Bug Fix for "Trust this device" period: Can the configured "Trust this device" period actually be honored server-side?

Avatar
  • Pending Review

Various users on this forum as well as elsewhere have reported that the "Trust this device" period is hit-or-miss. Even setting it to 365 days, users have found that they are prompted for MFA again weekly.


I believe this is due to the authentication mechanism (using ASPXAUTH cookies/sessions) which is reset whenever the web server (IIS) is restarted.


For cloud-hosted instances, this can happen randomly so that even the default 7-day period isn't consistently honored. It would be great if the software "does what it says on the tin."


There are workarounds server-side that could be implemented by ScreenConnect developers, but without those, it won't work consistently even if the client-side browser retains all of the cookies.


This is a known issue with ASP and .net based on research and stack overflow posts where it's mentioned that users ALWAYS need to log back in whenever IIS restarts (but I am not a .net/ASP developer).

Hopefully the ScreenConnect team can either: A) Fix this bug by implementing some of the known workarounds, or B) update their documentation regarding the "Trust this device" period to indicate this limitation. If it doesn't work consistently, it would at least be nice to acknowledge it publicly so that ScreenConnect system administrators know about the behavior so that they can explain it to end-users who notice and report that it is inconsistent.