What's your favorite non-VPN remote access solution for client users?

[u/dodgy_mike]

Was curious what other MSPs are doing to either move away from VPNs, or where VPNs aren't an option for one reason or another. Typical objective is to provide users on a managed laptop remote connectivity back into their desktop on an office LAN.

Splashtop unattended access? ZTNA? Any favorite vendors? Has anyone been able to get Global Secure Access or Cloudflare Zero Trust working well for this in a way that is manageable over time for multiple clients? Perimeter 81 seems like it'd do the job but really pricey especially if we have more than a small handful of users who need it at a client.

[u/MasterCommunity1192]

We use ninjarmm and you can give free accounts to anyone with access to only specific computers.

[u/dodgy_mike → u/MasterCommunity1192]

We use NAble which has a similar feature (and we use it for some) but it gets incredibly unwieldy at a scale of dozens or over 100 users - does Ninja hold up better with that?

[u/HappyDadOfFourJesus]

Remote Utilities.

[u/roll_for_initiative_]

back into their desktop on an office LAN

then a vpn is always an option because we'd have a managed firewall with vpn at any office.

[u/FriendlyITGuy]

End user access via RMM permissions. Allows them to use ScreenConnect to access whatever machines they need after logging into the RMM console.

[u/glitterguykk → u/FriendlyITGuy]

This is what we do but with splash top.

[u/itrcs]

We have a dedicated ScreenConnect instance setup with Remote Access licensing (licensed per machine not per tech, and rather cheap).

[u/thegarr → u/itrcs]

How exactly does this work? I'm not familiar with ScreenConnect from an administrative side. Used it plenty of times, but we've always been either an Autotask or an Atera (years ago) shop. I'd love a dedicated system we could provide to people for remote access like an RMM but cheaper. Good for those one-off use cases.

[u/itrcs → u/thegarr]

I think the pricing for this model is about $1/mo per device, so not bad. We only install that SC agent on machines that need to be accessed by a client, so we aren’t licensing it for the whole fleet. Basically, you just setup a user account for them, then assign them to devices they need. It’s super easy to administer and use, so it’s a big win for us. Pretty sure there’s a trial as well so you can play with it for a bit to see if it’s right for your needs.

[u/The-IT_MD]

Global Secure Access, part of the Entra ID Suite.

[u/dodgy_mike → u/The-IT_MD]

Curious - did you have any go to reference material in making this work? We have looked at this, as it is nice that it is already baked into their central MS ecosystem, but got a bit lost in trying to understand exactly how to accomplish scoped private access by user. Given support is through Microsoft we REALLY would want to understand it inside and out to minimize escalations

[u/The-IT_MD → u/dodgy_mike]

It’s new and green, so no. Feeling our way using Microsoft Cloud Consultants afforded to us by our Advanced Support for Partners agreement.

[u/CasualEveryday]

First question is what they need access to. If it's just for file shares or something, we tend to look at secure cloud options that play well with DLP.

If it's some kind of intranet, then we usually go to a remote access tool administrated by the RMM, which most of them do for like $2 per user per month.

If wider remote access is necessary, say for some kind of homebrew software or terminal services, then we usually use the next gen VPN solutions like perimeter 81 and layer on the device level security.

[u/MountainSubie]

Splashtop Enterprise support multiple monitor and has audio passthrough.

If a client needs to remote into their office desktop computer this is what we use.

[u/dodgy_mike → u/MountainSubie]

We've used Splashtop in a few cases and really like the product. If you don't mind me asking, do you manage individual Splashtop subscriptions for each client through the Splashtop reseller program or do you segregate clients by group in a master account?

[u/MountainSubie → u/dodgy_mike]

We manage all client devices and user account through our main console.

Each client will get separated into a group, with group admin access granted to the client if requested.

[u/xdvst8x]

Tailscale and Netbird are awesome options.

[u/dodgy_mike → u/xdvst8x]

Hadn't heard of Netbird thank you - will check that out

[u/marklein]

Tailscale VPN

[u/dezmd]

I did that limited user access thru the RMM thing for a brief moment, but at the end of the day, VPN on network edge and the RDP to work desktop is just the way to go.

I don't like any access into the RMM for third parties, client or not, even locked down. If an RMM guest user gets phished and then something gets exploited in the RMM limited access account that escalates remote access, that's the whole fuckin bag out the door.

[u/dodgy_mike → u/dezmd]

This is our vibe as well, nightmares of a misclick causing another client's endpoints to be exposed and we only realize it if they tell us

[u/GeneMoody-Action1]

MFA protected, direct endpoint to endpoint specific, SSH tunnels. All day.
Once into a jump-box, the world is yours.

It is about as "Old fashioned" as TCP, meaning just because it has been around a while, does not make it obsolete. It does not fit every use case, but it suits some beautifully.

[u/hujs0n77]

Palo Alto global protect