{{ title }}

Atrio Remote publishes RDP access to a Windows Server through the browser, in HTML5, with Windows authentication, two-step verification, SID-based authorization, sign-in customization and auditing.

It installs from a single offline MSI inside the Windows Server you want to publish. Whoever connects opens a browser, signs in with their Windows account — with a second factor, if the server's policy asks for one — and gets the desktop, or only the application released to them. No RDP client, no VPN, no plugin.

Administration happens in a local console on the server itself: published resources, permissions, HTTPS certificate, sign-in appearance, file transfer, printing, active sessions, licensing and the audit trail.

How the pieces fit

• Server: the Atrio Remote Windows service, with the HTTPS portal, the RDP engine (local only) and the embedded database.
• Administration console: an application on the server itself, talking to the service over a protected local channel.
• Portal: what people see in the browser — sign-in, resource catalogue, session and their own account.
• Print Client (optional): an application for the user's computer that brings printing to the local printer.

Windows Server integration

Each installation publishes resources from its own server using the existing Windows accounts and RDP services. Maintain the Microsoft licensing required for your organization’s users and sessions.

Where to go next

Check the requirements, understand licensing and move on to Install.

Atrio Remote is licensed by subscription, per concurrent connected user. The same user with the desktop and two applications open takes one seat.

• Seats are allocated per server, and can be reallocated.
• Activation is online, by code, done in the console.
• If the connection to the licensing service is temporarily unavailable, the product keeps operating during its grace period. Check the license status in the console.

Activate this installation

1. Open the administration console and go to Licensing.
2. In Activate this installation, paste the activation code you received.
3. Click Activate. The state now reflects the license received.

The code is consumed once and gives the installation an identity of its own. Repeating the same code on the same installation only renews the license.

Follow the state

The Licensing screen shows the State, whether the installation Admits new sessions and the Allocated seats. The Renew now button forces an immediate renewal — useful right after opening the server's outbound access.

Without a valid license, the portal opens no sessions and tells whoever tries to sign in; the console shows the state and the log records it.

The installer is a single offline MSI with a five-screen wizard. Run it on the Windows Server whose RDP you want to publish, signed in as an administrator of that machine.

Steps

1. Before installing, check the SHA-256 checksum of the file you received — it is on the download page: Get-FileHash .\AtrioRemote-1.3.2.msi -Algorithm SHA256.
2. Run the MSI and accept the license agreement.
3. Choose the listening port (443 by default) and the listening address.
4. Choose the data directory (C:\ProgramData\AtrioRemote by default) and whether the installer should create the firewall rule.
5. Finish. The Windows service starts, and the administration console is available from the Start menu. At the end, the wizard may offer to restart the server now or later.

After installing

1. Activate the license — see Licensing and activation.
2. Publish the desktop and sign in for the first time — see First steps.
3. Replace the self-signed certificate with one your browsers trust — see HTTPS certificate.

On update

Port, listening address, data directory and firewall rule are preserved. See Update.

In a few minutes, from a freshly installed server to the first access through the browser.

1. Publish the desktop

1. Open the administration console from the Start menu.
2. In Published resources, click Publish resource.
3. Give it a Name (what people see in the catalogue) and choose the Kind Desktop.
4. Save. The resource appears in the list, marked Enabled.

2. Give someone access

1. Select the resource and go to Who has access.
2. Click Grant a user or group and type the name — for example SERVER\maria or COMPANY\Finance.
3. Click Check: the console shows the principal, kind and SID it found.
4. Confirm the grant.

3. Sign in from the browser

1. In Google Chrome or Microsoft Edge, open https://server-name/ (add the port if it is not 443).
2. With the installation's self-signed certificate, the browser shows a warning on the first visit. To remove it, use a trusted certificate.
3. Sign in with the granted account. The catalogue lists the released resources; click Open.

Done. From here, see how to publish applications and turn on two-step verification.

The administration console runs on the server itself and talks to the service over a protected local channel. It holds no state: closing the console affects nobody's access.

The ten screens

The console is available in Portuguese and English, with the language picked from Windows and a button to switch.

A resource is what appears in the user's catalogue. It can be the server's full Desktop or an Application, opened by initial program.

Publish an application

1. In Published resources, click Publish resource.
2. Enter the Name and choose the Kind Application.
3. In Initial program, enter the executable's full path, starting from the drive letter — for example C:\Program Files\ERP\erp.exe. The console checks right away that the program exists at that path.
4. Optionally, tick Start maximized.
5. Save and grant access to the right people — see Authorize users and groups.

Start maximized

Use this option to request that an application start with a maximized window. The result depends on the application: programs with fixed-size windows or their own window controls may keep their original size. This option applies to application resources.

A user's first access to an application

The published application opens inside the person's Windows profile. If they have never signed in to that server, have them do a first desktop sign-in, which creates the profile. The console warns you when you grant someone in that situation.

Edit, disable and remove

• Clearing Enabled takes the resource out of the catalogue without deleting its grants.
• Removing a resource also deletes its grants.
• The catalogue is recomputed on every opening: the change applies the next time the person picks a resource.

Access is given by associating a resource with a Windows user or group. The grant is stored by SID, not by name: renaming an account does not change who has access.

Grant

1. In Published resources, select the resource and open Who has access.
2. Click Grant a user or group.
3. Type the name: SERVER\user, DOMAIN\user or DOMAIN\Group.
4. Click Check. The console shows the Principal, Kind and SID.
5. Confirm.

Windows remote logon

When you grant access, Atrio Remote adjusts the Windows remote logon permission for that account. If a local or domain policy denies log on through Remote Desktop Services, the product respects the policy and shows the reason in the console.

Remove access

Remove the grant from the Who has access list. The resource stops appearing in that account's catalogue from the next opening.

Domain accounts

A domain group counts exactly like a local group. For domain member servers, check the three environment settings in Support matrix.

With two-step verification, the portal asks, besides the password, for the six-digit code from an authenticator app — Google Authenticator, Microsoft Authenticator, Authy, 1Password or any other TOTP app.

Choose the policy

On the Second factor screen, under When the second factor is asked for:

The policy applies from the next sign-in. Changing the policy does not erase existing enrollments.

How people enroll

Enrollment is done by the person, in the portal, by clicking their own name — see Enroll in the second factor. The secret reaches their app without passing through anyone else.

Enrolled accounts

The Enrolled accounts list shows each Account, when it was Enrolled on and its Last used time.

Someone lost their phone

Select the account and click Remove enrolment. From then on the account signs in with the password until it enrolls again. Removal exists only in the console, for security, and it is recorded in the audit trail.

The console manages the portal's HTTPS certificate. You can import a PFX, generate a self-signed certificate or adopt one already in the machine store. The swap takes effect without reinstalling and without dropping an open session.

The three ways

The screen shows the certificate in use: Subject, Issuer, Thumbprint, Valid from and Valid until.

How to check the private key

1. Open the certificate in the machine store and check the private key permissions.
2. Grant read access to the account the Atrio Remote service runs under.
3. Re-apply the certificate in the console and reload the portal in a new tab.

Certificate and Print clients

The Print Client pins the server certificate at enrollment. If a self-signed certificate is replaced, enroll the computers again. With a certificate from a recognized authority this is not needed — one more good reason to use one.

The Branding screen applies your customer's identity on top of the portal's sign-in screen. The default is the Atrio Remote identity; what you set goes on top of it.

Images

Logo, Background image and Tab icon, each through the Upload… button. PNG or JPEG, up to 4 MB. The product re-encodes the image before storing it; SVG is not accepted.

Colors

Primary (button and heading), Accent (focus and activity) and Screen background, in #RRGGBB form. The text over the primary color is picked automatically, light or dark, to keep it readable.

Text

Displayed name, Tab title, Welcome, Legal notice, Support and Footer. An empty field uses the product's text, in the visitor's language.

Languages and domain

• Languages: Portuguese, English and Spanish. With a single language offered, the switch button disappears from the portal.
• Initial language: pt, en or es. Empty lets the browser decide.
• Show the domain field on the login screen, for environments with domain accounts.

Reload the portal to see the result. Restore the product default goes back to the Atrio Remote identity.

File transfer moves files between the user's browser and the server, through the portal, over HTTPS. It starts switched off.

Configure

1. On the File transfer screen, tick Allow file transfer.
2. Under Where the files live, choose: In a product folder, deleted when the session ends or In the user's own folder, which outlives the session.
3. Under Allowed directions, tick Send files from the browser to the server and/or Download files from the server to the browser.
4. Save. The settings apply to sessions started from now on.

Limits

2 GB per file, 5 GB and 500 files per session. The console shows the limits in force on the installation.

Isolation

In the product folder, isolation between users is an NTFS permission the product applies. In the user's folder, isolation is that of the Windows profile itself, and the product never deletes it.

On the user side, see Send and receive files.

The Print Client takes printing from the session straight to the printer of the user's computer. Without it, printing keeps arriving as a PDF in the browser.

1. Install on the user's computer

Install AtrioRemotePrintClient-1.3.2.msi on the person's computer (Windows 10 version 1809 or newer). It starts with Windows and sits in the tray, next to the clock.

2. Enroll the computer

1. In the console, on the Print clients screen, click Issue enrollment code. The code is short-lived, works for one machine and is shown only once.
2. On the computer, click the tray icon and choose Inscrever este computador… (Enroll this computer).
3. Enter the gateway address (the portal address) and the enrollment code, and confirm.

3. Link the browser

In the tray, choose Vincular este navegador… (Link this browser). The portal opens and starts offering that computer's printers in the sessions opened on it. The sign-in screen shows the link, with Unlink next to it.

When a session asks for the printers, the person in front of the computer authorizes it from the tray.

Follow and revoke

Revoke takes that computer's printers out immediately, open sessions included.

The Active sessions screen lists who is connected through the portal: Who, Resource, Since, From, Authorized by SID and Connection.

Disconnecting or ending a session

Each action asks for confirmation, describing the consequence, and is recorded in the audit trail.

The Audit screen shows the trail of administrative changes on this installation, with who asked and what happened — refusals included.

• Only changes enter the trail; lookups do not.
• No secret is kept on the trail: passwords, second-factor secrets and enrollment codes are never recorded.

The service's operational log goes to the Windows Event Log — see Logs and Event Log.

This page is for people who use Atrio Remote day to day. Feel free to forward it to your users.

Sign in

1. In Google Chrome or Microsoft Edge, open the address your IT team gave you.
2. Enter the User and Password of your Windows account. If the screen shows Domain (optional), fill it in when told to. The user field also accepts DOMAIN\name and name@domain.
3. If two-step verification is on for you, the Verification code field appears: type the six digits from your authenticator app.
4. In the Available resources catalogue, click Open. Someone with a single resource goes straight into it.

During the session

• Resources goes back to the catalogue without ending the session; reopening the same resource returns to it. Opening another resource ends the open session, after asking for confirmation.
• End session ends the session on the server and closes the programs open in it.
• Clipboard, Print jobs and Files sit in the bar, when enabled.
• If the connection drops, the portal offers Back to resources.

Your account

Click your name at the top of the screen to set up two-step verification or change your password.

Two-step verification protects your account: besides the password, the portal asks for a code that only your phone generates.

Before you start

Install an authenticator app on your phone — Google Authenticator, Microsoft Authenticator, Authy, 1Password or another compatible app.

Steps

1. In the portal, click your name at the top of the screen.
2. Click Set up two-step verification.
3. Scan the QR code with the app. No camera? Type the key shown below the QR code into the app.
4. In Type the code the app shows, enter the six digits and click Finish.

From the next sign-in on, the portal asks for the code from the app.

Changed or lost your phone?

Ask the server administrator to remove your enrollment. Then enroll again with the new phone. For security, this is not done through the portal.

Through the portal you change the password of your Windows account — not just this portal's.

1. Click your name at the top of the screen.
2. Click Change password.
3. Fill in Current password, New password and Repeat the new password.
4. Click Change password.

The new password follows the length, complexity and history rules set in Windows or in the domain; if it does not meet them, the portal explains.

Print normally from inside the application. The document reaches you in one of two ways.

As a PDF, in the browser

The document appears in the portal's Print jobs panel, with Open and Download. Nothing needs to be installed.

On your computer's printer

If your IT team installed the Print Client on your computer, its printers appear inside the session and the document goes straight to paper. When a session asks for the printers, confirm in the window the Print Client shows next to the clock.

The sign-in screen tells you when the browser is linked to the computer's printers. Unlink undoes the link.

When enabled by your IT team, the Files panel appears in the session bar.

• To send, drag files onto the panel or click Choose files.
• To bring a file from the server, click Download next to it.
• Remove deletes the file from the folder; Refresh reloads the list.
• The panel shows the space used in the session.

The portal serves HTTPS on the port and address chosen in the install wizard — 443 by default.

• If the installer created the rule, it appears in Windows Firewall as Atrio Remote (HTTPS).
• The RDP engine listens on loopback only and needs no firewall rule.
• The Print Client uses the portal's own HTTPS port, as an outbound connection: nothing needs to be opened on the user's computer.
• The server needs outbound internet access for the license.

The data directory is chosen in the wizard — C:\ProgramData\AtrioRemote by default. It holds the local SQLite database, with the configuration and the audit trail.

• There is no external database to install or maintain.
• The Windows password is never written there, or anywhere else.
• Include the data directory in the server's backup routine.

The service writes its operational log to the Windows Event Log.

1. Open Event Viewer.
2. Go to Windows Logs → Application.
3. Filter by the AtrioRemote source.

There you find the service start-up — with the port it came up on —, license notices, engine failures and the detailed reason for errors the console summarizes.

• No secret goes to the log: masking is centralized.
• In the console, the Status screen shows the version, how long the service has been up and the RDP engine state.
• On the Print Client, the tray's log entry shows that computer's record.

To update, run the new version's MSI on the same server.

1. Check the SHA-256 checksum of the new installer.
2. Copy the data directory, as good practice before any update.
3. Run the MSI. The previous installation's answers — port, address, data directory and firewall — come pre-filled.
4. At the end, confirm the new version on the console's Status screen.

Print clients are updated separately, with their own installer, on each computer.

1. On the server, open Settings → Apps (or Control Panel → Programs and Features).
2. Select Atrio Remote and click Uninstall.

The Print Client is uninstalled the same way, on each computer where it was installed.

Find the situation you are experiencing and follow the steps to check your configuration and restore access.

Domain accounts: three environment settings

• Whoever signs in needs the Access this computer from the network right.
• The Allow log on through Remote Desktop Services GPO overrides the local setting.
• The domain controller must be reachable; local accounts still sign in with .\name.

See the full system requirements in Requirements.

Next page {{ nextLabel }} →