Docs / Obsidian Remote / Administrators

Rolling out to PCs

This chapter is for IT: putting Obsidian Remote on the PCs you support, already connected to your server, so you can reach them unattended.

The MSI isn't code-signed yet (our certificate is still being issued), so Windows SmartScreen may warn when someone starts it from a download. Silent installs through your management tools aren't affected.

What the MSI installs

The MSI installs for the whole PC and needs administrator rights. It runs on 64-bit Windows 10 (version 1809 or later), Windows 11 and Windows Server 2019 or later.

The service is what lets people in: it keeps the PC registered with your server, works at the sign-in screen, the lock screen and administrator prompts, and starts a helper in the user's session when someone connects. The app is only the window; nobody needs to be signed in for unattended access.

1. Get the client config string

In the admin console: Server settings > Client configuration, the copy button next to the config string. It looks like:

host=remote.example.com:21114;key=AbCdEfGhIjKlMnOpQrStUvWxYz0123456789-_AbCd

With a certificate from a certificate authority it has no key part. See Installing the server.

2. Install with the server already set

Pass the string as the SERVER property:

msiexec /i ObsidianRemote-0.1.0-windows-x64.msi /qn SERVER="host=remote.example.com:21114;key=AbCdEfGhIjKlMnOpQrStUvWxYz0123456789-_AbCd" /l*v "%TEMP%\ObsidianRemote-install.log"

The service picks the server up when it starts, if the PC doesn't have a server yet. A server someone chose in the app's Settings > Network always wins, and the same SERVER value is never applied twice: if someone clears the server in Settings, it stays cleared until you deploy a different SERVER value.

There is deliberately no property for a password: whatever is on an msiexec command line ends up in logs and in your management tool's history. Choose how technicians get in afterwards (step 3).

Group Policy

Software installation in Group Policy can't pass properties on its own. Create a transform (.mst) that sets SERVER, or install with a startup script that runs the msiexec line above.

Intune

Add the MSI as a line-of-business app with the command-line argument SERVER="host=remote.example.com:21114;key=...", or as a Win32 app (.intunewin) whose install command is the msiexec line above. For detection, use the file C:\Program Files\Obsidian Remote\ObsidianRemote.Host.exe at the version you deploy (the MSI's product code changes with every version).

RMM tools

Run as SYSTEM:

msiexec /i "C:\Path\ObsidianRemote-0.1.0-windows-x64.msi" /qn SERVER="host=remote.example.com:21114;key=..."
sc query ObsidianRemote

3. Choose how technicians get in

Each PC decides who may connect. Pick one way per customer or group of PCs and set it with a policy, so it can't be changed at the PC:

There is no way to push a permanent password from the server: by design, the server never knows it. Set it in a first session while someone is there to accept you (in the remote PC's Settings > Security), or have the person at the PC set it.

For two-factor sign-in, set it up on each PC (Settings > Security > Set up two-factor sign-in...) and scan the QR code into the authenticator your technicians share for that customer. Only then turn on the Require two-factor policy for those PCs: a PC under that policy without two-factor sign-in refuses all password sign-ins. See Two-factor sign-in.

4. Give the PCs owners and groups

In the admin console, put each device in the customer's group (and, if you like, give it an owner), so technicians who aren't administrators see it and may connect, and so the group's policy applies. See Devices, users, groups and address books. Signing in to the app on a PC with Register this PC under my account also makes you its owner.

Network requirements

The PCs only need to reach your server's port (21114, or 443 behind a proxy) outbound. No inbound ports from the internet and no port forwarding. See Ports and firewalls.

Check that it worked

1. In the admin console, Devices: the PC is there and online, with its name, Windows version, Obsidian Remote version and signed-in user.
2. Policies > Effective policy for a device: shows what the PC obeys.
3. From a technician's PC, connect by ID. The session window's status line shows Relay or Direct (LAN) and End-to-end encrypted.
4. On the PC, sc query ObsidianRemote shows RUNNING. Its log is in %ProgramData%\ObsidianRemote\logs (administrators only).
5. If you like: restart the PC from Remote actions and check it comes back online and can be reached at the sign-in screen.

Upgrading

Install the newer MSI the same way. It replaces the old version in place and keeps the PC's ID, key and settings. Copies of the app that are open (in every user session) are asked to close first, and anything still running after 10 seconds is ended. Older versions can't be installed over newer ones.

Installed PCs can also update themselves while the app runs (see Updates).

Uninstalling

Use Settings > Apps on the PC, or:

msiexec /x ObsidianRemote-0.1.0-windows-x64.msi /qn
msiexec /x ObsidianRemote-0.1.0-windows-x64.msi /qn REMOVE_DATA=1

The first keeps the PC's ID and key, so reinstalling gives it the same ID. The second forgets the PC completely. The service and the firewall rules are removed either way. In the admin console, Delete the device (its ID is then retired) or leave it to show as offline.