The way organizations support and manage their devices changed permanently when work stopped happening in one building. Among remote-capable US employees, 52% now work hybrid and 27% work fully remote, which leaves only around a fifth fully on-site.
When a user needs help right now, a technician has to reach their screen and work alongside them. When a server needs patching fast, or a kiosk in another state stops responding, a technician has to reach the device with nobody there to open the door. These are two different jobs, and the remote access model that fits each one is different. That’s why we’ll explore the distinction between attended vs unattended remote access in this guide.
But before we begin, consider this: in our Emerging Threats in Remote Access Security 2026 report, which surveyed 323 IT professionals, 66% described themselves as very or extremely confident in their current security, yet 55% of those confident respondents had still experienced a remote access incident in the previous 24 months. The model you choose matters, yet how you govern it matters more.
This guide covers how attended and unattended access work, where each fits, the risks practitioners run into, and the controls that keep either model from becoming a breach.
What Is Remote Access?
Remote access is the ability to view and control a device from another location as though you were sitting in front of it. A support technician on one machine sees the screen of a target device, moves its cursor, runs diagnostics, and fixes the problem without traveling to it. The devices reached this way span desktops, laptops, servers, kiosks, point-of-sale terminals, digital signage players, and mobile endpoints across mixed operating systems.
A remote session is the connection itself, based on the authenticated and encrypted link between the technician’s viewer and the endpoint. Every remote access model is a different way of starting, authorizing, and governing that session. The two that matter for support and management are attended and unattended.
Attended Access (a.k.a. How Attended Remote Sessions Work)
Attended access is the model where the end user is present and grants the connection. The user is at the device, an issue arises, and they authorize the technician to step in. Because someone is physically present to approve entry and the user can watch what the support technician does, attended remote support carries an inherent layer of consent and visibility.
Sessions begin when the user generates a session code and reads it to the technician, or when the technician sends a request, and the user accepts a prompt.
RealVNC’s On-Demand Assist and HelpDesk handle this without anything pre-installed, so the technician generates a short-lived code, the user downloads a disposable app and enters it, and the session runs encrypted under the technician’s named account.
Attended Remote Support Solution Use Cases
Attended remote support is built for immediate help and collaborative troubleshooting, where the value comes from the user being in the loop.
The model also suits unmanaged and BYOD devices, where installing a permanent agent is neither appropriate nor allowed. Educational institutions and organizations supporting personal laptops lean on attended remote support precisely because it needs no standing footprint on the device.
When you evaluate an attended remote support solution, prioritize security concerns like:
- Consent that is explicit and visible
- Session codes that expire quickly
- Clear session logging so every interaction is accountable
- An intuitive interface your technicians and users can navigate under pressure
Done well, this combination improves customer satisfaction because help feels immediate and transparent. The main trade-off is availability, as attended access depends on the user being physically present to prevent any unauthorized entry.
Unattended Access, Explained
Unattended remote access is the model where a technician connects to a device without anyone present to approve it. It works through a lightweight agent installed on the target device in advance. Authorization is established once, during enrollment, and governed from then on by policy rather than by a live prompt. With RealVNC’s Device Access, enrolled endpoints stay reachable so IT teams can connect on demand.
Unattended support capabilities offer a base for proactive IT. Technicians can perform routine maintenance tasks remotely at any time without disrupting anyone. They can push updates during quiet hours and resolve non-urgent problems on remote systems without pulling a user away from their work. Unattended remote support reduces downtime and improves service delivery, which has a positive effect on operational efficiency.
Real-time monitoring and continuous monitoring of enrolled devices let teams catch problems on critical systems before they escalate, ensuring business continuity across the estate. The device types suited to it are the ones that are usually unattended by design, meaning servers, headless machines, kiosks, POS terminals, digital signage, and the distributed endpoint fleets that managed service providers maintain.
Unattended access is scalable for managing large environments in a way attended access is not. RealVNC’s unattended model helped the Kyrene School District manage over 12,000 workstations across 19 elementary and six middle schools, and it lets Boston Valley Terra Cotta keep manufacturing kilns and machinery running at 24/7 output by reaching devices before a production line stops.
Key Differences between Attended vs Unattended Access
Attended access is session-based and approved live by a user. Unattended access is agent-based and pre-authorized through policy. Everything else follows from that single distinction, as the comparison below shows.
| Dimension | Attended remote access | Unattended remote access | Best for |
|---|---|---|---|
| Session initiation | User generates a code or accepts a prompt | Technician connects to an enrolled agent | Attended: live tickets. Unattended: scheduled work |
| User presence | User physically present to authorize | No user required | Attended: user-facing. Unattended: headless systems |
| Authorization | Explicit consent per session | Established at enrollment, governed by policy | Attended: BYOD. Unattended: managed fleets |
| Deployment | Little or no pre-install | Agent installed in advance | Attended: ad hoc. Unattended: standing estates |
| Security emphasis | Consent and visibility built in | Strong authentication and access control essential | Both, with different controls |
| Scalability | Scales with available users | Scales to thousands of devices | Attended: helpdesk queues. Unattended: IT infrastructure |
| Typical use | Immediate, collaborative fixes for ongoing support | Used to provide routine maintenance and patch management | Match to the work, not the tool |
Those key differences all trace back to user involvement and user interaction:
- Attended sessions depend on both
- Unattended sessions are designed to run without either
Most mature IT teams and managed service providers do not choose one, but run attended and unattended access side by side and match each to the task in front of them.
Three Governance Gaps that IT Teams Worry About Most
- The first is the silent-access concern. When an agent grants unattended access, a technician can connect instantly to a machine that has confidential information on screen without the user being aware. Practitioners want the option of consent-on-connect even on unattended devices, so a user who is present can approve or reject entry.
RealVNC’s gatekeeping and Privacy Mode address this directly, because a session can be configured to prompt a logged-in user for approval, and the screen and input devices can be blanked and locked during work to keep sensitive data private. - The second is the orphaned-agent problem. When a relationship ends, an unattended agent left on a device becomes a live pathway that nobody is governing. This is exactly the risk CISA’s guidelines warn about when it recommends auditing directories for inactive and obsolete accounts.
- The third is the wrong-machine problem. At scale, unattended device lists built from raw hostnames collide, and duplicate or unclear names raise the risk of a technician connecting to the wrong endpoint. The safeguards are clear device naming conventions, grouping by client or location, and RealVNC’s ring-fenced devices, where only permitted team members can discover and attempt to reach a given endpoint.
Start Securing Sessions Using MFA, Encryption, and Auditing
Neither model is safe or unsafe on its own, as risk depends on the controls around the session. Unattended remote sessions carry the most risk because no present user is watching.
Our 2026 research shows organizations using open-source or free remote access tools, and unattended remote access tools of uncertain provenance, hit a 64% incident rate, nearly double the 33% among business-grade commercial solutions.
Teams running four or more tools reached 67%, against 28% for those running one. The through-line to maintain security is governance: a few well-chosen security protocols carry more weight than more tools.
- Multi-factor authentication is the baseline for any elevated session; our research found 67% call MFA a must-have and 67% have implemented it. CISA goes further, recommending just-in-time access and re-triggered MFA when an account pushes commands across many devices. RealVNC Connect enforces MFA and TOTP, supports single sign-on, and keeps remote session authentication independent of account authentication.
- End-to-end encryption keeps remote connections confidential across untrusted networks. RealVNC Connect uses AES-GCM 128- or 256-bit encryption with Perfect Forward Secrecy, so a session cannot be read in transit or reconstructed afterward, and every API call runs over at least TLS 1.2.
- Auditing closes the loop. Session logging and session recording show who connected, when, and what they did, keeping teams accountable and meeting compliance retention requirements.
Managed Service Providers Choices
For managed service providers, unattended access is the go-to operating model, as maintaining fleets across many client environments only works when technicians reach devices without coordinating with each end user.
Our research found MSPs the most security-mature segment surveyed, yet still unable to close the gap: a 53% incident rate, with misconfiguration involved in 54% of those incidents (the highest of any industry) and 42% running four or more tools. Robust capabilities are nothing without consistent controls across every environment. Two matter most:
- Role-based access control gives each technician only the permissions their work requires, so a junior engineer cannot reach a domain controller. RealVNC’s granular permissions can disable functions such as file transfer or copy-and-paste for a user or group.
- Vendor and third-party access needs its own governance, since standing supplier credentials are a recurring breach vector. RealVNC’s Code Connect grants outside parties temporary access through a code that refreshes every 120 seconds and cannot be reused.
How to Choose a Remote Access Solution
The choice between attended and unattended access is rarely either-or, because most organizations need both. The useful question is which remote access solution supports both models under one set of controls.
- Start with platform coverage. The solution should reach the operating systems and device types you run, from Windows, macOS, and Linux to Raspberry Pi and mobile.
- Confirm it delivers both attended and unattended workflows natively. Ad hoc help and standing device management should share one console, one permission model, and one audit trail with a secure solution.
- Verify the non-negotiable controls this guide has established (MFA, SSO, role-based access control, end-to-end encryption, session logging, and session recording).
- Weigh the vendor’s own track record. Check for independent, regular security audits, a published security page, a credible update cadence, then run a real trial against your own devices, remote locations, and approval workflows.
Try RealVNC Connect for free – Get our 14-day trial now (no credit card required).
Our Expert Recommendation (Govern Both)
Attended and unattended remote access are not competitors, but two workflows within remote support, and the strongest IT operations use both. Attended remote support fits immediate assistance via user-present help, where consent is built into the session on the host computer, and the user’s context speeds the fix. Unattended remote support fits enrolled devices, after-hours maintenance, patch management, and the scalable operations that managed service providers and enterprise IT teams run normally during business hours.
Frequently Asked Questions
What is the difference between attended and unattended remote access?
Attended remote access requires the end user to be present and authorize the connection via a session code or prompt. Unattended remote access uses a pre-installed agent so an authorized technician can connect without anyone present, governed by policy set at enrollment. Attended access is session-based for live troubleshooting, while unattended access is agent-based for routine maintenance.
Is unattended remote access safe?
Unattended remote access is safe when tightly controlled, but carries higher risk because endpoints can be reached without real-time user approval. The essential safeguards are multi-factor authentication, role-based access control, end-to-end encryption, session logging, and a disciplined off-boarding process that revokes and uninstalls agents when secure access should end.
When should IT use attended remote access?
Use attended remote access for live help desk support, user training, guided installations, and application troubleshooting, where the end user can grant consent and describe the problem. It also fits unmanaged or BYOD devices where a permanent agent is not appropriate, and compliance-sensitive environments where visible user approval matters.
Does unattended access require user permission?
Unattended access requires prior authorization through policy, device enrollment, or administrative setup, rather than approval for every session. Requirements vary by organization, jurisdiction, device ownership, and compliance framework, and some solutions can prompt a present user for approval even on unattended devices.
How does remote access affect MSP pricing?
MSP pricing varies between session-based and agent-based models, and whether it is charged per technician or per endpoint. Unattended access usually supports scalable 24/7 management across large fleets on per-endpoint models, while attended support aligns with ad hoc, session-based helpdesk work.
