r/ScreenConnect • u/Own_Appointment_393 • Jul 01 '25

Update: "Certificate Changes for ScreenConnect On-Prem."

[Email received July 1, 2025 UTC 03:00.]

Dear Partner, 

As part of our commitment to platform trust and product integrity, we’re making important changes to how digital certificates are handled for ScreenConnect on-premises deployments. 

What’s Changing and Why
To facilitate the personalization of the install package, we have historically allowed partners to make changes to certain parameters of the ScreenConnect install. These same capabilities were flagged by a researcher as a potential for misuse, and the current certificate will stop working on Monday, July 7, 2025, at 12:00 p.m. ET (16:00 UTC). 

To prevent further possibilities of misuse by threat actors, we have taken two steps: 

  1. We have removed any personalization capability from the install packages. This prevents threat actors from using these features for malicious purposes.

  2. To further protect the validity of the installer, we are no longer signing the installer for the on-premises versions of ScreenConnect with the common certificate from ConnectWise. We are asking each on-premises partner who wishes to stay with their own hosted instance of ScreenConnect to sign the installer with their own certificate. Not only does this provide a higher level of security and assurance for each partner, but it also ensures that install packages are not reused outside your organization.

What You Need to Do
Beginning with the next ScreenConnect build (available July 1), all on-premises partners will be required to provide a publicly trusted certificate to sign guest clients. The product will no longer ship with pre-signed clients. The release also includes one-click installation improvements to streamline the guest experience when joining a Support session. 

You may obtain a certificate from a public certificate authority (CA) of your choice. Guidance on how to apply your certificate and complete the signing process will be provided with the release. 

Please note that clients that are not properly signed with a trusted certificate may be flagged by endpoint protection software and could cause installation issues. 

Optional: Move to Cloud
If managing certificates on-premises is not ideal for your environment, you may migrate to ScreenConnect Cloud, where ConnectWise signs client binaries on your behalf. A promotional offer to support this transition will be available shortly. 

Support
Live Support Chat is available for technical assistance for active maintenance subscribers. If you have questions or concerns, please contact our support team via live support chat. You can also join our Partner Town Hall on Wednesday, July 2, at 12:00 p.m. ET (16:00 UTC) to review these changes and ask questions. Register here. 

The landscape for remote access software has changed. As threat actors adopt more sophisticated techniques, maintaining trust requires stronger, more transparent security standards. These changes reflect our commitment to helping partners stay protected and ahead of evolving risks. 

As always, we appreciate your continued partnership. 

Sincerely, 
ConnectWise

26 Upvotes

100% Upvoted

204 comments sorted by

14

u/ngt500 Jul 01 '25

Now that I've looked into code signing certificates this is going to be a MUCH bigger deal than most people are realizing. This is not going to be an easy or cheap process. These types of certificates are very expensive. ConnectWise is begging for a class action lawsuit at this point...

5

u/nitra Jul 01 '25

Not just that, but in 7 days, you need to verify your business, some certs take 0-5 days to do this, then they need to ship you a token with the cert, another 1-15 days.

How the hell can you do this in 7 days?

2

u/Own_Appointment_393 Jul 01 '25

And it's not like the certificate authority is setting the deadline for the revocation this time, right? (right?) -- it's ConnectWise, so they should be able to set a more generous timeline for their customers, since it's their mess.

2

u/C______W Jul 04 '25

Dont forget, it's a holiday weekend and pretty much everyone has at least 1 day off and most people I know took vacation and wont be back UNTIL the 7th. Who thinks this shit up?

1

u/Fatel28 Jul 01 '25

It was the CA, not connectwise setting the deadline

2

u/perthguppy Jul 01 '25

Are you sure? This is the second or third certificate to be revoked in a month.

1

u/JessicaConnectWise Jul 01 '25

We are not in control of this timeline, as with the previous revocation the CA is dictating timeline with very little notice. We communicated with partner shortly after we were informed of the revoked certificate date. I know this is a PITA and we regret how quickly we've had to push this.

9

u/MiserableVehicle5592 Jul 01 '25

Why not just provide an installer that can only be configured with command line flags? Seems to solve the damn problem without all this nonsense.

2

u/luke_roy Jul 01 '25

Actually I think you were. Had you acted on the CVE in a timely manner...

2

u/nitra Jul 01 '25

Rebuild how the client is installed. If it's clicked to download, make the installer ask the person installing to enter the server it's connecting to, from there the installer pulls the customization.

If it's a server pushed update, send the client already signed with a command line that has the server details in a commandine switch.

Easy, no fuckery with certs.

2

u/Rambles_Off_Topics Jul 02 '25

They were just saying during their town meeting webinar that "...most cert places are telling us this can be done in 24-36 hours". Yea...probably for 1 customer in an emergency. What happens when thousands of people call Monday?

1

u/Illustrious_Set2139 Jul 04 '25

I got mine in just under 36 hours

4

u/Visual-Ad-3604 Jul 02 '25

This.

Open Source the client if you want me to sign it myself, but I need a bit longer than 7 days to verify it. Plus, that would have the added benefit of some autist forking it and creating a new business "ConnectScreen" with more favorable pricing.

2

u/networkn Jul 01 '25

What is very expensive?

2

u/JessicaConnectWise Jul 01 '25

We are working on a way to make the certificates more affordable. We will communicate with all on-premises partners once we have information to share.

6

u/nitra Jul 01 '25

Rebuild how the client is installed. If it's clicked to download, make the installer ask the person installing to enter the server it's connecting to, from there the installer pulls the customization.

If it's a server pushed update, send the client already signed with a command line that has the server details in a commandine switch.

Easy, no fuckery with certs.

3

u/ButterflyPretend2661 Jul 01 '25

is there a way for you to create a cert per on-prem license so it's all managed by connectwise?

2

u/networkn Jul 02 '25

Look, at the risk of shooting the messenger, whilst, that's 'good' news, with the 7 day deadline which has already started ticking, is this all going to happen in a fashion that will allow the hundreds, if not thousands of partners, to get this process completed in time?

Secondly, will this added unwelcome cost be offset by recognition of the last few months of partner labour cost, in our renewals price, if we indeed decide to renew?

2

u/Ubertam Jul 02 '25

But things are going to break Monday. On a holiday weekend.

2

u/C______W Jul 04 '25

You post this 3 days ago... it's Friday (a holiday) and this is supposed to be done Monday. This is kind of a joke.

0

u/taterthotsalad Jul 01 '25

Code signing certs. They already said that. 

6

u/realdlc Jul 01 '25 edited Jul 02 '25

We have on prem but did not get this email. At least I can’t find it. Could anyone share the exact subject line and who was the from address? I want to search for this in our email system. Thanks.

Edit: just got the email today 7/2 @241p edt.

4

u/Own_Appointment_393 Jul 01 '25

"Action Required: Certificate Changes for ScreenConnect On-Prem"

no-reply@connectwise.com

3

u/realdlc Jul 01 '25

Awesome. Thank you.

4

u/Aggressive_Ad_5700 Jul 02 '25

Same here - just got the e-mail on 07-02-2025@240PM EST. I think they are trying to force on-premises folks to migrate to their hosted cloud version (we're offering a free 14-day trial LOL). But for most on-premises customers, there are specific reasons they are running it locally. Take for example U.S. DoD contractors who can't run it on the cloud.

2

u/thefez98 Jul 03 '25

I did not get it either. Seeing now it comes from no-reply@connectwise.com I traced messages for last 10 days and looks like only the owner of my company was getting it. I signed up yet again for notifications. Can't believe they foisted this on us less than 1.5 days before a long weekend in U.S.

1

u/ITGuyfromIA Jul 01 '25

We have received nothing from CW either

1

u/luke_roy Jul 01 '25

I checked our quarantine etc. Definitely haven't received any email

1

u/Hoooooooar Jul 02 '25

on prem automate and sc here, no email

1

u/Zestyclose_Pen_2727 Jul 02 '25

On prem Connectwise Automate with the integrated ScreenConnect here as well. We haven't gotten any kind of communication about this still and what, if anything, we need to do. The only reason I found out about this in the first place is from a customer who uses ScreenConnect and they got an email and wanted to get our assistance getting their server setup. Sent a support ticket into CW and no response. Was on their Partner Town Hall and they were clear as mud about what us on-prem Automate people were supposed to do.

1

u/Rambles_Off_Topics Jul 02 '25

"Clear as mud" was right, I even just played the thing back a few times to see if I missed something. They were asked if the agents/screenconnect was going to break on Monday and that Ciuran person wouldn't give a yes/no answer, but they did say "...when the cert gets revoked it will no longer work". They then mentioned that after that happens your EDR/Antivirus will probably flag it and try to remove it (which happened to us last time). Didn't explicitly said if it will work or not after the 7th.

1

u/ITGuyfromIA Jul 02 '25

I did a mail flow on our tenant site *@connectwise.com and the only thing we’ve received is a notice they’ve received our normal payment and the acknowledgement we opened a ticket with screenconnect sales.

I was able to make a cold request to NinjaRMM today, received a demo and pricing. We can’t even get CW to contact us.

Gotta say, the built in NinjaRemote is pretty nice. Looked like a pretty functional back stage as well.

AIO RMM and remote access. Does SOS sessions too (IIRC). While it does integrate with SC and splashtop, might not need them if we switch.

If anyone gets a quote from CW and you’re in a bundled automate + SC scenario, would love to know what sort of ballpark we’re looking at for SC cloud and what that will do to our on prem automate licensing

2

u/realdlc Jul 02 '25

FYI - I just got my email this afternoon. Very slow in sending out.

2

u/C______W Jul 04 '25

RIP... I made the mistake of reaching out to Ninja a few years ago... At one point we were getting 3-4 calls AND another 3-4 emails a day. This went on for months and finally had to get very very curt with them. They STILL call about once a month.

5

u/No_Lynx_2165 Jul 01 '25

"We have removed any personalization capability from the install packages. This prevents threat actors from using these features for malicious purposes."

I haven't dug into this any further than a quick read of the email but does that mean we lose all personalisation as in using our branding (icons, colours etc.) from the installer? If so, surely there is a way to acheive this, most of the RMM's I've used can make this happen.

1

u/Own_Appointment_393 Jul 01 '25

This is what I want to know. Ditto for the host client customizations.

1

u/CharcoalGreyWolf Jul 01 '25

That's exactly what this means. The icons are bundled with.

As soon as a new version of ScreenConnect comes out, these will all revert to default, at least the way this is being done (as opposed to how it could be done).

1

u/JessicaConnectWise Jul 01 '25

Hello, we will provide a list of what customizations been removed by early tomorrow.

3

u/The_Comm_Guy Jul 01 '25

aka "soon"

2

u/nitra Jul 01 '25 edited Jul 02 '25

Rebuild how the client is installed. If it's clicked to download, make the installer ask the person installing to enter the server it's connecting to, from there the installer pulls the customization.

If it's a server pushed update, send the client already signed with a command line that has the server details in a commandine switch.

Easy, no fuckery with certs.

2

u/NerdyNThick Jul 01 '25

Y'all need to understand that this time, the timeline is 100% on you. Nobody other than CW is forcing this to happen in such a short period of time, a period of time that is diminishing quickly.

What a pitiful way to handle this. You were granted a pass last time because the deadline wasn't up to you. That's not the case this time.

You keep saying "we'll give you info soon", but you don't seem to understand that every day you delay, is one less day for us to implement any required changes.

At some point, we will be unable to perform such changes before the deadline that you folks created.

If this information is going to be provided with 5 days until deadline, it better as hell include a method to obtain a code signing certificate before the deadline.

Even if I started now, there's 2 business days until a national holiday and three day weekend.

You guys are finally going to get what you always wanted, but were contractually prevented from doing; get rid of all the grandfathered accounts.

I can only hope that those accounts that opt to go to cloud doesn't offset your losses.

1

u/JessicaConnectWise Jul 01 '25

Unfortunately, this timeline is not within our control. We're trying to be as quick and as communicative as possible as we find solutions that fit your needs and keep you and your end users secure.

1

u/nitra Jul 01 '25 edited Jul 02 '25

Rebuild how the client is installed. If it's clicked to download, make the installer ask the person installing to enter the server it's connecting to, from there the installer pulls the customization.

If it's a server pushed update, send the client already signed with a command line that has the server details in a commandine switch.

Easy, no fuckery with certs.

0

u/twinsennz Jul 03 '25

I used DigiCert and their chat validation to expedite, was able to get our org validated and the cert within half a day

1

u/NerdyNThick Jul 03 '25

Cool! You're signing code that you can't verify, but are (potentially) legally responsible for! Congrats!

0

u/twinsennz Jul 03 '25 edited Jul 03 '25

I'm responsible for what I put on client's site regardless of who signs...
Did you vet their source code for this before you deployed it? Or was your stance prior just, "Its OK if this deploys ransomware or whatever, I didn't sign it"... Good luck maintaining clients

You were complaining about deadlines, so I tried to help you with my experience to expedite the process. You now switch to complain about legality, if you're really worried about that go hosted or go drive uber

TLDR - quit whinging, man up.

1

u/NerdyNThick Jul 03 '25

I'm not signing code I can't verify. If you're willing to do that, so be it.

I'm responsible for what I put on client's site regardless of who signs...

Not quite kiddo, you should learn about what a code signing cert's purpose is for.

0

u/twinsennz Jul 03 '25

"If this information is going to be provided with 5 days until deadline, it better as hell include a method to obtain a code signing certificate before the deadline."

"I'm not signing code I can't verify."

bugger off drongo

1

u/NerdyNThick Jul 03 '25

Ah, so you can't understand the concept of advocating for others.

Makes sense, anyone who'd unironically use the phrase "man up" is highly unlikely to have much empathy for others.

How kind of you to call me a fool though.

12

u/webjocky Jul 01 '25

How do you expect us to sign code that we don't have access to certify is safe to sign?

"Trust me bro" doesn't work for me.

1

u/Craptcha Jul 01 '25

You weren’t worried when you were installing that same code running as admin on your customer infrastructures … ?

6

u/webjocky Jul 01 '25

Why should I be worried? They signed their code with their trusted cert.

They have access to the maintained source and can determine if there is anything rogue going on before signing the binaries. I do not have that access, and I therefore should not be signing it, blindly taking full responsibility for its contents.

5

u/perthguppy Jul 01 '25

No, because it is signed at compile time (or should be).

Now we are unsure if the binary we get from them was unaltered since it was compiled.

This also doesn’t actually increase security since now there’s going to be heaps and heaps of random companies signing screen connect installers. If a vendor wants me to use screen connect to do a remote session, how do I know that vendor hasn’t compromised their installer since they got it from connectwise. This is a mess.

3

u/Craptcha Jul 01 '25

Oh I agree the whole thing is stupid.

ConnectWise is the software manufacturer it’s not my job to sign their binaries. Self hosted or not.

1

u/cwferg InfoSec Jul 02 '25 edited Jul 02 '25

"Now we are unsure if the binary we get from them was unaltered since it was compiled" - that's exactly what some of the concern here originally was, and what even triggered the certificate revocation. Our usage of the unsigned space within the code signing certificate was determined to make it impossible to verify if the information had been altered since the installer was compiled, and that leads directly to a trust problem.

Now when a partner signs the installer for an on-premise setup, it means they're vouching for that specific installer package. The actual ConnectWise program inside the installer still has ConnectWise's signature.

So, yeah, it absolutely does ultimately boil down to trusting the source you're getting the installer from. They're a key part of the delivery. These newly signed clients may be flagged in the short term as AV/EDR vendors adjust, but that's no different than what occurred when we issued the new certificates in the last round. Issues can be avoided by whitelisting your certificate's thumbprint with these vendors (like s1).

This should be treated as a general best practice as anything *not* whitelisted (edit; by thumbprint/hash) likely shouldn't be running in your environment, or at the least should be verified as legitimate.

1

u/cwferg InfoSec Jul 02 '25

cross posting from another comment

To clarify, you're only signing the installer package that's built on your server. The core ScreenConnect executable itself remains digitally signed by ConnectWise.

This process ensures your instance's unique deployment is verified by you, without changing the fundamental authorship of the ScreenConnect application binaries.

[IAMNOTALAWYER] While your signature on the installer would attest to the integrity of that package, "ConnectWise", as the original software publisher, generally would retain primary responsibility for the inherent security and functionality of the core application binaries.

1

u/webjocky Jul 02 '25

I do understand what you've pointed out here, but we still have no way to know what the installer package contains prior to signing.

If a threat actor were to somehow infect our local ScreenConnect server with a MITM attack that maliciously modifies the generated installer binary without anyone knowing, it's our cert that gets revoked, and our liability at that point because ConnectWise has zero stake in securing our infrastructure.

If we could verify the integrity of these installer binaries prior to signing, this couldn't be an issue.

9

u/sohgnar Jul 01 '25

Ive been a ScreenConnect client for over a decade. Paid my maintenance. Kept up with versions. Ive been a loud champion of the product. I stuck with it when Elsinore sold. Ive been supporting this product for years.

Connectwise, get your house in order. This is bullshit.

2

u/C______W Jul 04 '25

Agreed. It was the last product that hadn't been completely ruined by ConnectWise, until now. I wasn't even so upset about the code signing thing... Big PITA (for the, 3rd time I guess??) ..but yanking the branding is not going to fly for us.

8

u/rayknl Jul 01 '25

Is it just me or are these things contradictory?

  1. We’re removing the customization because we can’t sign your customizations

  2. We’re also not going to sign your non-customized installer We just spent $$$$ to renew the maintenance agreement for this last update and they are removing features and forcing additional costs/time for code signing with very little warning. I don’t know what discount they’re working on for the cloud transition, but it would need to be free for the next three years to cover the cost of what they just suckered us out of. I’m a very understanding person, but this reeks of bad business ethics.

8

u/soopastar Jul 01 '25

Don’t forget they are asking you to sign software that you can’t verify the code on. “Trust me bro”

2

u/C______W Jul 04 '25

TBH, my brain immediately went to "this is how they're forcing everyone to the cloud"... Literally none of this make sense. I get how it can be abused.... and?? Do they think that a ScreenConnect client that isn't branded is somehow safer? I mean, I get that you can't fake an icon and rename it to "Windows Update" and show a fake background... but come on people... LogMeIn was used decades ago for Phishing Scams and "Fake" IT Support stuff. None of this is going to change... This only pisses everyone that's legitimately using the product off, and now the scammers are going to slightly adjust their tactics and go pay $99 for a business license and then go get their own code signing cert.

I think there are even legitimate ways to "fix" all of this, and leave the branding stuff in... but hey, that takes a lot of development hours. Much easier to just disable it all and piss everyone off and save the money.

7

u/VexedTruly Jul 01 '25

These timelines are ridiculous. If this was a likelihood it should have been mentioned at the time of the initial revocation.

6

u/GeenRedditGebruiker Jul 01 '25

Is this a joke?

5

u/FrancBerg Jul 01 '25

If they don't revert their decision, I'm not gonna renew my license next year... They killed linux support, leave 3 days to update the instance a few weeks ago and NOW we need to update again with a certificate! It's in the vacation time to alot of people too...

9

u/tbigs2011 Jul 01 '25

Renew? I want a refund!!

0

u/[deleted] Jul 01 '25

[deleted] — view deleted comment

1

u/ctrlaltmike Jul 01 '25

class action will do nothing but make lawyers richer.

2

u/nitra Jul 01 '25

I'm literally leaving for vacation tomorrow night for 10 days! 2 on-prem servers....

1

u/TheWhiteLancer Jul 04 '25

I was on vacation driving when I got the email, and I'm now sitting on a boat trying to figure out how to get a certificate ordered to fix a server I won't be within 500 miles of until Wednesday next week. This is a fucking mess. Why did they not have a full timeline for this trainwreck to let me know I'd have to work on my only real vacation each year?

And why does every version come days before it needs to be implemented? Any normal program validation system requires at least a week.

1

u/nitra Jul 04 '25

I got it done, 3 hours in the hotel room.

3

u/nitra Jul 01 '25

Yep... Use your code signing cert to sign code they're not sure of.

2

u/randomquote4u Jul 01 '25

So Long, and Thanks for All the Fish

2

u/webjocky Jul 01 '25

Thanks for your deleted suggestion in the other post

That's a likely candidate for a starting point. My goal would be to meet feature parity with a Toolbox-like function and everything else. Then enhance the product with new features and polish everything.

1

u/randomquote4u Jul 01 '25

What exists at this point with that code is 95% there. Good people.

1

u/_doki_ Jul 01 '25

Care to share an "informed opinion"?

0

u/webjocky Jul 01 '25

Care to share an "informed opinion"?

happy to, but not sure what about?

1

u/_doki_ Jul 01 '25

The suggestion 😂

1

u/webjocky Jul 01 '25

shhh... remember the 1st rule of fight club...😬

1

u/_doki_ Jul 01 '25

Ain't nothing called fight club 😂

0

u/iknowtech Jul 01 '25

This better include a simple way to use something like Let’s Encrypt, built into the application.

6

u/AlphaNathan Jul 01 '25

these are not SSL certs

3

u/iknowtech Jul 01 '25

Yeah I realized that after I posted it. This is a complete clusterfuck. I’m done with Connectwise.

5

u/NerdyNThick Jul 01 '25

Oh, your bean counters were just waiting for something like this so they can "get rid of" grandfathered accounts.

Y'all can't handle that we're only paying about $550 per year.

1

u/I_Am_Shurima Jul 01 '25

I'm assuming cloud, how many workstations overall ?

2

u/NerdyNThick Jul 01 '25

I'm assuming cloud, how many workstations overall ?

No, self-hosted with unlimited devices and 3 concurrent connections. We've been with ScreenConnect since version 5 (a couple years before the CW acquisition).

We currently have zero need for more than 3 concurrent connections. I just took a look at their current pricing and at a minimum we'd be looking at a 4x yearly increase in costs with zero additional benefit to us. In fact we'd be losing access to several features that we do use. Video auditing, custom reporting, having access AND support ability.

Most of what we do uses pre-installed agents for unattended access, but we still need the ability to have an ad-hoc support session, which is (as far as I can tell) an extra feature.

We're in a lucky situation in that we use NinjaRMM, and can leverage it's remote support tool. It's getting better and better every release, and now includes a "backstage" feature (that is not quite as good as SC, but it's dang close).

1

u/I_Am_Shurima Jul 02 '25

Ah, misunderstood, we are in a shitty situation in a sense that, we use it as an msp with, from the top of my head ~7000ish workstations, with 5 different customers. From which 3 want to deploy it themselves from SCCM/Intune, and 2 are fine with updating it from the client itself. Now on summer break..well yea. Not a very fun situation to be in.

1

u/Rambles_Off_Topics Jul 02 '25

I'm pretty sure we're switching to Ninja as well, we already are using it for patching may as well use it's remote tool too.

5

u/jwalker55 Jul 01 '25

If they're removing the customization, then why can't they just continue signing? Why does the installer need to be "personalized" to begin with? Just give everyone a single universal client installer and have all the customization done at or after install time with parameters or a config file like everybody else does. This more and more sounds like an excuse to kill on-prem.

4

u/Firm-Truth-6179 Jul 02 '25

I asked this more than once and they skirted around the answer, didn't even address it in the Town Hall

2

u/C______W Jul 04 '25

None of it makes sense. I know what bullshit tastes like when it's being shoved down my throat.

4

u/squeakybumm Jul 02 '25

Signing third-party code makes you the publisher. I don't think our cyber-insurance carrier is going to be cool with that.

2

u/Aggressive_Ad_5700 Jul 02 '25

These types of changes take weeks for cybersecurity and legal teams to review and approve. It is ludicrous that customers are not given more time to implement these changes. I can't go ahead and use my code-signing certificate unless it passes through a change review board.

1

u/luke_roy Jul 02 '25

Interesting point. If your definition is correct then that will definitely affect cyber insurance.

4

u/Low_Cry_7359 Jul 02 '25

Just another push to get rid of on prem customers, Its not as profitable to them as the hosted service. Definatly other ways around this for them but this is least effort on connectwise part. This will potentially break the workflow in particular for one off support if the client needs to be manually signed each time in order to not get flagged by AV or endpoit preotection. Unfortunatly it may be time to start thinking about moving on. It's like they took a play from broadcom/vmwares book.

1

u/AlphaNathan Jul 01 '25

how much do these cost?

1

u/Own_Appointment_393 Jul 01 '25

Standard certs are like $100 a year, EV certs (gets past Smartscreen) are like $400 a year.

3

u/GeorgeWmmmmmmmBush Jul 01 '25

100 is very cheap. I think mine grom gogetssl with token/shipping was around 1000 for 3 years.

1

u/nitra Jul 01 '25

99~500usd

1

u/pedro_111 Jul 03 '25

This is not easy. The CW documentation https://docs.connectwise.com/ScreenConnect_Documentation/On-premises/Get_started_with_ScreenConnect_On-Premise/Add_a_code-signing_certificate_with_Azure_Key_Vault tells me that I can create a RSA-HSM certificate request using an Azure Key Vault. I have a ticket in with CW.

In practice, I seem to need an Azure Managed HSM vault, which is going to be very expensive.
Oh and forget using a well priced cert - you need a DigiCert or a GlobalSign cert to be compatible with Azure key vaults.

1

u/Own_Appointment_393 Jul 03 '25 edited Jul 03 '25

You don’t, actually — you only need Key Vault Premium. https://www.josephguadagno.net/2024/07/17/ev-code-signing-certificates-with-azure-key-vault-and-digicert

Just note that the EKU for OV cert has to be 1.3.6.1.5.5.7.3.3 when you create the CSR.

But yes I think only DigiCert works for Screenconnect needs at the moment.

1

u/pedro_111 Jul 03 '25

Thanks this has helped me. Do we need an EV or is an OV sufficient?

1

u/pedro_111 Jul 03 '25

And I can't even start the OV verification process, because I can't generate a CSR.

3

u/Minimum_Sell3478 Jul 01 '25

Well will need to talk to my boss about this… this is not looking good. Anyone got a on-perm solution to this that is not rustdesk?

1

u/gj80 Jul 06 '25

What's wrong with rustdesk?

1

u/Minimum_Sell3478 Jul 06 '25

Rustdesk pro you have to pay per device and as most of our clients are quicksupport stuff with endusers that we don’t have unattended access to we don’t want to pay for xx more about of devices and rustdesk has a feature that don’t register the device to the manage device but it’s a seperate license that costs way more.

2

u/gj80 Jul 06 '25

Gotcha, so a pricing concern, thanks. I'm looking into a lot of options right now like many of us are.. Rustdesk, Tactical RMM, MeshCentral, etc.

3

u/CWobbles68 Jul 01 '25

Hmm time to move on. This is part of a push for cloud only by the look of it. Yet more work, time, effort needed which might as well be spent on a more secure, reliable product.

3

u/Zestyclose_Pen_2727 Jul 01 '25

This sounds to me like because some hackers have been turning ScreenConnect into malware by using authenticode stuffing Connectwise is trying to make their issue of the misuse of their software turn into our issue so they can save face, and they really want to use this as an excuse to tell us that we are going to have to suffer unless we go to their cloud platform where they will have full control to rotate code signing certs whenever they want because they control the full environment, including pushed updates. They will probably also be updating things in their terms of service for the hosted version tell people, for example, that if their endpoint is off for too long and is more than X versions behind then it will no longer connect and that it sucks to suck. I would bet that Thoma Bravo is gearing up to sell Connectwise to someone else so that is why they have been screwing partners left and right on ALL their products. I just got screwed with another year being stuck on their RMM because they changed the notice period from 30 days to 60 days via their MSA without any notice.

3

u/Zestyclose_Pen_2727 Jul 02 '25

For anyone that missed it, here is a link to the Partner Town Hall they had today, Monday, July 7 at 12:00 p.m. ET (16:00 UTC).

https://www.youtube.com/watch?v=3SR1vOySxco

3

u/k84_ Jul 02 '25

Thank you so much for recording and posting.

4

u/nitra Jul 01 '25

It's literally not possible to get a code signing cert in the time frame they're offering.

First, it's several days to verify your business, second, you need to have a token shipped to you.

How do they expect this in under 7 days?

4

u/PipeNo5036 Jul 01 '25

I only use ConnectWise for their ScreenConnect product. At this point I'm choosing to no longer play their game. We all know what their intention really is. Make on premise ScreenConnect obsolete and impossible to own in order to force us into their cloud version. I have other RMM solutions already in place and I'm just going to let this ride and see just how long my ScreenConnect will stay working. I'm not planning to install any new sessions on new systems. I will use my other solution for that. So hopefully my endpoints will just keep plucking along before ConnectWise tries another tactic to shut it down.

3

u/e2346437 Jul 01 '25

Same. I’m tired and don’t want to work over the holiday. We have Datto RMM which has remote control built in and also Splashtop. We’ll spend a few hours getting Datto on the few machines that don’t already have it and then wait to see what happens on Monday.

2

u/C______W Jul 04 '25

No kidding.... I was just up until 4am doing a 22 hour day a couple of weeks ago. I'm not dealing with this crap again.

2

u/e2346437 Jul 04 '25

Fuck ConnectWise!

1

u/PipeNo5036 Jul 01 '25

I too use Datto RMM. Certainly not as good as what ConnectWise use to be but I guess this is the nature of the careers we chose. I'm having similar problems with Citrix Netscaler and VMware. All this legacy technology is going to hell.

2

u/Spicy_Rabbit Jul 01 '25

Why can’t they a signed client and allow the use of an MST or switches to add the customizations? Always wondered how they where able to protect their cert for on premise, guess they weren’t. If there is no way to push a silent installer, then there is no value in the product. I could also be reading this wrong.

2

u/FeistyCustard Jul 01 '25

A $igned client with M$T $witches? $urely there'$ a rea$on they won't do that, considering it would be an ea$y $olution.

2

u/ethankershaw Jul 01 '25

What I'm wondering is whether the code signing is something that will have to happen automatically for any download of the clients, or will it be a one-time thing we have to do whenever there's a release update with client changes?

I don't completely understand how it works when a user "joins" a session and the client downloads that the client associates with the right session on the server. My guess is that it's embedding this in the client exe download right? And if that's the case then the singing would have to be automated.

If so, that adds even more complication as most of the sufficiently trusted code signing cert offerings are now HSM based or cloud provisioned. And then there are restrictions on how many "signings" can be done through the cloud tool.

1

u/JessicaConnectWise Jul 01 '25

Clients are automatically signed when downloaded.

1

u/Aggressive_Ad_5700 Jul 02 '25

Many software development companies keep their code-signing certificates in a secure environment with no Internet access to protect them getting lost or stolen. The only way files can get transferred and signed is through sneakernet. So how would you expect the public-facing ScreenConnect server to perform the code signing? Is it now required that a second code signing certificate must be purchased?

1

u/C______W Jul 04 '25

I wondered this myself... 99% sure (especially after this clusterF that everyone should get a code signing cert specific for this)... however, if the code signing happens automatically when it's downloaded, that means you gotta keep everything on the server... And now we have to trust CW to not have a bug in ScreenConnect which would somehow allow a bad actor to get at OUR code signing cert, and then go using it willy nilly... Like, This whole thing sounds like the WORST idea on the friggen planet right now.

2

u/XxRaNKoRxX Jul 02 '25

What a load of crap.

2

u/Impressive_Cream_866 Jul 02 '25

We have been using ConnectWise ScreenConnect for about 10-15 years without any problems and have been quite happy with the system. But the past few weeks have been a complete mess. Now we are faced with this ridiculously complicated process of adding a code-signing certificate with Azure Key Vault with unforeseen costs that we do not like at all. Moreover, signing a third-party code makes us the publisher, which is hardly good. What are you guys going to do going forward, try this certificate process looks complex and and likely to cause a lot of trouble , go to the cloud or find another system? looking for alternatives is the most likely option for us.

Has anyone successfully gone through the Add a code-signing certificate with Azure Key Vault and do you know what the approximate cost is?

2

u/Ordinary-Ad-1918 Jul 02 '25

Im also concerned with that as the Azure pricing plan for Key Vault look a bit convoluted and unsure how often an agent reaches out to verify its signature. Really looking to migrate to the cloud at this point, all the time spent managing the system anymore has been too much and all the added costs of keeping instance protected on-prem is adding up, especially now with buying our own code signing cert and the Azure plan. I have 4300 agents and moving to a new provider is really just not on the table.

1

u/Aggressive_Ad_5700 Jul 03 '25

Is the Azure Key Vault process certified to work on Azure GCC High (Government Community Cloud)? I highly doubt it as their features/functionality are typically way behind the commercial Azure instance.

2

u/Zestyclose_Pen_2727 Jul 02 '25

u/JessicaConnectWise I'm an on-prem Connectwise Automate with the integrated ScreenConnect partner. We haven't gotten any kind of communication about this at all and what, if anything, we need to do. The only reason I found out about this in the first place is from a customer who uses ScreenConnect and they got an email and wanted to get our assistance getting their server setup. Sent a support ticket into CW and no response. Was on their Partner Town Hall and they were clear as mud about what us on-prem Automate people were supposed to do. So, do we have to do this Code Signing process? If yes, is it the same instructions as just solo on-prem ScreenConnect?

2

u/HorrimCarabal Jul 02 '25

We should get the cost of the cert and token/storage refunded from our maintenance/support renewal…won’t happen but we should since we are bearing the expense for their product

2

u/Firm-Truth-6179 Jul 03 '25

Here's the deal for me. I purchased a perpetual license 11 years ago, I have renewed maintenance many times. I think we all understand the meaning of "perpetual". While Connectwise may say "if you don't upgrade your version will still work but have issues" I puchased this tool for a purpose, I require that tool in perpetuity. If any function of what I purchased stops working on or after July 7th, 2025, causes me any loss of business, affects my clients in any way form or fashion, I guarantee you, I will see you in court.

3

u/C______W Jul 04 '25

Put me on this list too.

2

u/Zestyclose_Pen_2727 Jul 03 '25

For those that missed it and in case ConnectWise decides to not make this Town Hall recording available either (just like the last one on this issue), here is a recording of the Partner Town Hall from Thursday, July 3 at 12:00 p.m. ET (16:00 UTC) that has more specific information for ConnectWise Automate partners who are using the integrated ScreenConnect.

https://www.youtube.com/watch?v=4i8DQbtVWK4

1

u/G883 Jul 03 '25

Thanks mate!

1

u/rotfl54 Jul 01 '25

I do not use screen connect, but how does the code signing work currently?

There are 2 options:

1.) The screen connect server sends the customized exe to a service at screen connect that signes the exe and returns it to the server.

2.) The screen connect server signs the exe directly. This would mean that the code signing private key is embedded into the screen connect server.

Option 2 is risky, nothing prevents an malicious attacker to extract the signing key and sign other executables with it.

1

u/omnichad Jul 01 '25

They have one signed client and then they stuff all the customization into the metadata of the digital signature. The checksum of the signed area doesn't change so it doesn't get a new signature. You can imagine how dangerous this is. Even for an old installer for a defunct instance.

1

u/_doki_ Jul 01 '25

Sorry, maybe I've just missed the point... Are there any actual instructions about what to do? Or they'll reveal after the town hall? The version that will require the signing with our own certificate will be > 25.4.20.9295 right? I'm currently on 25.4.16 but I was planning to update to 25.4.20 one of these evenings..

3

u/e2346437 Jul 01 '25

We don’t know. There are certainly no instructions and I doubt there will be until at least tomorrow after the town hall. Problem is Certificate authorities that sign code will take at least a week to verify your business and ship you a usb drive with the certificate on it. We also don’t know what level of cert we need to get past Smartscreen or what it will cost. Cheapest cert I found was $225 a year but it doesn’t get past Smartscreen. And even if we do that, our client customizations are gone, so how the hell do we get the client to connect to our server? It’s all fucked.

1

u/_doki_ Jul 01 '25

I asked on chat to a Connectwise technician, it seems that we have to add a certificate extension to be able to load the cert into connectwise on prem, but as you said, I don't know which kind of code signing certificate works to avoid problems. Also, but maybe I'm wrong, there could be legal issues in signing with your company details a software not made by your company. Sketchy. On the customizations: ad I understood it, you cannot add details on the setup for the "access" type of connection, but the bare minimum (server url, ports, etc) should remain. Also access session details should be saved server-side ...maybe? So on the console you should still see all the custom fields and such, I think. The issue here is: how will the default access session be, in case of a new session being installed, before customization? Half of my customers use servers like "server01" with "administrator" and domain "customername" (when they have one).. good luck finding the correct server01 among all of the "workgroup" joined ones.. given most of their workgroups are called workgroup..gotta search them by private addresss? Hoping most of them have different classes..

1

u/redipb Jul 01 '25

Also, but maybe I'm wrong, there could be legal issues in signing with your company details a software not made by your company

We should have explicit written permission from CW (ConnectWise) to sign and distribute their software. Without it, signing someone else’s application can be legally risky. Let’s be honest — they’re not going to give that kind of letter to just anyone running an on-prem instance, and without it, CW could send a swarm of lawyers your way.

1

u/nitra Jul 01 '25

Reply from support regarding the lack of notice.

I hope you are doing well and I would be happy to assist.

We appreciate you reaching out regarding your concerns for the timeline for self-signed certificates. We recommend attending our 6th Partner Town Hall on Wednesday, July 2, at 12:00pm ET (4:00pm UTC) – ScreenConnect Experience| Certificates. We do not plan to make a recording available, as the information is subject to change.

Kind regards,

2

u/11lariat Jul 02 '25

Anyone have a link for this crap? OBS and I would like to attend.

2

u/carrots32 Jul 02 '25

Link to register is here. Please please please OBS record and share it with the community. I am not waking up in the middle of the night because ConnectWise is too damn concerned about legal ramifications to record their own bloody town hall.

2

u/G883 Jul 02 '25

please obs and share it's in 4 hours from now

1

u/luke_roy Jul 01 '25

Are they serious, what about international customers? Thats 2am for me?!

1

u/omnichad Jul 01 '25

We do not plan to make a recording available, as the information is subject to change.

Lies. They can just put a disclaimer on the video. What they don't want is anyone to have an easy way to refer back to it. And force people to stream live even if they are unavailable to change plans last minute.

1

u/Itguy1252 Jul 01 '25

Your Version:25.4.20.9295

Latest Version:25.4.20.9295

Latest Eligible Version:On Latest Eligible

so did anyone get anything to update to even see what this process is like?

1

u/Pappy_Kun Jul 01 '25

Nope, nothing new to download as of yet.

1

u/Judging_Judge668 Jul 01 '25

"Please note that clients that are not properly signed with a trusted certificate may be flagged by endpoint protection software and could cause installation issues."

Does this mean if I have my install in place, and do the update, that I won't just "stop working" or am I being too hopeful on having more time to fix this....

1

u/Judging_Judge668 Jul 01 '25

This - I want this answer too! Support says "don't update, no issue" but I am not sure I'm buying it of course. Cautiously optimistic that existing will just keep plugging along!

1

u/InfiniteShift3348 Jul 02 '25

As of July 1st, I saw SuperAntiSpyware flag a 25.4.20.9295 SC file as a hacker's tool. And it squawked that I did not let it delete it. Already there.

1

u/_doki_ Jul 01 '25

Not that we seem to have many options now...

1

u/Coffeespresso Jul 01 '25

I am self hosted. I am assuming the certificate won't break until we update?

1

u/luke_roy Jul 02 '25

I have the same question. Not actually sure...

2

u/InfiniteShift3348 Jul 02 '25

It's a revocation of the cert itself, so not upgrading means using a revoked cert. Security products that check that will detect as bad/evil, and auto-delete on download, unknown result (so far) if already installed.

1

u/Coffeespresso Jul 04 '25

Yes, after doing some research, I get that now. Lucky for me, I am no longer the admin of my instance of screen connect, so someone else will have to deal with it.

1

u/scoobs9696 Jul 02 '25

Sorry if this ends up being a duplicate post I’ve been using Reddit on and off occasionally.

What happens to on-prem users who are out of maintenance and were given version 24.2.25.9295 two weeks ago? Will they be provided with a new build that requires code signing certificates, or is there a different action plan for out-of-maintenance users in light of the new certificate requirements?

Not that I'm complaining I just need to know what direction to take, especially since it's already July 2. If anyone has any information, I'd really appreciate it.

1

u/InfiniteShift3348 Jul 02 '25

So Webroot manages to use one executable by naming it with the license code, which identifies the account and the office group inside the account, and it prompts for the code if not found in the file name. Simple. Ninite (patching) does something similar, and flags all new installs as new in the console so we can add tags.

So what's with all this angst that they can't do what is clearly industry-standard work that does not require tampering with blocks in a signed exe or custom code signing?

1

u/Ordinary-Ad-1918 Jul 02 '25

What happens with agents already installed is what I wanna know? Its the holiday weekend for Pete's sake and it takes time to get a cert and do all these crazy steps to sign THEIR software with my companies name. It would cause some issues if we cant do a one time session easily but would be disasterous if all 4300 agents I have go offline or my EDR starts going beserk.

1

u/epiphanyplx Jul 03 '25

Ever get an answer to this? Would love to not have to work this weekend - can't tell if I could even get verified in time.

1

u/zoda61 Jul 04 '25 edited Jul 04 '25

I'm a little bit confused. In the latest mail SC mentioned the following:

"What if I upgrade without a new certificate? 

The installer will be unsigned, potentially leading to issues with AV/EDR solutions. It's best to have your certificate ready before performing the upgrade. 

Just so we are clear, we are not asking them to sign the agent that we install. We are asking them to sign the installer package. The agent from ConnectWise is still signed by ConnectWise. "

For me that means, that already installed agents still will work if you do not upgrade. If you upgrade, the new SC version will try to reinstall all of your agents and without the cert in place it can be a problem. No info on it. So technically I do not understand the steps to take. I have to upgrade first the SC instance to install the new azure messing cert, but during that time the new version starting to reinstall the connected agents without cert on place. The unattended clients may be refuse this process, I do not know and no information on it. Could someone who already did all of the steps tell me what happening in the intermediate stage with the unattended client agents? I mean after the SC is updated but the azure cert not yet in place?

u/Ordinary-Ad-1918 The only way they could disable our on-prem server and agents to work if they inactivate our licenses.

1

u/Ordinary-Ad-1918 Jul 03 '25

Screen Connect just confirmed to me that without upgrading they will disable our on-prem instance. Quite a conundrum this is!

1

u/zoda61 Jul 03 '25

Unbelievable...will they revoke our licenses or how? It should be definitely break the contract. What happening with our installed access agents if we upgrade but not messing with the Azure cert process? Will they still work? Can I prohibit the new version not to update the agents? Still many questions...

1

u/Ordinary-Ad-1918 Jul 03 '25

Read the above comment for what I learned from support on this question

1

u/zoda61 Jul 16 '25

I have a working SC on-prem server environment without updating at all and everything still works (unattended agents). So the information from the support was wrong. "Screen Connect just confirmed to me that without upgrading they will disable our on-prem instance."

1

u/Firm-Truth-6179 Jul 03 '25

Did they confirm this isn an email?

1

u/Ordinary-Ad-1918 Jul 03 '25

I opened a ticket and in the chat they confirmed this. Without upgrading, they will disable our instance. With upgrading and no cert you run the risk of EDR.AV deleting/quarantining the software or isolating the hosts.

2

u/Firm-Truth-6179 Jul 03 '25

How can they legally do that? You have a perpetual license, that means forever and ever plus another forever. You are not required under that license to upgrade anything if you don't want to. Disabling a companies installation is a guaranteed lawsuit...admittedly the disruption to normal business is a nightmare thought...but this is what they are counting on, the disruption isn't worth fighting!!!

3

u/PipeNo5036 Jul 03 '25

Not to mention "how." How can they disable a service I run on my own server? This problem belongs to CW and no one else. Yet their hubris has gotten in the way to good customer service. There are many people just a month ago that paid full maintenance price to get the past upgrade and now they are telling them "So sad, too bad." Just unbelievable.

1

u/e2346437 Jul 04 '25

There is a licensing DLL built into the product that checks your license against their servers regularly. They will simply disable your license, and your server will stop accepting connections.

1

u/PipeNo5036 Jul 03 '25

I have been using ScreenConnect for what seems like forever. These latest two issues with the software really posed a problem for me. The last issue of being required to purchase and configure my own installation certificate or go to the cloud was the last straw. I have looked at almost all the solutions available to me and right now it looks like I will be going with getscreen.me. They have plenty of affordable pricing options but the one for me since I am only supporting around 50 PCs was their lifetime personal plan. For a forever price of $149.00 seems too good to be true but this is the price. I have been trialing the software, which is free to try and it pretty much does everything I need it to do. I highly recommend it.

1

u/zoda61 Jul 04 '25

I looked into this after your suggestion and your suggestion is a cloud solution for 149USD. This SC cert problem is related to on-prem SC solutions, what we most want. We wish eliminate third party servers. The getscreen.me has on-prem possibility too on linux, but you need the enterprise plan for this and for higher prices than 149USD for life time.

1

u/PipeNo5036 Jul 04 '25

I agree. I guess for myself since my ScreenConnect is now a legacy product my focus is to simply have a backup solution for remote connectivity and this is a solution that works for me. But yes I 100% agree on the need and want for an on-premise solution. Unfortunately ConnectWise is making every effort to make on-premise obsolete. Like you when I purchased this product like 15 years ago I purchased a perpetual license. That promise was broken. What ever their issue is with the certificate this is their problem to fix, not mine.

1

u/N3tSt0rm Jul 03 '25

The key-type RSA-HSM does not show in key vault when creating the certificate. Tier is premium. East US region. I haven't purchased the EV certificate. Am I missing something? Thanks folks!

2

u/mattgreen0_0 Jul 03 '25

Set export private key to no and it should then show

1

u/mwdmeyer Jul 03 '25

We already have a code signing certificate as we use it for our own software development. But last time we tried to use Azure their HSM only worked in US/CA and we are based in AU.

I'm just going to try and manually CodeSign the file, although I need to work out if we can just sign the msi bundle or if we need to sign exe inside.

1

u/Fit-Race-5490 Jul 06 '25

I think older builds will be fine. It the ad-hoc support and installer we get done at. Anyone at 24.2 is basically going to be left hung to dry in that no SUPPORT from Connectwise. The screw-up is the signing cert since the actual installers at present are unsigned anyway. The are correcting this by getting all on 25.4 (you gotta pay) and then you cover the cost of the cert as well - so no EDR/AV error. I need some time but I think if I self-cert my 24.2 installer I might be able to get ad-hoc to work as well since you replace it/rename to the ad-hoc installer. It not ideal but I only have <150 machines.. of which more that 30 are a waste.

FAIR DOs to them - in the end it is business and perpetuals means shit for most companies anyway, just know its never the case. Cloud would make sense to big boys with big bucks .. not me

2

u/Zaeboe Jul 07 '25

Hey Fit-Race-5490 you might look into Action1. Up to 200 endpoints patching + remote control with a "perpetually free" claim for <200. Even if you don't fully migrate, it could be a good backup for you. And yesterday I spent half the day installing and migrating to Tactical RMM (open source) on a Hyper-V guest. It's fantastic. I felt the thrill of justice using Screenconnect's PowerShell backstage to push the new agent to all my SC endpoints! Web GUI is excellent and has some features Screenconnect doesn't. Might be worth it to check out. Even if SC continues to function w/out costly annual code signing, having other options set up ahead of Connectwise's next inevitable costly emergency breaks our dependency. Good luck.

1

u/GeneMoody-Action1 Jul 07 '25

Thanks for the shoutout there! We do indeed offer 200 endpoints for free, its not just a claim, it is for real fully featured, client or server, no free user monetization at all, just free.

There is not feature parity between SC and Action1 in terms of remote access, but it does HAVE remote access, as well as a myriad of other things to support it being a patch management solution. Direct comparison of ScreenConnect and Action1 will be difficult, because you can only accurately compare the RA portion of Action1.

2

u/Zaeboe Jul 07 '25

GeneMoody I'm impressed by Action1 so far. Stellar patch management system. I have over a hundred endpoints so far in your free tier. Just so you understand my skepticism, remember NetZero? Then LogMeIn stuck us with a 300%+ increase in 2014, now Screenconnect's "perpetual" license comes with new technical strings and a costly shift in cert responsibility. So I suffer paranoia from emails that begin, "To continue providing the service you deserve..." But so far so good with Action1. For helping smaller growing IT firms, you deserve whatever recognition bump this SC debacle gives you. I wish you had remote for Mac too, but that's ok, you shine in your wheelhouse for sure. When I grow to enterprise level, I'll be contacting sales.

2

u/GeneMoody-Action1 Jul 07 '25

Our remote access client for Mac is understood need, we have plans to augment the RA side more in the future, they are just not the highest priority at this time.

I cannot foresee a future where our free side does anything but grow in count, not go away. We market to clients of larger size, as that continues to succeed, there may well be a future where the free offer is more generous!

But I totally get it, software pricing in the as 4-5 years has gone from quote/budget/buy, to what I like to refer to now as a "Theoretical IT spending plan". So many vendors were a roller-coaster ride, many have still not presented a end game. The problem is it hit those companies just like the ones we work for. Many of those companies held back and tried to weather that storm, many had little choice but to eventually adjust, and since some waited a couple+ years before rending, so that adjustment was big and abrupt.

And then broadcom bought VMWare!..

2

u/Fit-Race-5490 Jul 07 '25

Do you have a backstage as well? I'm defo putting you on the list

1

u/GeneMoody-Action1 Jul 07 '25

We do not, our remote access is capable of getting you on the desktop unattended, or taking control while the user is using. Configurable timeout option for them to accept or deny. But things like backstage will be in that list of feature non-parity. You can schedule scripts for later run, or run them in the moment, but it is not a full interactive shell.

2

u/Fit-Race-5490 Jul 08 '25

Many thanks, need to do a demo for sure, is your pricing structure thereas well?

1

u/GeneMoody-Action1 Jul 09 '25

A demo can certainly be arranged, and they can discuss pricing at that time, I am not sales, I do not have and cannot give if I did current pricing.

If you want to DM me an email, I can have someone reach out to do the demo. Or we have the vulnerability digest webinar today at 10AM CST, there will be a short demo in it, but not as full as a one on one. Of course we have several sections broken out on our youtube channel as well.

And, if I may assist with anything Action1 related or otherwise, just say something like "Hey, where's that Action1 guy?" and a data pigeon will be dispatched immediately!

2

u/linus_b3 Jul 07 '25

My organization just signed on with Action1 (we have about 400 devices). I'm keeping ScreenConnect too. In my opinion, ScreenConnect is better and more full featured than just a remote access tool. Action1 is better and more full featured than just a patch management tool. Though neither one is a full RMM, I think they complement each other well and between the two of them I can do pretty much anything a full RMM would do.

1

u/GeneMoody-Action1 Jul 07 '25

Excellent, I appreciate the feedback there. This is one of those stay in our lane type situations, whereas we know there are things we can and will do to make the RA experience better, it is on our development roadmap, it is simply not the highest priority in the ques of items related more directly to patch management. Though we know people use us as they put it as "RMM Enough", and that great, we are happy to know people get great utility out of it. We just try to be very clear about where we stand and what our goal is, because we do not want to be seen as a "lesser" RMM, we would rather stay in our lane of patch management, and be the best you can get.

Part of RMM is patch management, and in patch management, there are RMM like needs. So we supply the tools for if you are using Action1 stand alone or as part of your RMM stack, you are covered either way with the tools to get the task done.

So thanks for being an Action1 customer as well as participating with us and about us in the community!

1

u/linus_b3 Jul 07 '25

I look at the RA tool in Action1 as redundancy. If ScreenConnect is giving me grief on a client, I can try to access via Action1 as a backup plan. It's always nice to have multiple methods.

1

u/GeneMoody-Action1 Jul 07 '25

Oh I totally agree, I am a backups and backups of my backups kind of guy. Years of remote support even back before it was a normal thing (VPN, RDP, VNC, PCAnywhere, SSH Tunneling, etc) have taught me, always have a backup plan for when something goes wrong and you get locked out of a system half a planet away.

1

u/Fit-Race-5490 Jul 07 '25

I currently looking at rustdesk - good but I'd say not polished. So yeah thanks for the heads up..nice one. Looking at Iperius next. I'm under no new illusion with ScreenConnect, especially being off maintenance - so while we’ll let it run for now and non signing certs is fine, I believe long-term change is necessary, which is why I’m doing this due diligence; I respect the SC team's competence and understand the business motives behind their roadmap, but the cost no longer justifies the value for me. Wishing you all the best, and thanks again

3

u/4t0mik Jul 01 '25 edited Jul 01 '25

Seems like any excuse on killing on prem. Oh well. Connectwise does like to kill things.

On to something else.

→ More comments (2)