Private Access Policy

Who may reach which of your systems. Access is granted explicitly: a person or group is granted a system, and reaches nothing else. This is also where a Router's advertisements are set, meaning the nodes, addresses, subnets and names reachable through it.

When two Routers advertise the same subnet, clients use whichever answers fastest.

Routers

A system with Router switched on is a way through to other addresses on its network rather than something reachable only in itself. What it advertises (nodes, addresses, subnets and names) is set here.

Switch Router off before revoking such a system. Revoking it while it is a Router would strand the addresses it advertises, and the console refuses that rather than letting it happen.

Session Privileges

Granting somebody a system says they may reach it. Session Privileges says what they may do once they are in. Every item below is a way data leaves a session, so each is off until you turn it on.

Protocols

The protocol switches decide what Remote may open at all. Everything else on the page only matters for a protocol that is already on.

Ad-hoc addresses let a person type any address rather than picking from the systems you publish. With it off, they can reach only what has been granted to them by name.

SSH

File transfer (SFTP and SCP) moves files in both directions.

Port forwarding tunnels anything through the session, past every other rule on this page. It is the one switch that can make the rest of the page advisory.

Agent forwarding lets the target host use the person's own keys to reach a third system, so access to one machine becomes access to everything their key opens.

Clipboard and drives

Clipboard is the quiet way data leaves: copying out of a terminal leaves no trace in a file transfer log.

Drive redirection mounts the person's local disks on the remote desktop, which makes the remote machine able to read and write them.

RDP

Network Level Authentication refuses to connect to a host that will not do NLA, rather than falling back to a weaker handshake.

Plain HTTP for WinRM, when off, means port 5986 and TLS only.

Credential delegation hands the target the person's reusable credentials. It is the double-hop escape hatch, and it is why a compromised target becomes a compromised account.

Recording

Setting recording to Required means a session that cannot be recorded does not open. Remote is what records, so this is a rule it keeps rather than one we can enforce from here.

RDP screenshot interval is in seconds. Zero takes none.

Address rules

Allow and Deny take CIDRs (10.20.0.0/16) or hostname globs (*.corp.local), one per line. Deny wins. An empty Allow list means anything not denied.

Session limits

Zero in any of these means no limit.

Idle timeout is minutes without input before the session is cut. Maximum duration is hours, however busy the session is. Re-authenticate every is hours before Remote makes the person sign in again.

Session recording

Optional records when recording is possible and lets the session proceed when it is not. Required means a session that cannot be recorded does not open at all. Remote is what records, so Required is a rule it keeps rather than one we enforce from here.

Clipboard

Off means nothing crosses between the session and the local machine. Text Only allows text and refuses files and images, which is the setting that stops a screenshot or a document leaving inside a copy.