I am interested to learn more about this different approach, Sergey. True unattended access to a session in progress is something we view as a requirement as well.

Ok that makes sense. It would just be a process adjustment on our end but overall better for the client as they would be knowingly granting session shadow access each time.

That is correct, when I remote in I see a windows lock screen and then have to log into windows on the endpoint. Is there a way to have it act more as a shadow session where we can see whomever is logged in at the time? I am thinking about remote support scenarios where users could get annoyed if our connection forces them to unlock their workstation every time.

I disabled the custom password option on the endpoint agent and found that I could get right in from the console. So now my question is, by disabling the custom password option, have I made the remote control agent less secure? We do have encryption enabled on the connection.