminal and TCP tunnels if you don't use them
For staff PCs where the person must agree:
- Accept connections by: Click to accept
Leave Direct IP access off unless you need to reach PCs without the server on a network you trust.
A policy can't set a PC's permanent password: the server never knows it, by design. Set it on the PC itself (see Unattended access).