+51
Pending Review

Delete clipboard on guest from after 30 seconds or upon exit

jeff weinman 2 years ago updated by Thomas W 11 months ago 16 1 duplicate

To bolster security, when using the clipboard, ConnectWise Control should delete the clipboard on the guest every 30 seconds (or periodically during a session) and upon exit of that session.

Duplicates 1
+2

I agree on this one too... clear and without doubts.

+2

Yes very much needed - I would like to suggest flushing the clipboard for Guests and Hosts alike on disconnect.

+6

Yes, let's reduce security risk of accidental exposure to sensitive information on both MSP/Tech and client sides :)

As SteveIT said, flushing both sides on disconnect is crucial; I'd even go 1 further and say it should be on connect as well (or at least an option to flush on both sides similar to the Consent request)

+1

This would be very helpful for security.

+1

This would be a great feature as sometimes a tech might copy confidential info such as passwords and forget to clear the clipboard before disconnecting.

I have raised a ticket with ConnectWise and they said this would be a great enhancement and suggested to post on this forum and here gos my vote. Pity cannot vote multiple times :)

+3

Definitely a needed feature.

It would also be nice if we could set default Clipboard Sharing based on device type, either workstation or server.

So we could default it to On for Servers and Off for Workstations

+2

Please add this!

+1

Ditto to all above^^

+2

This is a security issue so it should definitely be added!  Clearing the clipboard history in it's entirety on disconnect is critical so that passwords and other sensitive info isn't accidentally left on remote computer.

+2

I can't believe this hasn't been implemented yet considering how big of a security risk it is to not clear the clipboard history on the guest side, thereby leading to possible instances of guests gaining access to sensitive information inadvertently.  I always try and remember to clear the guest clipboard, but this should be done automatically.  Update on this????  Let's focus on some of these important security features and not aesthetic features...


The Essentials menu option 'Send Keyboard Clipstrokes' is independent of the shared clipboard and will allow your hosts to send what is on their clipboard without making it available on the clipboard of the guest machine.


This means that you can disable the clipboard as described here: https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/Essentials_menu/Clipboard_sharing_during_a_remote_session, but still be able to send the host clipboard to the guest machine.

As to the ability to clear clipboard upon disconnect, we have begun scoping this issue out, and I'd like to share some of the potential pain points we have regarding clipboard history in Windows 10 and 11


Clipboard history

  •  Windows 10 and 11 have clipboard history enabled which stores a lot of clipboard information (you can see this by hitting Windows Key + V (defaults to ON)
  • Can sync clipboards over multiple devices (defaults to OFF)
  •  'Pin' clipboard items available in a menu when viewing clipboard history.
  • Clear options in Windows settings clears everything across all devices EXCEPT pinned items


 Our philosophy has always been to be very careful when making a change that could impact the host or guest machine in an unintended way. In this case we wouldn't have knowledge of which clipboard content to clear; it would be very likely that we would be clearing information that was stored intentionally by the guest or the host, and affecting multiple devices.


That's not to say we won't do this, but would like to hear from our partners what they would expect the behavior to be if clipboard history is enabled.

While it is understandable to err on the side of caution about removing data from guest machines, I still think this is an important security feature that should be implemented in some manner so that all clipboard history (maybe with the exception of pinned items) on the guest machine can be cleared upon disconnect.  Maybe set it up as an advanced configuration editor customization that needs to be enabled, but having this would be helpful to avoid leaving unintended info in the guest's clipboard when the host disconnects.  

I would definitely enable a feature to clear the clipbaord and all history from every machine as we log out if we could. The clipboard is a temporary spot and clearing it would be a rare minor issue to any of our clients in my view, very few would be actually using history. But security wise it is a big problem. We now have disabled by default the share clipboard, and will leave it as such but often enable it and it would be easy for my techs to enable it to copy a file over then later copy a admin password without thinking about it. I see no reason why clearing the clipboard and history on disconnect couldn't be an optional feature that partners could choose to use.

This would be a very helpful feature from an MSP point of view.  I actually just came across this issue and disabled our clipboard to ensure that this didn't occur.  If we could use the clipboard with minimal to no risk because it automatically cleared itself that would be a much loved feature I'm sure.  Even just giving us the option to enable it, but having it disabled by default, would leave the responsibility for the management of the feature solely on our end.

FYI I did manage to do it a hacky way by adding a trigger to run on disconnect (Session.SessionType = 'Access' AND Event.EventType = 'Disconnected' AND Connection.ProcessType = 'Host') to run a batch script from the toolbox with just this in it "echo off | clip"

Doesn't always work, sometimes puts up a run prompt after you have logged out. Probably also the client would see a black command prompt window for a split second as you log out.
I did look at trying to add it to the script that is part of the 'Selective Lock on Disconnect' extension, but there was protection to stop you from adding commands into it, and anyway it has to run in the user context and not sure that one does.