ET Ducky changelog, October 4, 2026

These changes cover where remote control permissions are granted, keyboard shortcut capture in remote desktop, shell commands from Fleet Tools, documentation search, and two dashboard fixes.

New

• Fleet Tools has a Run as logged in user option for shell commands on Windows, which runs the command as the account signed in at the console. A machine with nobody signed in returns an error and the command does not run as SYSTEM.
• The Security documentation has an Execution Identity section that covers the Run as logged in user option in the live session shell, Multi-Agent Sessions, Fleet Tools, and the remote desktop shell panel.

Improved

• Allow Ctrl+Alt+Del and Allow viewing and control of the secure desktop, listed as per-agent settings in the October 1 changelog, are now granted in the Remote control capabilities card under Systems > Security, for the whole organization, a tag, or a single agent. A grant is reviewed and recorded the same way a detection rule change is, and the Remote Desktop section of the agent configuration dialog links to that page.
• Capture keyboard shortcuts in remote desktop switches the session to fullscreen and sends Alt+Tab, Ctrl+W, and Ctrl+T to the remote machine in Chrome and Edge. In other browsers it captures ordinary shortcuts and Alt+Tab stays on your own computer.
• Documentation search keeps your search when you open one of its results. The search is also kept in the page address, so a refresh or a copied link shows the same results.

Fixed

• Buttons and fields respond to clicks again in dialogs such as Script Repositories, agent details, distribution servers, automations, and invites.
• When the server refuses an action, the dashboard shows the reason the server gave.