Overview
Unattended sessions let a Tanium Console operator connect to a Windows endpoint without endpoint user permission. This capability is intentionally restricted. This article describes the permissions involved and how to build a custom role and persona that grants unattended access to a defined set of endpoints and users.
Prerequisites
Authority in Tanium to create custom roles and personas under Administration > Permissions.
Windows endpoints. Unattended connections to macOS endpoints are not supported.
No Default Role Grants Unattended Access
The default Integration Admin - ScreenMeet, Screen Sharing Agent, and Integration Viewer - ScreenMeet roles cannot establish unattended sessions. You must create a custom role.
Permissions
Permission | Effect |
|---|---|
| Establish unattended sessions with Windows endpoints. The endpoint locks after the session by default. |
| Leave the endpoint unlocked after an unattended session. Requires the Unattended Execute permission. |
Step 1: Create the Custom Role
From the Main menu, go to Administration > Permissions > Roles and click New Role.
Enter a Role Name, such as
Screen Sharing Unattended Role.Set Permission Type to
Allow.Select
Screen Sharing Support Session Unattended Execute.To allow operators to leave endpoints unlocked, also select
Screen Sharing Support Session Disable Autolock Execute.Click Save.
Step 2: Create the Persona
From the Main menu, go to Administration > Permissions > Personas and click New Persona.
Enter a persona Name, such as
Screen Sharing Unattended Persona.Click Manage Roles and select
Interact Basic User(for Interact access),Screen Sharing Agent(for screen sharing access), and your custom unattended role.Click Apply. The Permissions table shows the union of permissions from these roles.
Persona Combines Roles
The persona must include a role that grants screen sharing (Screen Sharing Agent) and Interact access alongside the unattended role, so the operator can both find and connect to endpoints.
Step 3: Scope the Persona
Expand Computer Groups, click Manage Computer Groups, select the groups containing the target endpoints, and click Select.
To scope by user group, expand User Groups, click Manage User Groups, select the group, and click Select.
To scope to individual users, expand Users, click Manage Users, select the users, and click Select.
Click Save.
Operators assigned this persona can establish unattended sessions with the scoped endpoints when the persona is active.
Scope Tightly
Restrict the persona to the smallest set of computer groups and users that need unattended access. This limits exposure if credentials are misused.
Where This Is Configured
Roles and Personas in Tanium
Custom roles and personas are Tanium Console constructs. More information is surfaced in the Tanium documentation at Tanium Direct Connect User Guide: Configure personas to establish unattended screen sharing sessions.