Remote Desktop
Overview
ET Ducky’s browser-based remote desktop lets you view and control any online agent’s screen directly from the dashboard. No VPN, no VNC client, no RDP configuration, no firewall rules — just click “Remote” on any online agent and start working.
Remote desktop sessions run alongside existing features. You can have a live query session and a remote desktop session with the same agent simultaneously.
Starting a Session
- Navigate to the Agents page
- Click the Remote button on any online agent row (the button is disabled for offline agents)
- A fullscreen modal opens with a connecting overlay
- The server creates a session record and signals the agent via SSE
- The agent initializes screen capture and connects its WebSocket
- Once both sides are connected, frames begin streaming and the overlay disappears
Typical connect time: 1–3 seconds on LAN, 2–5 seconds on WAN.
Toolbar Controls
| Control | Description |
|---|---|
| Status Indicator | Color-coded dot: amber (connecting), green (connected), red (disconnected) |
| FPS / Bandwidth | Live readout of frames per second and data throughput |
| Quality | Dropdown: Low (30), Medium (50), High (70), Ultra (90). Adjusts encoding quality in real time |
| Scale Mode | Fit (maintain aspect ratio), Stretch (fill viewport), Native (1:1 pixels with scroll) |
| Display Picker | Appears when the agent has multiple monitors. Each display gets a button; click to focus one, or shift-click to add additional displays to the active set and span the canvas across them (see Multi-Display Sessions below) |
| Keyboard Grab | Toggle to capture browser shortcuts (Ctrl+Tab, Alt+F4, etc.) and send them to the remote system |
| Fullscreen | Enter true browser fullscreen for an immersive experience |
| Disconnect | End the session, release all resources, and close the modal |
On a phone or tablet the toolbar is replaced by a single bottom control bar with the same capabilities — see Controlling from Your Phone below.
Input & Clipboard
Mouse
- Mouse movement, left/middle/right click, and scroll wheel are all forwarded to the remote agent
- Coordinates are normalized (0.0–1.0) and translated to absolute screen coordinates on the agent via SendInput
- Mouse move events are throttled to 60/second to prevent overwhelming the connection
Keyboard
- All key presses are captured using browser
KeyboardEvent.codevalues and mapped to Windows virtual key codes - Modifier keys (Ctrl, Alt, Shift, Win) are tracked independently to prevent stuck-key issues
- Enable Keyboard Grab in the toolbar to intercept browser shortcuts and forward them to the remote system
- All held modifier keys are automatically released when a session ends
- Ctrl+Alt+Del cannot be sent as three key presses. Windows reserves it, and no software can produce it through ordinary input injection. ET Ducky routes it to the operating system's own secure attention API instead, which requires the capability to be enabled on the agent first. See Sign-in screens, UAC prompts and Ctrl+Alt+Del below
Clipboard
- Text clipboard syncs bidirectionally between browser and agent
- Agent monitors clipboard changes via
AddClipboardFormatListenerand pushes updates instantly - Browser clipboard access requires page focus (Clipboard API security requirement)
Sign-in Screens, UAC Prompts and Ctrl+Alt+Del
The Windows sign-in screen, the lock screen, the Ctrl+Alt+Del screen and UAC elevation prompts are all drawn on what Windows calls the secure desktop. It is a deliberately sealed surface: only the operating system itself may draw there or read input from it, which is precisely what makes it trustworthy to type a password into.
That seal applies to remote control too, so these screens behave differently from the rest of a session, and how they behave depends on what the agent has been allowed to do.
By default: the screen freezes
With neither capability enabled, a UAC prompt or a lock screen stops the session in place. Your view holds the last frame of the user's desktop, and anything you type or click goes nowhere. The session is still healthy and it recovers by itself the moment the prompt is answered at the machine. This is the default on every agent and it is not a fault.
Allow Ctrl+Alt+Del
Enabling Allow Ctrl+Alt+Del on the agent lets you raise the secure attention sequence, which is what you need to reach the sign-in screen, the lock screen or Task Manager's own entry point on a machine sitting at a locked desktop. On the phone control bar it appears in the quick-keys strip as a single Ctrl+Alt+Del button; from a keyboard the combination is intercepted and routed for you.
The button stays hidden until the agent reports that the capability is available, so if you do not see it, the setting is off on that agent or the agent service has not restarted since it was turned on. Enabling it also sets a machine-wide Windows policy on the host; the Security page describes exactly which value and how it is reverted.
Allow viewing and control of the secure desktop
Raising the screen and being able to use it are separate permissions. The second switch, Allow viewing and control of the secure desktop, is what lets you actually see the sign-in screen and type into it. With it on, the frames you see while a secure desktop is up are captured by a component with the privilege to read that desktop, and your keystrokes and clicks are delivered to it.
With it off, Allow Ctrl+Alt+Del on its own will raise the screen on the remote machine, but your view will freeze exactly as described above and you will not be able to answer it. The two are meant to be used together.
This is a significant permission and it is off by default. It means an operator with remote desktop access can enter credentials at the sign-in screen and approve elevation prompts on that host. Enable it where you would be comfortable handing someone the physical keyboard at the lock screen. Keystrokes are never written to any log, on the agent or in the cloud.
Where to set them
Both are granted in the Remote control capabilities card under Systems → Security, for the whole organization, a tag, or a single agent. Granting one is reviewed and recorded the same way a detection change is. The Remote Desktop section of the agent's configuration links to that page. Changes take effect when the agent service next restarts.
Controlling from Your Phone
On a touch device the session switches to a mobile layout automatically: the desktop toolbar folds into a single control bar at the bottom of the screen (within thumb reach), the view starts at the top of the remote screen, and frames render at your phone’s full native resolution. The first tap enters fullscreen, and fullscreen switches to landscape automatically on Android — even if your phone’s rotation lock is on (on iPhone, rotate the phone manually). While a session is open, the phone’s back gesture and pull-to-refresh are disabled so a stray swipe can’t end the session — leave with End.
Pointer modes
| Mode | Behavior |
|---|---|
| Trackpad (default) | The screen works like a laptop trackpad: glide anywhere to move the virtual cursor, tap to click. Precise — best for ordinary desktop UIs. |
| Tap | Touches act directly at the point you touch. Best when zoomed in, or for kiosk-style UIs with big targets. |
Switch modes any time with the Trackpad / Tap button on the control bar; your choice is remembered.
Gestures
| Gesture | Action |
|---|---|
| Glide one finger | Move the cursor (trackpad mode) / move the pointer under your finger (tap mode) |
| Tap | Left click — tap twice for a double-click |
| Tap, then tap and hold | Drag: the left button stays held while you glide — select text, move windows, drag files. Released when you lift. |
| Hold still (∼0.7 s) | Right-click (trackpad mode; a short vibration confirms). Moving your finger cancels it — a gliding finger never right-clicks. |
| Two-finger drag | Scroll (mouse wheel) |
| Two-finger tap | Right-click (trackpad mode) |
| Pinch | Zoom the view 1–4× around your fingers; in tap mode a two-finger drag pans while zoomed. 1:1 on the control bar resets. |
The control bar
| Control | Description |
|---|---|
| Connection badge | Live FPS and latency, colored green / amber / red by connection quality |
| Trackpad / Tap | Switches pointer mode (table above) |
| 💬 Tools | Opens the session tools (Ask Ducky, Shell, Files) as a bottom sheet. Opening does not raise the phone keyboard; it appears when you tap an input field. Tap again (or the sheet’s close button) to give the remote view the whole screen back |
| ⌨ Type | Summons your phone’s keyboard for typing into the remote machine (including Backspace and Enter) |
| Ctrl⋯ Quick keys | A strip of keys phones lack: Esc, Tab, Win, arrows, Del, latching Ctrl / Alt / Shift for combos, and one-tap Ctrl+Alt+Del |
| 1:1 | Resets pinch zoom to fit |
| ⛶ Fullscreen | Toggles fullscreen (auto-landscape on Android) |
| ⚙ Settings | The desktop toolbar’s session controls: Quality, Scale Mode, the Display picker for multi-monitor agents, Keyboard Grab, and event-collection pause |
| End | Disconnects the session |
Performance & Limits
| Metric | Typical Value |
|---|---|
| Input latency | <50 ms LAN, <150 ms WAN |
| Frame rate (idle) | 1–5 FPS |
| Frame rate (active) | 15–30 FPS |
| Bandwidth — H.264 (idle) | ∼30 KB/s |
| Bandwidth — H.264 (active, typical) | ∼400–600 KB/s |
| Bandwidth — WebP/JPEG fallback (low quality) | 0.5–2 Mbps |
| Bandwidth — WebP/JPEG fallback (high quality, 1080p) | 2–5 Mbps |
| Capture method | DXGI Desktop Duplication (GPU-accelerated); GDI+ fallback for RDP sessions |
| Encoding | H.264 decoded in-browser via WebCodecs where available (hardware-accelerated, up to 30 FPS, dramatically lower bandwidth); WebP or JPEG with dirty-region encoding as the fallback when the browser lacks WebCodecs or the agent's H.264 encoder can't initialize |
| Max concurrent sessions | 2 per organization |
| Idle timeout | 15 minutes |
Adaptive quality: The encoder automatically reduces quality when bandwidth is constrained and increases it when headroom is available.
Troubleshooting
- Black screen after connecting: The agent may be in an RDP session where DXGI is unavailable. The agent automatically falls back to GDI+ capture, which may take an extra second.
- High latency or stuttering: Reduce quality to Low or Medium in the toolbar. Check network connectivity between the agent and the ET Ducky server.
- Keyboard shortcuts not working remotely: Enable Keyboard Grab in the toolbar to intercept browser shortcuts.
- Clipboard not syncing: Ensure the browser tab is focused. The Clipboard API requires page focus for security reasons.
- “Agent is not online” error: The agent must be online (green status) to start a remote desktop session. Check agent connectivity.
- “Maximum sessions” error: Your organization has 2 concurrent remote desktop sessions active. End one before starting another.
- The screen froze when a UAC prompt or the lock screen appeared. Expected unless Allow viewing and control of the secure desktop is enabled on that agent. Windows seals the secure desktop against everything but the operating system, so with the capability off there is nothing to show and nowhere for your input to go. The session recovers on its own once the prompt is answered. See Sign-in screens, UAC prompts and Ctrl+Alt+Del.
- No Ctrl+Alt+Del button on the phone control bar. The button appears only once the agent reports the capability. Check that Allow Ctrl+Alt+Del is on for that agent, then restart the agent service: the capability is evaluated at service start, not per session.
- Ctrl+Alt+Del raised the screen but nothing you type reaches it. The second switch is off. Allow Ctrl+Alt+Del raises the screen; Allow viewing and control of the secure desktop is what lets you use it.
- Linux (Wayland): you can see the screen but not control it. Agent versions before 2.5.9.6 asked the desktop portal to remember the input grant, which Wayland portals refuse for remote-desktop sessions — the portal answered by granting zero input devices instead of returning an error, so the session ran view‑only with nothing to explain it. Upgrade the agent. If it persists on 2.5.9.6 or later, the compositor itself is refusing input: check the agent log for
granted zero input devices. Accepting the on‑screen prompt is not the issue — a declined prompt fails the session outright, so if you have a picture at all, the prompt was accepted. Screen capture, file transfer and the shell are unaffected either way; only pointer and keyboard injection stop. - Linux (Wayland): the picture is frozen but the session is healthy. Wayland screen capture is change‑driven — a desktop where nothing is moving produces no frames by design, which is not a fault. Moving the mouse on the remote machine, or anything else that repaints the screen, resumes the stream immediately.
Multi-Display Sessions
On agents with multiple monitors, you can capture and control more than one display in a single session. Useful when you’re troubleshooting an app whose window crosses the bezel, or when you want to see a dashboard on one monitor while you click around on another.
Selecting displays
- The toolbar shows one button per monitor (e.g. Display 1, Display 2, Display 3).
- Click a button to focus that display — the canvas resizes to that monitor’s resolution and only that monitor is captured.
- Shift-click a button to add it to the active set. The canvas grows to span the union of selected monitors and the frame stream switches to a composite encoder that stitches them together server-side.
- Shift-click an already-active display to remove it from the set (one display always stays selected).
Input mapping
When multiple displays are active, mouse and keyboard input are routed using MOUSEEVENTF_VIRTUALDESK coordinates — coordinates map to the agent’s virtual-desktop space rather than a single screen. Click anywhere on the composite canvas and the cursor lands on the corresponding monitor on the remote host.
Performance impact
Each additional display roughly doubles the bytes-per-frame budget. On a low-bandwidth link, drop the Quality dropdown to Medium or Low before adding more monitors. The composite stream uses the same encoder pipeline (DXGI Desktop Duplication on Windows, x11vnc on Linux), so the per-monitor frame rate stays consistent.
Multi-display support is available in agent versions 2.0.1.2 and later, both Windows and Linux. Older agents will only expose a single display button until upgraded.