How to control who can access your PCs and servers

• Who is it? Every person gets their own sign-in. Shared accounts make it impossible to tell who did what, or to remove one person without locking out everyone.
• How do they prove it? A password plus a second factor, such as an authenticator app or an SSH key protected by a passphrase.
• From where? If people always connect from the same networks, limit access to those networks.
• What may they do? Watching a screen, controlling it, copying files and running commands are different powers. Give each person only what they need.
• What's recorded? A log of who connected, where and when, so you can spot something odd and answer questions later.

1. 1

   Step 1: Give every person their own account

   Don't share your RemoteAccessApp sign-in. On the free plan, each person reaches the PCs set up in their own account. With Teams (Pro), you'll share chosen PCs with someone's own account instead of handing over a password. For an office, our guide on setting up remote IT support for a small team covers invites, roles and permissions step by step.

2. 2

   Step 2: Turn on two-factor sign-in

   Under Security on your dashboard or in the app's settings, add an authenticator app and keep the backup codes offline. Without it, a browser or PC you haven't used before still needs a 6-digit code we email you.

3. 3

   Step 3: Keep the Allow prompt where people work

   On a PC someone uses, leave unattended access off: the PC then asks the person there before every session. Use unattended access only on your own PCs, or with the clear agreement of the people who use them.

4. 4

   Step 4: Limit sign-ins to trusted networks

   Add the IP addresses or ranges you connect from. Signing in, using your account and connecting to your PCs then only work from those networks, and you can set a list per PC too. Very broad ranges are refused.

5. 5

   Step 5: Review the trusted consoles and browsers

   On each PC with unattended access, right-click the RemoteAccessApp tray icon and choose Trusted consoles and browsers. Remove anything you don't recognize or no longer use; a removed console is disconnected at once. The help article on trusted browsers, consoles and networks explains how long each one is remembered.

Every RemoteAccessApp session follows the same rules on the PC, on the free plan:

• Unless unattended access is on, the PC asks the person there to allow the session and shows nothing until they do.
• A banner stays on the screen for as long as anyone is connected.
• Allow remote control is a switch on the PC. Turned off, the session is view-only: no mouse, keyboard or commands.
• Commands only run during a session while remote control is allowed at that PC, and the banner says when a command prompt is open.

Teams, roles and per-PC permissions Pro

When several people look after the same PCs, Teams let you share chosen PCs and saved hosts instead of a password. Each member gets a role (Admin, Member or Viewer), and for each shared PC you choose what they may do: view, control, files, Windows tools and commands, and managing access. Our server signs those permissions into each connection, and the PC itself enforces them. Changing someone's role or permissions, or removing them, ends their live connections at once. To start a team and send invites, follow the help article on teams and roles.

The same rules apply to servers you reach over SSH. On most Linux distributions the SSH server's settings live in /etc/ssh/sshd_config.

1. 1

   Step 1: One user per person, with sudo for admin work

   Create an account for each person (sudo adduser anna) and add only those who need admin rights to the sudo group. Don't let people sign in as root.

2. 2

   Step 2: Keys instead of passwords

   Each person puts their public key in their own ~/.ssh/authorized_keys. Once every key works, turn off password sign-in and root sign-in.

3. 3

   Step 3: Allow only the people who need SSH

   List the allowed users or a group, so a new account doesn't get SSH access by accident. For a group, create it with sudo groupadd sshusers and add each person with sudo usermod -aG sshusers anna.

4. 4

   Step 4: Limit which networks reach port 22

   If people connect from known networks, let only those through your firewall, for example sudo ufw allow from 203.0.113.0/24 to any port 22.

The settings for steps 2 and 3 look like this:

PasswordAuthentication no
PermitRootLogin no
AllowGroups sshusers

Reload the SSH server afterward (sudo systemctl reload ssh, or sshd on some distributions), and keep your current session open while you test a new one, so a mistake can't lock you out. New to SSH? Start with how to SSH to a Linux server. The RemoteAccessApp SSH client checks each server's host key before sending a password and signs in with keys, passphrase-protected ones included.

• Your account's security log keeps sign-ins, PCs added or removed, account changes and a record of each session (who, which PC, when and for how long, never what happened in it) for 90 days.
• Windows tools in the RemoteAccessApp app show a PC's sign-in sessions and its Event Log, free, so you can check what happened on the PC itself.
• On Linux, last lists recent sign-ins, and journalctl -u ssh (or -u sshd) shows the SSH server's log.
• Activity log download as a CSV or JSON file, including your team members' sessions on your PCs, is part of Pro. A week of remote IT help for a five-person office shows it in use on an ordinary Friday.

Access that outlives the job is the most common gap. Work through this list the same day:

• Remove their console and browsers from each PC's Trusted consoles and browsers list.
• Stop sharing PCs and hosts with them, or remove them from your team.
• Change any password they knew, including shared Windows or server passwords.
• On servers, delete their key from authorized_keys and lock or remove their user account.
• Check the logs for anything unexpected in the days before they left.

For the bigger picture of how RemoteAccessApp protects PCs and accounts, see security and the security white paper, which covers team access control in detail. For a short list you can work through in an evening, read how to keep your remote access safe in 2026.