Phatmandrake

I wiped and reinstalled and couldn't get this to work thank you haha.

Sure thing have to troubleshoot why on MacOS the right hand side isn't displaying information first though so it might take me a bit.

Awesome thank you. The last piece to my puzzle is to then attach the OTP to a VPN definition for automatic appending, but I think this feature is currently only available on the MacOS version of RDM. Is this something that will be supported to configure through the module?

The property doesn't exist though.

It would seem possible to create a credential object and specify it as type "OTP"

$Session.Credentials.CredentialType = "OTP"

And it will generate an entry, but how do I supply a value for the key parameter?

It would appear there are several parameters that can be set, but not key.

I need to distribute RDM to multiple users, but each user will have a special OTP and VPN that I want to auto-inject on installation of RDM.

Is there a way to inject credentials for the local data source, or perhaps create an XML file that is capable of being targeted and updated programmatically? The <SafePassword> <SafeOTPKey> keys are, presumably, reversibly encrypted is there a way to supply an unencrypted form of the password or to encrypt it.

Stupendous. That desktop alias is a perfect workaround. The benefit of using the spotlight API though I assume would be being able to use meta-data to support a search. But this is great!

Now to work on a deployment.

This is demonstrated by Microsoft Remote Desktop on MacOS. Being able to launch connections via spotlight would enable speedy workflows.

Alternatively, if it were possible to create Finder shortcuts to entries you could get a similar behavior.

I hope the same functionality comes to windows as well.

Exquisite, Phenomenal, Magnifique!

A thousand blessings unto you and your kin.

I'm ecstatic I can't thank you enough.

For the record (and the web crawlers), this is being used to streamline a 2FA enabled Meraki VPN connection workflow. Using a password + OTP form of 2FA via RADIUS. Which is especially cumbersome to do using the native OS interface.

A powershell Module would be preferable, but I mean any sort of REST API would also be fine.

Your first paragraph is correct. At the end if there was a way to update who has access to what machine easily, it would work, but anything that requires me to interact via a web interface is less desirable than something I can do programmatically. We do already have all the information about who is assigned to which machine, so even a one time dump would be helpful, but really for this to be viable long term, tools that let us Create, Update, and Remove as needed on demand would be ideal.

We have 3 technical Teams and many individual users who need access to specific machines. The use cases are either they're a true technician on a technical team, or they are an end user who needs remote access to their work device.

The 3 Technical Teams will either have access to all machines or a subset of machines depending on which team they're on.

Where this falls apart is for our individual users. We have a couple hundred user's who need to be able to access machines 1:1.

There are also a handful of other configurations that will need to be done where non-technical team users may need access to another person's machine, but those could feasibly be done by hand.

Unfortunately because of this even synchronizing AD groups will not be of help for this.

Is there any way to restrict what machines a technician have access to in the Mongo DB even if it isn't officially supported?

I have hundreds of permissions that I will need to configured and if my only option is to point and click my way through the web interface, then integrating this product into my environment is infeasible.

How are other people managing permissions? I can't imagine it's all done manually.

Ah that would explain it. i'll take a look see thanks for your help!

Is the RSA SecurID entry available on MacOS? It doesn't appear for me when searching.

We have 2FA set-up via RADIUS using a form of password+OTP to authenticate.

Is it possible in Remote Desktop Manager to say get the current value of a OTP and dynamically inject it into another entry for the purpose of authentication?

The goal is to make it so a user only needs a single click to start a session and to eliminate manual copy and pasting.

Oh that's clever with ARD!

Now this comes with one primary restriction: You would need to authenticate with a user that is authorized for Apple Remote Desktop connections. It's obvious when you think of it, since we would be authenticating locally with ARD with the credentials passed through Wayk Now. Would this restriction be acceptable?

Oh that's not a problem in the slightest. As long as the keep alive session was also kept secure.

I think I already know the answer, but I presume that the 80$ Apple Remote Desktop application

Eh, we use ARD internally, but we want something that's simple for our End Users, branding and ease of use are important. Then we really don't wanna have to use a VPN or futz with ports for these connections. We do also have Windows servers and workstations, etc etc etc that we have to contend with so we're looking for the EZ all in one solution to keep everybody happy and everything centralized.

Also a remote access product like yours are more likely to support external authentication, so the added security/management bonus of being able to leverage our IDP to control access to these services is also why we're looking to third party vendors.

As for 2FA and SAML: if you had to choose between 2FA and SAML, which one would you pick?

Wayk Den provided 2FA combined with your existing LDAP support would be... "acceptable"; however, I really truly only see SAML as the only real solution. Everything has a user account these days, and being able to minimize the need for third part authenticators and avoid the tedium of setting up 2FA for every new service is important. This is especially true to our end users overall satisfaction with our IT services as a whole. It's not just a nice to have internally, the implications have an impact on the overall quality of life of our ends users as well. When it "just works" it's great for them, and makes people more productive when the behavior of technology is consistent and not in the way.

I would definitely want a way to Add/Remove/Disable/Assign for users/machines and at minimum terminate active sessions through command line to support any of these scenarios.

1. That's welcome news.

2. I believe it would, although you've got me thinking of how it would be neat to be able to run shell scripts on user connect/disconnect to trigger this. Just a thought.

3. Well the SAML specification really leaves it up to the IDP to handle any requirements for validating the user (2FA/MFA,Context Awareness etc), seeing as during this handshake the user is directed to the IDPs domain for validation, I would hope that it wouldn't present any additional complexity over what is already being looked into. I'm certain all diligence is being taken though for determining what is best. I did spin up a private Wayk Den instance following the documentation, impressively simple, lightweight, and fast. I would definitely be confident in deploying it to our live environment. Is there a particular reason for the question?

4. Marc-André, I cannot begin to explain how many hopeless hours have gone into looking for a reasonably priced remote solution that doesn't include MacOS as an afterthought.

Splashtop, Zoho Assist, Connect Wise Control, ISLonline, RemotePC are a subset of the 30 or so I looked at.

Price, external authentication, CLI/REST API management, features (multimonitor etc), integrations with our helpdesk, product aesthetic, protocol transparency, and other factors all went into the determination criteria, with an emphasis on being able to automate deployment and user/machine management.

1. Splashtop didn't support External authentication, or charged extra for it, but was was reasonably priced otherwise.

2. Zoho Assist doesn't support passing keyboard shortcuts (🤦) so we stopped looking at that, but was easy to use and browser based.

3. RemotePC was cheap, easy to deploy, but their support has been questionable. Machines have gone missing or have linked to other devices so they have DB issues...

4. ISLOnline, in all its magnificent glory, is outside our price range for our size, but would be a steal for a much larger company.

5. ConnectWise Control is the last product to look into. They support 5 forms of authentication including SAML and OAuth, connect with our helpdesk, support curtain mode, and are also fairly reasonably priced. It's still being evaluated, but my expectations are at an all time low in this market 😂.

I'll say this, I really, really appreciate that devolutions has an actively developed Powershell module to support their application. I find that to be a desirable trait, I see that as a sign that a company, cares enough to do that, has admirable motive to make their products simple to manage, and demonstrates to me that they're focused on delivering a quality product. I think the client has been lightweight and snappy to use even with the limitations on MacOS. I've spent a few days trying to find creative ways to over come those limitations, but I keep coming up short. If there were external authentication support, the ability to manage machines/users WaykDen users through that Powershell module, even without curtain mode this would be no contest. WaykNow would easily be top 3 based on all criteria. Automation, Security, and Cost being the most principally important features, Wayk Den would be without a doubt the top pick.

Performance between all these remote access applications are relatively the same, if Devolutions has some secret Chrome Remote Desktop-like sauce for creating responsive high-quality remote desktop sessions that's great, but if I also have to ensure I can automate these deployments at scale for security's sake. Especially with something as sensitive as remote access software. Ensuring account access can be stopped as apart of an automated termination work flow is of paramount importance, as much as the main product feature itself, which almost all of these remote access solutions seem to lack.

For both the privacy of our end users, and the protection of sensitive client documents we require that machines that are remotely accessed be able to enforce a curtain mode. We are a Mac shop, our end users need to be able to remotely access their Mac desktops from home. Most sensibly this would be enabled through Wayk Now, but 3 things are really holding back the possibility.

1. Lack of unattended access for MacOS - (I'm willing to be creative if I can manage things from a CLI if true unattended is too complex right now)

2. Lack of Curtain Mode for privacy

3. Lack of 2FA or modern external authentication (SAML or OAuth) that MFA could be enforced through. (I could throw it behind a cloud application proxy, but that's a burden)

Our IDP is GSuite so having Office365/Azure specific integrations would actually present an additional challenge having to dual host IDPs. Hopefully your intention is to just support SAML, then every IDP would be able to integrate with Wayk Den. SAML is preferable over LDAP which while GSuite supports LDAP, it does not allow for MFA. (Oauth or SAML only).

SAML is also preferable over GSuite's OAuth implementation because in GSuite only SAML apps or GSuite Marketplace apps are able to be added to their application launch menu/dashboard. (Although having both would be superior for a wider audience, OAuth is is so ubiquitous these days I question the motive of a company that doesn't support it.)

Also being able to manage the removal or addition of users/machines from a CLI/REST interface would also be great. Management from a web interface at scale is infeasible.

Yes, it's a security requirement for us. That and being able to enforce 2FA, which is also makes this a no go for us unfortunately.

Maybe this is a "Unattended Access" feature, but I am using Wayk Now on MacOS and do not see it as an option. Is this available in unattended access mode on Windows? If not it should be an option.