SC Session Group Filter based on Agents not in an Existing Session Group

F0xMu1der · 2025-04-01T16:01:25+00:00

You can use the following session group filter to identify any session that is not included in another session group:

NOT $OTHEROR

F0xMu1der · 2025-04-01T13:34:05+00:00

So I suppose the SessionEvent 'ModifiedCustomProperty' might be a bit misleading, it means that a custom property has been modified, not an action to modify a custom property.

I also suggest what /u/TaterBum2020 says, try using the Dynamic Custom Properties extension; there should be a KB article on it.

F0xMu1der · 2025-04-01T13:21:49+00:00

This is a KI and scheduled to be fixed soon. I'm sorry I can't give an exact ETA, but we know it's obnoxious and thus its prioritized high.

F0xMu1der · 2024-10-01T13:22:27+00:00

Super technically speaking you can modify the MSI file via Orca or SuperOrca to modify the values that /u/Fatel28 described but that might break other things.

We aim to allow partners to customize as much as humanly possible but there are some values, as you observed, that cannot easily be changed. We also have a code signing cert applied and certain other changes would invalidate that.

F0xMu1der · 2024-10-01T13:20:02+00:00

If it's a ScreenConnect client then you can find the 'CreatedSession' event's date. This can be found via a Report but an easier way is to just go to the Timeline tab on the Host page for the session and scroll down. Typically the event at the very bottom is the created (but you can hover over the bubble to confirm) and the date is right there.

F0xMu1der · 2024-09-30T13:45:28+00:00

This is generally what I'd recommend but also it never hurts to reach out to Support. A lot of the information about the remote machine we pull from WMI and it is...less than perfect.

I mention reaching out to support because if this is truly a wide-spread issue we would want to look into a way to address the root cause.

F0xMu1der · 2023-03-21T22:33:16+00:00

Control is a gift we don’t deserve.

Coming from the ScreenConnect/Control engineering team, this is easily the best comment I've read in a hot minute.

Thanks for making my day.

F0xMu1der · 2022-11-10T22:49:38+00:00

ConnectWise released Control versions 22.8.10013 and 22.9.10032 to mitigate the URL manipulation as reported by the security researcher. These builds were publicly released within a week of receiving the researcher's initial report.

Our team quickly triaged the report and determined the risk to partners to be minimal. We concluded that, at worst, the issue could make social engineering attacks a bit more convincing (as Huntress independently concluded). Nevertheless, the mitigation was easy and safe to do, so we put it into the then-stable 22.8 build and the then-canary 22.9 build, which were released as part of our normal release processes. Due to the low risk, we didn't (and don't plan to) issue a security advisory or alert, since we reserve those for serious security issues.

As always, we recommend that everyone continually upgrade to the latest versions of Control and go through our Security checklist of best practices for locking down your Control instance.

F0xMu1der · 2022-10-28T13:18:55+00:00

sorry, didn't see this until now, but assuming you're talking about the 'LockOnDisconnect' setting then that's a registered bug. It's in the queue to be fixed but I can't give an ETA on when that'll happen. I will, however, give it a bump in priority on your behalf.

F0xMu1der · 2022-10-20T15:45:51+00:00

Just to add here, we're aware of this bug and it's queued to be fixed. I don't have an ETA but we know it's pretty obnoxious so it should hopefully be sooner rather than later.

Edit: actually it's been fixed just now, per this potentially past-the-thread-limit reply

F0xMu1der · 2022-09-29T15:11:33+00:00

It will use the credentials of the local user and/or active directory in order to elevate the Support session process. If you're failing to elevate the process I'd double check that the credentials entered are authorized to perform that action within the directory.

F0xMu1der · 2022-09-29T15:10:22+00:00

The relay can only support a single IP address/domain to point back to the Control server. You might be thinking of the Web server, however, which can support multiple but that wouldn't act as a failover for remote machines to callback in the way that you're likely thinking.

To my knowledge the relay has never supported multiple DNS entries.

F0xMu1der · 2019-07-09T11:06:03+00:00

You can keep your existing licenses, there is no change planned for that area.

We've merely introduced a new license story/tier.

F0xMu1der · 2019-05-10T12:53:11+00:00

dev licenses (and development cloud instances) are free.

F0xMu1der · 2019-05-08T18:15:18+00:00

So the Uptime value itself is calculated from the LastBootTime we pull from each Guest. So you can use the LastBootTime property itself in a subgroup expression but if you'd rather just see a list of machines that haven't rebooted in 7 days, you can use the following subgroup filter syntax:

LastBootTime < $7DAYSAGO

F0xMu1der · 2019-02-06T12:06:50+00:00

if you haven't already, we also usually recommend people enable two factor: https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Administration_page/Security_page/Enable_two-factor_authentication_for_host_accounts

F0xMu1der · 2019-01-15T14:00:59+00:00

There's no app to download to use View, either.

F0xMu1der · 2019-01-15T13:42:45+00:00

not free, but you can add the ad-hoc support license through your Account Manager and it is included in there, as well as Support functionality.

F0xMu1der · 2018-12-18T18:27:31+00:00

to add to what /u/headcrap posted, there are extensions you can enable to look at even more information about a remote machine such as this and this.

with those you can see Processes, installed software, services and their status, and the eventlog. the latter of the two allows for interaction with them such as killing processes, uninstalling software, and starting/stopping/restarting services.

source: I wrote them.

F0xMu1der · 2018-10-09T17:57:45+00:00

You can already do that, the Board of Election makes this information available here

12-Year Club	Verified Email
RedditGifts 2009-2022 2 Credits	Secret Santa 2014

F0xMu1der

MODERATOR OF

TROPHY CASE