Docs / Obsidian Remote / Being supported
Unattended access
Unattended access means reaching a PC when nobody is there to click Accept or read out a password: a server, a kiosk, a PC in a closed office, your own PC at home. It needs the installed version and a permanent password, and it deserves a few extra safeguards.
What you need
- The installed version (the MSI) on the PC you want to reach. It runs as a Windows service, starts with Windows, and works at the Windows sign-in screen, the lock screen and administrator prompts, with nobody signed in. The portable version can't do this.
- A permanent password on that PC, so you can sign in without anyone reading you the one-time password.
- The PC set to accept passwords, so it doesn't wait for someone to click Accept.
Set it up
On the PC you want to reach (in person, or through a session while someone is there to accept you):
- Open Settings (the gear button at the top right of the main window) and go to Security.
- Under Accepting connections, choose Password only (unattended).
- Under Permanent password, type a password of at least 8 characters into New permanent password and again into Again. Make it long and unique.
- Strongly recommended: under Two-factor sign-in, click Set up two-factor sign-in... (see Two-factor sign-in).
- Click OK.
The main window then says A permanent password is set (Settings > Security).
Changing these settings needs the person signed in at the PC or an administrator. A permanent password set without administrator rights belongs to the Windows user who set it: it works while that user is signed in at the PC, and at the sign-in screen when nobody is, but not while another user is signed in. For a PC several people use, set it from the app run as administrator; it then works whoever is signed in, and only an administrator can change it. Your organization may set some of them for every PC with a policy; they are then greyed out, with a note saying the server policy sets them. There is no way to set a PC's permanent password from the server: by design, the server never knows it.
Connect to it
From the Windows app, connect by ID as usual and type the permanent password when asked. See Connecting to a computer.
If nobody is signed in at the PC, you see the Windows sign-in screen: use Remote actions > Send Ctrl+Alt+Del and sign in. Until someone is signed in, file transfer and tunnels are refused, and the terminal only works if an administrator turned on Allow a terminal at the sign-in screen (runs as SYSTEM).
After you restart the PC remotely, the service starts with Windows and the PC is back online at the sign-in screen. Connect again once it is up.
Safeguards
These settings are all in Settings > Security on the PC (or in a policy, see Policies):
| Setting | Why |
|---|---|
| Two-factor sign-in | A stolen password alone isn't enough: the viewer also needs a code from the authenticator app. |
| Only allow viewers from these addresses | Accept connections only from the addresses you name, one per line, for example 203.0.113.10 or 10.0.0.0/8. Empty means from anywhere. |
| Disconnect idle sessions after | Ends a session nobody has used for that many minutes, in case you forget to close it. 0 = never. |
| Lock this PC when a session ends | Locks Windows when the last session ends, so the desktop isn't left open. |
| What viewers may do | Untick what you never need, such as Terminal or TCP tunnels. |
| Use a one-time password | Turn it off if only the permanent password should work. |
The PC also protects itself against guessing: after 6 wrong passwords in a minute from one address, that address is locked out for a minute, and after 30 wrong passwords in 10 minutes from anywhere, it stops accepting passwords for 5 minutes.
Remove or change the permanent password
In Settings > Security, type a new one into New permanent password and Again and click OK, or click Remove the permanent password and then OK. The permanent password is stored only in a scrambled form that can check a password but not reveal it.
If your organization doesn't allow permanent passwords, the page says so and the permanent password is ignored.