Session Targets ​

A session target is one machine users reach through a remote session, such as a domain controller over RDP or a Linux server over SSH. Each target belongs to a zone, whose tunnel agents carry its sessions. If you have not set up a zone yet, start with Remote Sessions Setup.

This page covers how you add and configure targets, and how you grant them to users through roles. To organize targets into folders for the users' Sessions page, see Session Target Folders.

The RDP and SSH Tabs ​

You manage targets under Admin → Sessions → RDP and Admin → Sessions → SSH. Both tabs work the same way, each for its own protocol. You can search by name or host, and filter by zone, folder and state.

The table shows each target with the following columns:

ColumnWhat it shows
TargetThe display name, with the host and port below it.
Zone and FolderWhere the target belongs, and where users find it.
Granted byThe roles that grant the target. A target no role grants is reachable by nobody.
Sign-inUser signs in, Automatic, or Automatic, password shown, with the username format for automatic sign-in.
SecurityIdentity pinned, Pins on first use or Identity unchecked. See Server Identity.
Data flowIcons for clipboard, file transfer and audio, with their direction. zone default means the target inherits its zone's settings.
StateRecorded or Not recorded, and Enabled or Disabled.

Add a Target ​

On the RDP or SSH tab, click New Target. The dialog has the following sections. Click Create Target to save.

Connection ​

FieldWhat it does
ZoneThe zone whose agents reach the target.
FolderWhere users find the target on the Sessions page. A folder grants no access.
Display nameThe name users see, such as DC One.
HostThe host name or IP address, such as dc01.corp.local. It must resolve to an address inside the zone's CIDRs.
PortPrefilled with 3389 for RDP and 22 for SSH.
Allowlist pinsOptional IP addresses or CIDRs, one per line or comma-separated. See Allowlist Pins.
EnabledA disabled target stays granted but cannot be reached, and leaves the zone's allowlist.
Turn off the RDP graphics pipelineRDP only. The first picture can appear sooner, but image quality and bandwidth use may be worse.

A host and port can have only one target in your tenant.

Terminal ​

SSH targets have a Terminal section with the Font, Text size and Colour scheme a session starts with. See SSH Terminal Defaults.

Sign-in and Security ​

Sign-in decides how the user gets into the target. See Sign-In Modes for what each option needs.

FieldWhat it does
Sign-inThe user signs in at the target, or Automatically, with a checked-out account.
SecurityRDP only. Negotiate (any), NLA, TLS or RDP (legacy). With automatic sign-in, only NLA and TLS are offered.
Username formatAutomatic sign-in only. sAMAccountName and domain, DOMAIN\user or UPN. The default is UPN for SSH and sAMAccountName and domain for RDP.
The target always asks for the passwordAutomatic sign-in on RDP only. Set it when a group policy forces a password prompt at logon. The account's policy must also allow showing the password.
Do not check the server identityAutomatic sign-in on RDP with NLA only. See Turning the Identity Check Off.

When you edit a target, this section also shows its Server identity. See Server Identity.

Recording ​

Record sessions is on for a new target. The user is told before a recorded session opens, and a stored recording cannot be deleted before its retention expires. See Session Recordings.

Session Features ​

A target takes clipboard, file transfer and audio from its zone while Clipboard is set to Inherit from zone. The hint below the field shows what the zone currently allows. Choose a clipboard value to override the zone for this target, and the File transfer and Audio fields appear. The target then uses its own values for all three, whatever the zone later changes. Set Clipboard back to Inherit from zone to follow the zone again.

The values are the same as for zones. See Session Feature Defaults and Session File Transfer.

Sign-In Modes ​

With The user signs in at the target, the target's own logon screen appears in the session, and the user signs in with an account they know. GrantFlow decides whether the user may open the session, and the target decides who may sign in.

With Automatically, with a checked-out account, GrantFlow signs the user in with a managed account they check out, and the user never sees the password. The account must be eligible for a role that grants the target. On the users' Sessions page, such a target shows Auto sign-in and the Check out & connect action, which checks out the account and activates the role in one step. Automatic sign-in is available for RDP and SSH targets.

On RDP targets with automatic sign-in, the Sign-in column shows Automatic, password shown when The target always asks for the password is set, because the target's own prompt then displays the password to the user.

Automatic sign-in needs the server's identity

Unless you turn the identity check off, GrantFlow sends a password only to a server that proves it is the one you pinned. Keep the identity check on for targets with automatic sign-in wherever you can.

Server Identity ​

GrantFlow checks the identity of every RDP and SSH target before a session goes through: the certificate fingerprint for RDP, and the host key for SSH. The check runs for both sign-in modes.

A new target has no identity pinned yet, and its Security column shows Pins on first use. GrantFlow reads the server's identity before the first session and pins it. The user who opens that session sees The server's identity was recorded for the first time, with the fingerprint. From then on, the column shows Identity pinned, and a server that presents a different identity is refused.

To pin an identity yourself, edit the target after you create it. The Server identity area shows the pinned value, or Not pinned yet:

  1. Click Read identity. GrantFlow connects to the server and shows the observed fingerprint or host key.
  2. Compare it with the value on the server itself.
  3. Click Pin observed identity to pin it.

When a server's identity changes legitimately, for example after a certificate renewal or a rebuild, pin the new one the same way. Or click Clear, and the next session pins the identity again.

SSH file transfer requires a pinned host key. See Pinned Host Key Required.

Turning the Identity Check Off ​

For an RDP target with automatic sign-in and NLA, you can select Do not check the server identity. Only NLA then protects the password: a connection redirected to another domain machine would receive it. The Security column then shows Identity unchecked.

A target can also have server checks turned off through the API. The Security column then shows Certificate unchecked or NLA off. The target dialog keeps these settings and points them out, but you can only change them through the API.

Allowlist Pins ​

By default, a target's host name may resolve to any address in the zone's CIDRs. Allowlist pins narrow that further: the host name must then resolve inside the pins as well. Leave the field empty to rely on the zone's CIDRs alone.

Pins belong to a host, so every enabled target on the same host must carry the same pins. A new target is prefilled with the pins of an existing target on the same host. If two enabled targets on one host disagree, the save is refused and names the other target. To change a host's pins, disable the other targets on that host, save the new pins on each target, and then enable them again. Changing a zone's CIDRs is refused when a target's pins would fall outside them.

Import Targets ​

To add many hosts at once, click Import on the RDP or SSH tab:

  1. Under Source, choose Paste a host list or Enter hosts manually. From the directory is not available, because the directory data GrantFlow syncs holds users and groups, not computers.
  2. Choose the Zone, and optionally a Folder for every imported host.
  3. Check the Port, which is prefilled with the protocol's default.
  4. Under Hosts, enter one host per line. To give a host a display name, add it after a comma, for example dc02.corp.local, DC Two.
  5. Choose whether to Record sessions to these targets, and click Import.

One import takes up to 500 hosts. A host that already has a target on that port in your tenant is skipped and keeps its settings and folder. Imported targets are enabled and use The user signs in at the target. To use automatic sign-in, edit them afterwards. Imported hosts join the zone's allowlist, which is delivered to its agents automatically.

Grant Targets Through a Role ​

Users never get a target directly. You grant targets to a role, and activating the role grants a session to every target it lists, for as long as the activation lasts. Approvals, access reviews and the audit trail therefore cover sessions the same way as any other access.

  1. Open Admin → Role Management.
  2. On the role, click the Session targets icon.
  3. Select the targets the role grants. They are grouped by zone, with REC on recorded targets and disabled on disabled ones.
  4. Click Save Targets.

Saving replaces the role's whole list. A role grants up to 200 targets. A managed account eligible for the role may have its password delivered to any of the role's targets that use automatic sign-in.

Removing a target from a role ends the live sessions that were opened through that role. The Granted by column on the RDP and SSH tabs shows which roles grant each target. For how roles work, see Role Management.

Disable or Delete a Target ​

To take a target out of use for a while, edit it and clear Enabled. It stays granted and keeps its settings, but users cannot reach it, and it leaves the zone's allowlist.

To delete a target, click Delete target on its row and confirm. Roles that grant it stop granting it. A target with a live session cannot be deleted: end the session first, or wait until it closes.

VNC Targets ​

The admin portal offers RDP and SSH targets. VNC targets can be added through the GrantFlow MCP server with session_target_add, with port 5900 by default. A VNC target always uses The user signs in at the target, and it has no server identity and no file transfer. VNC targets appear in a role's Session targets dialog, so you grant them like any other target, and they appear on the users' Sessions page. They do not appear on the RDP or SSH tab, so you view, change or delete them through the GrantFlow API.

Audit Events ​

Target changes and grants are recorded in the audit log:

EventWhen
Target Created, Target Updated, Target DeletedA target was created, changed or deleted.
Target ImportedTargets were imported.
Role Targets SetA role's session targets were saved.
Target Identity ProbedRead identity read a server's identity.
Target Identity Pinned, Target Identity ClearedA server identity was pinned, by an admin or on the first session, or cleared.
Target Identity Check ChangedThe identity check of a target was turned off or on.
Session Credential ReleasedA checked-out account's password was released for automatic sign-in. The event never contains the password.
Session Credential DeniedGrantFlow refused to release the password, and the session ended.
Session Credential RejectedThe target refused the password GrantFlow released. GrantFlow then rotates the account's password once, so the directory and GrantFlow agree again.

For the full list of audit events, see Audit Events.