ConnectWise Control permissions management
ConnectWise Control offers granular control over who can access which machines and with what rights.
Available roles
| Role | Rights |
|---|---|
| Administrator | Full access — management of users, machines and settings |
| Technician | Connection to the machines in their group, file transfer, commands |
| Read-only access | View only — can see the screen but not control it |
Machine groups
Machines are organized into groups. A technician can be given access to certain groups only:
- ScreenConnect portal → Administration → Groups
- Create logical groups (e.g. "Paris Customers", "Production Servers", "HR Workstations")
- Assign machines to their groups
- Assign technicians to the authorized groups
Creating a technician user
- Administration → Users → Add
- Fill in: email, name, temporary password
- Assign the role and the accessible machine groups
- Enable 2FA (mandatory for technician accounts)
Granular permissions per session
For each session, configure:
- Keyboard/mouse control: Enable/disable
- File transfer: Upload, download, or both
- Clipboard access: Share or isolate the clipboard
- Remote printing: Redirection to a local printer
- Session recording: Enable for audits
Auditing and traceability
Portal → Reports → Session Logs:
- Who connected, to which machine, at what time and for how long
- Files transferred (name, size, direction)
- Commands executed (if enabled)
- CSV export for compliance audits (GDPR, ISO 27001)
Security best practices
- Principle of least privilege: each technician only accesses their own customers' machines
- Mandatory 2FA for all technician accounts
- Disable access immediately when an employee leaves
- Review the logs monthly
- Use dedicated groups per customer to isolate access
