SG SealGrid Athena Docs
Docs / Operations / Unattended Access

Unattended Access

By default, a WebRTC screen-share session waits for the person at the machine to approve it before the technician sees the desktop. That is the right behavior for helping a signed-in user — but it doesn't work for servers, kiosks, or lab machines where nobody is sitting in front of the screen. Unattended access is a per-agent designation that lets an authorized technician connect to a specific machine without the on-screen consent prompt. You turn it on for the machines that need it, from the console, the REST API, or PowerShell.

Unattended access applies to WebRTC technician screen-share. It changes whether the consent prompt appears — it does not bypass authorization: starting a session still requires the Operator or Admin role, and every session is recorded in the audit trail.

Attended vs. unattended#

Every screen-share session is one of two kinds. The difference is decided by the target agent's unattended designation, which the server reads before the session starts:

Attended (default)Unattended
On-screen consent promptShown — the session waits in Waiting for approval until the person at the machine approves.Skipped — the session goes straight from Connecting to Connected.
Best forAssisting a signed-in end user at their desk.Servers, kiosks, digital signage, lab and shared machines with no one at the console.
Authorization to startOperator or Admin — the same for both.
On-screen session indicatorShown while a session is live — the same for both.
Audit trailRecorded as a normal (attended) session.Recorded and flagged as unattended.

An agent is attended unless you explicitly designate it for unattended access. If the server can't read the flag for any reason, it treats the session as attended — the safe, consent-required default.

Unattended is not the same as headless. Skipping the consent prompt does not let a technician capture a screen when nobody is signed in. Screen sharing needs an interactive desktop, so a machine with no logged-in user still can't be captured — the session ends with a “no interactive user” reason even when unattended is enabled. Someone must be signed in (locked is fine) for the desktop to be shareable.

Turning it on from the console#

Open the target machine from the fleet list and find the Allow unattended screen-share toggle on its details page (in the agent-info section). Switch it on to designate the machine for unattended access, or off to require an attended consent prompt again. The change takes effect immediately and applies to the next session — there is no restart and nothing to install.

The toggle is shown only when both of these are true:

When you connect to a machine that has nobody signed in and isn't yet designated, the console offers a shortcut to designate it for unattended access on the spot, so you can set it up the first time you need it rather than hunting for the toggle.

What changes when it's on#

Unattended access covers WebRTC screen-share only. It does not change how RustDesk access, remote command execution, or the remote file browser work.

REST API#

The same designation is available over the REST API, so you can enable unattended access in bulk (for example across every server or kiosk) instead of clicking through each machine. It requires the Operator or Admin role and returns 404 when the agent ID isn't found. On success it returns the updated agent, whose allowUnattended field reflects the new value.

ActionEndpointRole
Set an agent's unattended designationPOST api/agents/{id}/unattendedOperator / Admin

The request body is a single boolean:

# Designate a machine for unattended access
POST /api/agents/550e8400-e29b-41d4-a716-446655440000/unattended
{ "allow": true }

# Require attended consent again
POST /api/agents/550e8400-e29b-41d4-a716-446655440000/unattended
{ "allow": false }

The response carries the updated agent, including its unattended flag:

{
  "success": true,
  "message": "Unattended remote access enabled",
  "data": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "hostname": "kiosk-01",
    "allowUnattended": true
  }
}

PowerShell#

The Athena PowerShell module exposes the toggle as a single cmdlet that accepts an agent from the pipeline, so you can designate one machine or fan the change across a whole collection or tag in one line. It requires Operator or Admin and supports -WhatIf/-Confirm.

CmdletWhat it does
Set-AthenaAgentUnattendedSets an agent's unattended designation: -Id <guid> and -Allow $true (skip consent) or -Allow $false (require consent). Returns the updated agent.
 
# Designate one machine for unattended access
Set-AthenaAgentUnattended -Id "550e8400-e29b-41d4-a716-446655440000" -Allow $true

# Require attended consent again
Set-AthenaAgentUnattended -Id $agentId -Allow $false

# Enable unattended for every machine tagged "kiosk"
Get-AthenaAgent -Tag "kiosk" | Set-AthenaAgentUnattended -Allow $true

Auditing#

Both changing the designation and using it are recorded in the audit trail:

Recommendations#

See also#

© 2026 SealGrid · sealgrid.ai · Sealed by design.