I was looking for a way to grant users under my account access to specific computers when they log into my ScreenConnect server with a ScreenConnect user account that I create for them. Many times I would be granting access to a single computer for a user that wants to access their computer at night from home. Additionally, there would often be overlap with a manager/owner that might want access to multiple or all computers at their office. FYI - I am an MSP with over 70 cliens and 1500 computers in ScreenConnect. After contacting ScreenConnect support they pointed me to this forum post.

By following the initial instructions in this post and creating a Session Group that uses the $USERNAME variable I was able to create a dynamic session group that gives users access to only the computers that I assign to them. I called the Session Group "My Computers". This is the Session Filter that makes this group dynamic:

CustomProperty2 LIKE '*' + $USERNAME + '*'



I then created a Role on the Admin --> Security screen that granted access to this Session group:



Here is a user I created called 'Test' with only this role assigned:



Now when the Test user logs in, they ONLY see the Session Group called "My Computers". When a different user logs into ScreenConnect they will see a completely different list of computers in the "My Computers" Session Group. Additionally, I can add as many different users as I want to the CustomProperty2/Remote Users field without ever having to go back and create a new Session Group or Security Role.



FYI - I have decided to standardize on the user's email address as their ScreenConnect username. That way there is no chance that a username that gets reused (employees come and go) would result in that new user having access to the old user's computers.

Edited by user Wednesday, May 20, 2015 2:02:19 PM(UTC)  | Reason: Not specified

Great solution, Quinn! I've decided to implement that method myself.

I've a related problem, though, that I'd like some help with. It concerns the "Build Installer" function. At the moment, I'm asking each user to enter, manually, their Windows login username in the "Custom Property 2" field. However, when there are hundreds of users, this manual process is cumbersome and mistakes can be made. So, I'm wondering whether there's a way to automate this whole process by reprogramming the installer—the .exe file—itself, such that each user merely needs to run the installer. Is this possible?

Cheers,
Simon

Edited by user Thursday, February 18, 2016 1:30:54 AM(UTC)  | Reason: Not specified

Cheers, Alex. I created the following batch script and that did the trick:



For the key, I replaced every occurrence of % with %%.

You will likely need to compare what you've set in the custom property value to what you have listed for the user account in AD - offhand, I believe it's going to pull the "User Logon Name" field under the Account tab.

Sorry for the confusion. I think you need to use $USERLOGINNAME instead of $USERNAME in the filter for that to work in LDAP. $USERNAME is mapped to the user's display name.

http://forum.screenconne...pressions.aspx#post34337

Edited by user Thursday, February 2, 2017 2:54:18 PM(UTC)  | Reason: typo :)

Update: USERLOGGINNAME had a typo....should be one "G" rather than two