Welcome to our community!

Backstage Mode Option to Turn Off the Feature

CSFi

6 years ago
updated 2 years ago
Completed

The Backstage Mode feature that allows hosts to have complete Windows Terminal and PowerShell access to a remote machine doesn't have an option to turn it off except for using the option of unchecking SwitchLogonSession in Security Roles which also affect other features that are needed.

When you have the option to require Consent where the user has to allow access, if you use the Backstage Mode is doesn't require consent even thought the option is set on.

This is a big security issue for financial institutions that have secure servers and don't want people doing anything to their servers that they are not aware of. With the Backstage Mode option it's wide open.

Duplicates 1

Restrict Access to Backstage

Mark_M

Currently anyone with access to ScreenConnect has access to BackStage or the ability to run commands as an administrator. With this access any one connected to the ScreenConnect Access page and create a user account and login to any connected computer. This is primarily a concern in the event of a security breach. It would be nice to limit access to those areas.

Replies 13

Oldest first
Newest first Oldest first

Caitlin M Barnes Team Member

6 years ago
Under Review

Link

CSFi

6 years ago

I have not personally tried this. I was going thru the new features and saw this option so I started chatting (Ticket 11475408). I told him that our banks have to give us consent to access their servers and did this option require consent and I was told No.

If it does require consent does it show the user the screen that is being used for the Powershell and CMD window?

As far as the other issue of not seeing the consent screen if the user used RDP to access their server the normal consent screen isn't seen. The person on our side has to select the Logon Session for RDP not Console.

But still the Backstage option should be able to be turned off because financial institutions do not like it if they can't control who has access to their server.

Link

anonymous

6 years ago
Considering for Future Release

Link

Caitlin M Barnes Team Member

6 years ago
Under Review

Link

adelamora

6 years ago

This should be controlled by a separate variable, preferably one that allows us to restrict backstage access by group as well as account role. For security we need all of the following, otherwise it is pretty much a security hole to even have it available at all.

1) Backstage should comply with consent

2) Techs who can switch sessions, but not have backstage access (eg: assisting end users on terminal servers)

3) Techs who can have backstage access, but only on workstations (defined by groups). No server backstage allowed.

Link

armstrong007

5 years ago

I agree that we need a way to disable Backstage. As our clients become more security conscience and we employ new security tools, Backstage is being flagged and considered a major security hole. I am voting also for some method, PER CLIENT and/or PER user group to be created.

Link

Shannen

4 years ago

I am not sure if this was implemented or because the way the LabTech / ConnectWise Automate integration works but I just found out that when using Backstage on a machine which requires Consent through LabTech also requires Consent for Backstage and there doesn't appear to be a way to disable that.

Link

Rishikesh Gajul

4 years ago

Quote from Shannen

Hi Shannen,

We do have an option to turn off consent to the Backstage. If you wish to, you can go to Admin > Advanced Configuration Editor > Quick Settings and turn off 'Auto Consent to Backstage'.

Thanks.

Link

Shannen

4 years ago

Quote from Rishikesh Gajul

Hi Shannen,

We do have an option to turn off consent to the Backstage. If you wish to, you can go to Admin > Advanced Configuration Editor > Quick Settings and turn off 'Auto Consent to Backstage'.

Thanks.

Hi Rishikesh,

Does this also function that way when launching it from LabTech / Automate because I have that enabled but LabTech still is prompting for Consent.

Link