Remote Sessions
The Sessions page lists every RDP, SSH and VNC target that one of your roles can reach. A session opens in its own browser tab, through GrantFlow, so you need no VPN and no local remote desktop or SSH client. Each target shows its state, the role that grants it, and the action that connecting would take.
This guide covers how you find a target, start a session, send keys your keyboard cannot send, reconnect after a session ends, and open a second SSH session on the same target. To move files during a session, see Session File Transfer.
Find a Target
The filter bar at the top of the Targets list holds everything you need to narrow the list: the selection button, a search box for name or host, filters for protocol, zone and state, and the Cards / List toggle. The badge next to the filters shows how many targets match.
Choose What to Show
The first button in the filter bar names what the list shows right now, with its count, for example All targets 13. Click it to open the selection panel:
| Entry | What it shows |
|---|---|
| Favorites | The targets you starred. |
| Recently used | The last 10 targets you opened a session to, newest first. |
| All targets | Every target your roles reach. |
| Folders | The folders your administrator created, as a tree. A folder shows the targets in it and in its subfolders. |
| Unassigned | Targets that are in no folder. It appears only when there are any. |
The panel stays open while you pick, so you can click through several folders and watch the list change behind it. It closes when your mouse leaves it, when you press Esc or Tab, or when you click outside it or on the button again. On a touch screen, it closes as soon as you pick an entry.
A folder with subfolders has its own chevron. Click the chevron to fold or unfold the folder without selecting it, and click the folder name to show its targets. When you select a folder, a breadcrumb above the list shows its path, and each part of the path selects that folder.
The counts in the panel follow your search and filters, so a folder's count always matches what selecting it shows. A folder with no matches for the current search stays in the tree, dimmed, so the tree does not jump while you type.
Folders only organize the list
Folders, favorites and recently used change only how you find a target. They do not grant access, and you only ever see folders that hold a target you can reach. Access always comes from your roles.
Favorites
Click the star on a target to add it to your favorites, and click it again to remove it. Your favorites follow your account, so they appear on every device you sign in on. You can keep up to 100 favorites. When the list is full, GrantFlow asks you to remove one before you add another. A star on a target you can no longer reach still counts toward the 100, and you cannot remove it from the page, because the target is no longer shown.
The first time you open the Sessions page, it shows Favorites if you have any, and All targets otherwise. After that, it opens on the entry you picked last.
Recently Used
A target joins Recently used when a session to it opens successfully. A session that was refused or could not be opened is not added. Opening a target that is already on the list moves it to the top. If you lose access to a target, it disappears from the list.
Cards and List View
Use the Cards / List toggle to switch between a grid of cards and a table. Both show the same targets, with the same search and filters, and the same star and action buttons.
The card view shows more detail per target: the account a target signs in with, the time left in a running session, and the folder the target sits in when that is not the folder you selected. The list view fits more targets on screen, with columns for name, host, protocol, zone, role and state. On a narrow screen, the list hides the host, zone and role columns and shows the host under the name.
The page remembers your last selection and your layout for your account in this browser.
Start a Session
The button on each target says what connecting takes:
- Connect opens the session directly, because nothing else is needed first.
- Activate & connect activates the role first and then opens the session. See My Roles for how activation works.
- Check out & connect checks out the account the target signs in with and then opens the session. See Account Checkout.
- Request access sends a request for approval. An approved request does not open a session on its own: come back and connect. See Requests & Approvals.
- Choose how to connect appears when there is more than one way to reach the target, for example through two roles, so you pick the one to use.
If a session is recorded, the session tab tells you before it opens. A target with the REC badge is recorded, and a target with Auto sign-in signs you in with the account on that path, so you never see its password. A running session also appears on its target's card or row, where you can disconnect it.
The Connect Dialog
Activate & connect, Check out & connect and Request access first open a dialog that names the role, and the account if there is one, that the session goes through. It asks for two things:
- Duration: how long the access lasts, set with the slider or the Until time. It cannot exceed the role's maximum, or 8 hours when the role sets none. Below the slider, the dialog shows when the access expires. For a request, that time assumes an approval right now, because the clock starts when an approver agrees.
- Justification: why you need the access, at least 6 and at most 2,000 characters. It is required.
Confirm with the button that names the action. Activate & connect and Check out & connect open the session tab right away. The tab shows each step while it works, such as activating the role and, for Active Directory access, waiting until the change has reached the domain controllers the target uses. It then connects. Send request sends the request and leaves you on the Sessions page.
When the role behind a Check out & connect needs approval, the account is checked out to you right away and stays checked out while you wait. The session tab shows Pending approval and does not connect on its own: once the request is approved, the target turns ready on the Sessions page, and you connect from there. To give up, cancel the request in the tab, and check the account back in if the tab offers it.
Send Special Keys
Some key combinations never reach the remote machine, because your own operating system or browser keeps them. Ctrl+Alt+Del is the classic example on Windows. The Keys menu in the session bar sends these combinations to the session for you. In fullscreen, the same menu sits in the floating pill under Session.
Each entry shows what the combination does and its keys. On an RDP target, the entries are grouped as follows:
| Group | Entries |
|---|---|
| System | Security screen (Ctrl+Alt+Del), Lock (Win+L), Task Manager (Ctrl+Shift+Esc) |
| Windows & apps | Start menu (Win), Run dialog (Win+R), Switch window (Alt+Tab), Close window (Alt+F4) |
On an SSH target, the entries are the keys a shell needs, and the process control entries also name the signal the terminal sends:
| Group | Entries |
|---|---|
| Process control | Interrupt (Ctrl+C, SIGINT), End of input (Ctrl+D, EOF), Suspend (Ctrl+Z, SIGTSTP), Quit (Ctrl+\, SIGQUIT) |
| Editing | Delete word (Ctrl+W), Transpose (Ctrl+T), Next in history (Ctrl+N), Escape (Esc) |
At the bottom of the menu, Keyboard helper… opens a reference of what the session gets for the keys you press on your platform. Its test box shows what a key combination would send, without sending it, and its buttons send the same combinations as the menu.
Reach the menu from the keyboard
Press Ctrl+Alt+Shift (Ctrl+Option+Shift on a Mac) to move focus from the session to the session bar. Press Escape to give the keys back to the session.
Pointer and Paste
A session shows one mouse pointer: the pointer of the remote machine, which follows your mouse. Your own browser pointer is hidden while it is over the session.
In an SSH session, pasting does not release a Ctrl key you are holding. When you paste with a combination that includes Ctrl, such as Ctrl+Shift+Insert, or Ctrl+Cmd+V on a Mac, Ctrl stays pressed on the remote side until you let go of it.
Whether you can paste into a session, or copy out of it, depends on the clipboard setting your administrator chose for the target. On a recorded target, the recording notice tells you what the session allows.
Reconnect After a Session Ends
When a session ends, the tab shows why. If the connection dropped (Connection lost), or the session ended without a reason (Session ended), for example because you typed exit in a shell or signed out of Windows, the end screen offers Reconnect next to Close tab. Reconnect opens the target again in the same tab, through the same role or account.
What you get back depends on how the session ended. After a dropped connection to an RDP target, programs on the remote machine usually keep running, so reconnecting typically returns you to where you left off. After a dropped SSH connection, or after you typed exit, reconnecting opens a new shell. Signing out of Windows is different from a dropped connection: it closes the Windows session and the programs in it, so reconnecting starts a new Windows session and cannot restore unsaved work.
Reconnect is not offered when the session ended for a reason, such as your activation ending, an administrator ending the session, or a refused connection. A reconnect would only be refused again. It is also not offered after you click Disconnect yourself.
Duplicate an SSH Session
On an SSH target, the session bar has a Duplicate button while you are connected. It opens the same target in a new tab, through the same role or account, so you can work in two shells side by side. The new tab shows its own recording notice if the target is recorded.
The second session counts toward the session limits like any other: your own, the zone's and your organization's. If a limit is already reached, the new session does not open.
Duplicate is not available for RDP targets, because a second sign-in with the same account takes over the first Windows session.