Bring your Windows systems to the browser.

Session in the browser

Just open the portal and sign in. The desktop or application appears inside the browser tab, follows the window size and responds normally to keyboard and mouse.

• Back to the catalogue without signing in again: the Resources button in the session bar goes back to the catalogue and opens another resource without typing the password again. Reopening the same resource returns to the session you left.
• Ending a session: End session closes the session on Windows along with its programs.
• A session dropped by the network returns to Back to resources, not to the sign-in screen.
• The catalogue is recomputed on every opening: what was published or withdrawn applies immediately.
• Bidirectional clipboard.
• No RDP client, no VPN, no plugin on the device.

Publishing resources

Each person finds a simple catalogue with only the desktops and applications released to them.

• The full desktop of the host.
• A single application, by initial program: the person receives only that system.
• Start maximized, per resource: the product asks Windows to open the published application maximized.
• Each resource associated with a user or a group.

Authorization

You release each resource to Windows users or groups. Permissions use the account's SID, keeping grants consistent even when a name changes.

Deny by default: no resource appears to anyone until it is explicitly associated. A domain group counts exactly like a local group.

Security built on Windows

Users sign in with a local or domain Windows account, validated by the system itself. The password is not stored in a database, file or log, and access to the session uses a short-lived, single-use ticket.

Use the accounts and groups your company already manages. Windows validates the credentials, and Atrio Remote applies resource permissions using the account identifier (SID). For domain accounts, check the environment settings on the requirements page.

• The user field accepts DOMAIN\name, name@domain and .\name, for a local account on a domain-joined machine.
• Sign-in attempts are rate-limited per origin.

Two-step verification

Besides the password, the portal asks for the six-digit code from an authenticator app — Google Authenticator, Microsoft Authenticator, Authy, 1Password or any other TOTP app (RFC 6238).

• Three policies, chosen in the console: Disabled, Optional (for those who enrolled) and Required (for everyone).
• Enrollment is done by the person, in the portal: a QR code on screen, or the key to type in. The secret reaches their app without passing through anyone else.
• The first code is asked as confirmation — only then is the enrollment saved.
• The secret is protected at rest, and attempts are rate-limited per account.
• Someone who lost their phone asks an administrator: removing an enrollment exists only in the console, and it is recorded in the audit trail.
• Changing the policy does not erase existing enrollments.

Manage your account

By clicking their own name in the portal bar, people take care of their account without opening a ticket.

• Change their own Windows password, always presenting the current one.
• Enroll in two-step verification, in their own name.

Administration stays in the server’s local console, separate from the portal your team uses.

Printing

Two paths, and the second is optional. Printing from inside the session works from the very first access, with nothing installed.

• When the Print Client is not connected, the document is available as a PDF in the browser.
• The PDF is produced by Windows itself and passed along with no third-party converter.

Print Client

A lightweight app for the user's computer, with its own installer. It publishes that computer's printers to the sessions opened on it.

• Windows 10 version 1809 or newer.
• Tray icon: the person in front of the computer authorizes the use of their printers.
• Enrollment by single-use code, issued in the console, with a short validity.
• Outbound connection over the portal's own HTTPS port: no port opened on the computer, no inbound firewall rule.
• Print clients screen in the console: enrolled computers, the state of each one, and immediate revocation.

Sign-in customization

Logo, background image, favicon, three colors, display name, title, welcome text, legal notice, footer, support contact, domain field, default language and offered languages. Portuguese, English and Spanish.

Customization focuses on the sign-in experience your users see every day.

File transfer

Send and receive files through the portal over HTTPS. The feature starts disabled, and the administrator can enable each direction separately and choose between predefined safe destinations: a product folder, cleared at the end of the session, or the user's own folder, which outlives it.

• Isolation between users enforced by NTFS permissions.
• Limits of 2 GB per file, 5 GB and 500 files per session.

Your team enables only the flow it needs and keeps file destinations under control.

HTTPS certificate, from the console

Import a PFX, generate a self-signed certificate, or adopt one already in the machine store. Swap it without reinstalling and without dropping an open session.

Sessions and auditing

Active sessions are listed in the console with two distinct actions: Disconnect, which takes the person off the connection and keeps their work on the server, and End session, which closes the programs. Every administrative change lands on the audit trail — refusals included — with the operational log in the Windows Event Log.

Licensing

Subscription per concurrent connected user — the same user with the desktop and two applications open takes one seat.

• Seats allocated per server, and reallocatable.
• Online activation, by code, on the console's Licensing screen.
• If the connection to the licensing service is temporarily unavailable, the product keeps operating during its grace period. Check the license status in the console.
• Check the license status in the console and follow changes in the logs.

Atrio Remote licensing does not replace or waive Microsoft licensing (CAL/RDS).

Install and update

An MSI installer with a guided setup. Port, listening address, data directory and firewall rule are asked during installation and preserved on update.

• The wizard checks that the port is available and names the process using it.
• Server compatibility is checked before any file is copied.
• No manual prerequisite and no Windows feature to enable.
• Third-party licenses installed with the product, in their own folder: 32 components, with copyright notices and source code offers.

Everything runs on your own server

• One single Windows service hosts HTTPS, API, authentication, authorization, the WebSocket tunnel, the database and auditing — fewer parts, less to maintain.
• The console is a thin interface: it asks the service over an authenticated local channel and never touches the database. Closing the console affects nobody's access.
• The RDP engine is a native Windows process packaged with the product. No WSL2, no container, no VM, no Windows feature to enable.
• The engine is never exposed to the network: local interface only, and the supervisor refuses any address that is not loopback.
• The Print Client connects from the outside in, over the portal's own HTTPS port — no port opened on the user's machine.
• Local SQLite database — no database server to install, no external dependency.

Solutions

Which approach fits your team?

Browser-based access: Atrio Remote gives users a portal with their authorized applications. It suits teams that want simpler access to Windows systems without deploying an RDP client.

Windows Server installation: the installer includes the required components, and the local console brings together access settings, printing, branding and auditing.

Access by application: make the systems each person needs available through user or group permissions. If your environment also requires access to other network services, review those requirements with your IT team.

Ready to take a look?

Request the installer and tell our team how you plan to use Atrio Remote.