Overview
This article describes how to open a ScreenMeet screen sharing session with an endpoint from Tanium, and how attended and unattended connections behave on Windows and macOS. You can start a session from several places in Tanium; the options presented are the same in each.
Prerequisites
Access to the endpoint in Tanium.
Screen Sharing tools installed on the endpoint through Tanium Endpoint Configuration, unless connecting to an endpoint with no Tanium Client.
The endpoint included in the
Screen Shareaction group. The Open Screen Sharing button appears only for endpoints in this group. By default the action group is set toAll Computers.For unattended sessions, a role that includes the unattended permissions. See Screen Sharing User Role Permissions.
Where You Can Start a Session
You can open a session from the Tanium Home page endpoint search, from Shared Services > Direct Connect, from Reporting (the Computer Name column), and from Modules > Performance > Direct Connect. In each location, locate the endpoint and click Open Screen Sharing session, then choose the options described below.
Entry Points in Tanium
The exact navigation for each Tanium module is surfaced in the Tanium documentation at Tanium Direct Connect User Guide: Open an endpoint screen sharing session.
Session Options
After you click Open Screen Sharing session, the available options depend on your permissions and your Session Recording configuration:
Windows, with
Screen Sharing Support Session Unattended Execute: select Ask the endpoint user for permission to start an attended session, or clear it to start an unattended session. After an unattended session ends, the endpoint locks by default.Windows, with both unattended permissions: after starting an unattended session, select Automatically lock after session ends to lock the endpoint, or clear it to leave the endpoint unlocked.
Windows and macOS, with
Screen Sharing Product Options ReadandLet the Agent Decideset for Session Recording: select Record session to record, or clear it to run without recording.Click Open.
A Tanium action deploys an executable to the endpoint that connects to ScreenMeet services. Establishing the connection can take one to three minutes. For an attended session on an end user's computer, the user must accept the session to continue. When connected, your screen switches to ScreenMeet in Tanium, where you use Support Tools to run Windows commands, tasks, and tools.
Attended and Unattended Behavior
Connection | Platform | Behavior |
|---|---|---|
Attended | Windows | The endpoint user must accept the session. Control passes to the operator on acceptance. |
Attended | macOS | A view-only session is established first. The operator requests control, and the user must accept before control is granted. |
Unattended | Windows | A session is created without endpoint user permission; the operator takes control. The endpoint locks after the session unless autolock is disabled. |
Unattended | macOS | Not supported. |
macOS First-Connection Permissions
The first time you establish a session with a macOS endpoint, the endpoint user must grant ScreenMeetSupport the Screen Recording and Accessibility permissions in System Settings, then click Later when prompted.
Connecting to Mac Devices
More information is surfaced in the ScreenMeet documentation at ScreenMeet Documentation: Connecting to Mac devices.
Session Recording
Recording behavior is set in the ScreenMeet console under Organization > Settings and Policies > Remote Support Features > Session Recording:
Always: the session is always recorded.Let the Agent Decide: an operator withScreen Sharing Product Options Readchooses whether to record. If recording is on, users can disable it before joining.Never: the session is never recorded.
Windows Endpoint Considerations
PowerShell Constrained Language Mode
If PowerShell runs in ConstrainedLanguage mode, the signed session script <Tanium Client installation directory>\Tools\ScreenSharing\start-session.ps1 must be allowed to run in FullLanguage mode through Windows Defender Application Control (WDAC) or another system policy, or the session will fail.
If no user is logged in and you establish an unattended connection, the session may display a disconnection message after you enter operating system login information. Wait several seconds for login to complete and the connection to reestablish.
Verification
The ScreenMeet interface loads in Tanium and shows the endpoint.
For attended sessions, the endpoint user's acceptance is reflected in the session status.
If recording was selected, confirm the recording indicator is active.