Remote Desktop Session Permissions: What to Approve Before Helping

Before connecting, describe the job in one sentence: “Help me change the default printer,” for example. Start with screen viewing if the person can follow instructions. Add control or data access only when you can explain why that specific task needs it. This framework is a practical synthesis of the vendor documentation below.

Use three questions for every permission: What will it let the helper see or change? Why does this task need it? When will it expire or be removed? If an answer is unclear, leave that permission off and work through the next step together.

For family support, confirm the helper through a familiar phone number or conversation before exchanging a session code. For a work computer, use the organization's approved support process. Microsoft advises users to initiate contact with Microsoft Support or their IT support staff directly before allowing a helper to connect. [Microsoft’s Quick Assist guidance](https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist)

Screen viewing: use it to inspect an error or guide someone through settings. Close unrelated documents, messages and account pages first. Treat anything visible on the shared display as disclosed to the helper. Check which display or window the tool shares before approving.

Keyboard and mouse control: approve it when the helper needs to operate the application directly. For a printer preference change, viewing plus control may be enough; file transfer, clipboard synchronization and ongoing access have no obvious role. Agree that the helper will ask before opening unrelated applications or files.

Clipboard and file access: leave these disabled unless the task requires moving information between computers. If a diagnostic log must be sent, agree on the exact file, its destination and whether it contains personal information. AnyDesk documents separate settings for clipboard synchronization and transferring files through the clipboard. Check all available transfer controls rather than assuming one checkbox covers every route. [AnyDesk’s file-transfer documentation](https://support.anydesk.com/file-manager-and-file-transfer)

Audio, microphone, recording and terminal access: consider each separately if offered. A sound problem might justify system audio; changing a printer preference does not. Ask what a proposed terminal command changes before permitting it. Agree explicitly before recording, including who keeps the recording and for how long. Available controls vary by tool, platform and organization policy.

Permission labels are not interchangeable. In Quick Assist, the recipient first approves screen sharing. The helper can then request control, which requires another approval. This supports a useful workflow: inspect the problem together, then decide whether taking control is necessary. [Microsoft’s Quick Assist instructions](https://support.microsoft.com/en-us/windows/apps/solve-pc-problems-remotely-using-quick-assist)

Chrome Remote Desktop documents a broader support grant: the recipient sees the helper's email address and selects Share, giving access to applications, files, emails, documents and history. Check that identity before approving. Its support code works once, but that limits reuse of the code rather than narrowing access during the session. [Google’s remote-support instructions](https://support.google.com/chrome/answer/1649523?hl=en)

If the tool bundles more access than the task needs, make that trade-off explicit. Choose a tool with narrower controls or let the recipient perform the clicks while you guide them. A spoken agreement defines the agreed work; it does not create a technical restriction the software lacks.

A useful approval sounds like: “You may view my desktop and control the printer settings while I stay here. Ask before transferring files, installing software or restarting. We will end access when the printer works.”

Remote control and administrator privileges are different permissions. Windows User Account Control, or UAC, requests consent or administrator credentials for elevation, depending on the account and configured policy. Accepting a remote session should not be treated as blanket permission to approve these requests. [Microsoft’s UAC explanation](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works)

Suppose the printer problem turns out to require a driver installation. Pause, explain the change, identify the installer and its source, and ask for approval before proceeding. Have the recipient or authorized IT administrator handle credentials rather than sending passwords through chat or clipboard sharing.

If the remote tool cannot show or operate an administrator prompt, let the authorized person respond locally or use the organization's approved elevation process. Keep UAC protection enabled; Microsoft recommends retaining its secure desktop protection. Plan any restart too: explain whether it will end the connection and how the recipient will approve the next session. [Microsoft’s secure desktop guidance](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works#securing-the-elevation-prompt)

Locate the recipient's stop control before the helper takes over. In Quick Assist, Cancel control stops the helper's control, while Leave ends the session. In Chrome Remote Desktop's support workflow, the recipient selects Stop Sharing to end sharing. Identify the action that ends viewing as well as input. [Quick Assist controls](https://support.microsoft.com/en-us/windows/apps/solve-pc-problems-remotely-using-quick-assist), [Chrome Remote Desktop controls](https://support.google.com/chrome/answer/1649523?hl=en)

If the recipient needs to open a password manager, bank account or other unrelated sensitive material, end sharing first and reconnect afterward if necessary. Removing keyboard control alone should not be assumed to hide the screen.

Keep approval tied to the current task. If troubleshooting expands into deleting files, installing software or accessing another account, explain the new action and ask again. The recipient should be able to decline without being pressured to approve everything.

Finish together: confirm the result, summarize changes, stop sharing and have the recipient check that the session has ended. Review any files copied or recordings created. Ending access cannot retrieve information already transferred, so agree on retention or deletion as part of the support task.

Then check for persistent access: unattended access settings, saved login approvals, account invitations or a reusable support password created during the visit. Treat future access as a separate decision from approving today's help. For recurring access requirements, see the [unattended remote access setup guide](/blog/unattended-remote-access-setup).

Revocation is product-specific. AnyDesk documents that turning off permission to save login information stops new tokens, but existing tokens remain valid until cleared. Clear all tokens or changing the unattended-access password invalidates saved tokens. Token removal alone does not revoke a password the helper already knows; remove temporary unattended access too if it is no longer needed. [AnyDesk’s unattended-access documentation](https://support.anydesk.com/docs/unattended-access)

For one support task, aim to finish with no new standing access. If ongoing access is deliberately retained, document who has it, its purpose, when it will be reviewed and how the recipient can revoke it.