What Is Unattended Access? How It Works, and How to Set It Up Safely.

Unattended access is the feature that makes remote support actually work — and the one most likely to appear in an incident report if you configure it carelessly. It is worth understanding properly rather than toggling on.

The plain definition

Unattended access is remote access to a computer when nobody is sitting at it to let you in.

The permission did not disappear. It moved. Instead of someone clicking Allow at the moment you connect, the authorisation happened earlier — when an agent was deliberately installed on that machine by someone with the authority to install it.

That is the whole concept. Everything else is mechanics and controls.

Attended vs unattended, side by side

Most IT teams need both, which is why "does it include unattended access, and at what price" is the single most useful question to ask a vendor. It is also the most common cause of a surprise renewal, because several tools license unattended endpoints separately from technician seats.

What you actually use it for

• Servers and infrastructure — the machines that have no user by definition.
• Out-of-hours work — patching, upgrades and reboots scheduled deliberately for 2am.
• Back-office and shared machines — the reception PC, the warehouse terminal, the point-of-sale box.
• Remote sites — the office with no on-site IT, where "can you go press the power button" is a two-hour round trip.
• Devices whose user cannot help — a kiosk, a digital sign, a machine in a locked room.

If none of those describe your work, you may genuinely not need unattended access, and you can buy a cheaper attended-only tool. That is worth checking before paying for it.

How to set it up — the pattern that is the same everywhere

Vendors word their menus differently and rename things between versions, so here is the sequence rather than a click path. It holds for TeamViewer, AnyDesk, Splashtop, Zoho Assist, ScreenConnect and Remote Login alike.

1. Get to the machine first. Physically, or in an attended session. You cannot bootstrap unattended access without one of those.
2. Install the persistent agent — not the one-time runtime applet. These are different downloads in most products, and installing the wrong one is the most common reason "unattended access doesn't work".
3. Assign the device to your account or organisation. This is the step that makes it yours rather than a machine with a password on it.
4. Choose the authorisation method. Prefer account-based access — the device trusts your technician accounts — over a shared unattended password. More on why below.
5. Grant OS-level permissions. On macOS this means Screen Recording and Accessibility, granted manually on that machine. Skipping this produces an agent that connects but cannot control anything, which looks like a broken install.
6. Test with the machine logged out. This is the step people skip. Sign out entirely, then connect. An agent that works only while a user is signed in has not been configured for unattended access — it has been configured to look like it was.

Tool-specific notes

• TeamViewer — unattended setup is part of the host installation and ties the device to your account. Searches for "setting up unattended access TeamViewer" usually land on people who installed the QuickSupport applet instead of the Host; check which one is on the machine before troubleshooting anything else.
• AnyDesk — unattended access is enabled by setting unattended access in the agent's security settings, either with a password or via the address book on a licensed plan. The password route is quick and is the one worth moving away from.
• Splashtop — the streamer is the persistent agent; deploy it and assign the device to your account.
• Zoho Assist — unattended devices are licensed separately from technician seats. Deploy the unattended agent and confirm your licence covers the device count, not just the technicians.
• Chrome Remote Desktop — supports unattended access to your own machines with a PIN. There is no multi-technician management, no client separation and no audit trail, so it is not a professional support option even though it technically does the thing. See the free options compared for where that line sits.
• Remote Login — devices are authorised into a client organisation and reached by named technicians. Consent is still shown on the device and sessions expire on a fixed window. How consent, expiry and authorisation work is documented in full.

The security part, which is the actual point

An unattended agent is a permanent, authenticated path into a machine. Attackers know this, and remote access tooling is a well-established intrusion route — which is why it belongs in the same conversation as ransomware protection.

Six controls, roughly in order of how much they matter:

1. MFA on every technician account. If unattended access is protected only by a password your technician reuses, your fleet is protected by that password. This is the single highest-value control on the list.

2. Per-device authorisation, not one shared password. A shared unattended password is a single secret that unlocks everything, cannot be rotated without touching every machine, and leaves with any technician who resigns. Account-based authorisation revokes centrally in one action.

3. Session expiry. An access window that closes on its own limits what a stolen session can do. Indefinite sessions are convenient right up until they are not.

4. An access record the technician cannot delete. Who connected, to which machine, in which organisation, when. If a technician can clear it, it is not a record — it is a convenience feature.

5. A real offboarding step. When someone leaves, their access to every unattended device must be revocable in one action. If offboarding means visiting machines or rotating a shared password, it will not get done completely.

6. Least privilege on the endpoint. The agent should not run with more rights than the support work requires, and unattended access should be scoped to the devices that genuinely need it — not applied to the whole fleet because it was easier.

Unattended access and consent are not opposites

There is a persistent assumption that unattended access means covert access. It does not, and tools that treat it that way create problems that are not technical.

In a well-designed setup:

• The device owner authorised the agent knowingly, and that authorisation is recorded.
• A visible indicator shows a session is live, even with nobody at the keyboard.
• The connection is written to a record that survives the session.

A support tool with a genuinely invisible mode is not giving you a capability, it is giving you a liability — the kind that becomes an HR complaint or a regulatory question. "Nobody clicked Approve this time" and "nobody can ever know" are very different properties, and only the first one is unattended access.

How much it costs, and why that varies so much

This is where unattended access stops being a technical topic and becomes a budget one. The models in the market:

• Included, unlimited — ScreenConnect includes unlimited unattended agents at every tier.
• Included within an allowance — Remote Login includes 100/250/unlimited devices per technician seat depending on plan.
• Licensed separately — Zoho Assist and others license unattended devices independently of technician seats.
• A pricing variable among several — TeamViewer's total moves with users, connections and devices together, which is why its price is hard to quote.

If your device count is growing and your technician count is not, the third and fourth models are the ones that produce the renewal surprise. We work the numbers through in remote support software pricing.

Where to go next

• Remote desktop software for IT support — the full buyer's guide, organised by licensing model
• 7 TeamViewer alternatives — if the tool you have is the problem
• Remote support software pricing — what each model actually costs
• Ransomware protection for small business — why exposed remote access keeps appearing in incident reports

Setting unattended access up correctly across a fleet — MFA, per-device authorisation, offboarding that actually works — is something we do as part of IT support and cybersecurity engagements. If you would like yours reviewed, get in touch.