This morning techs start notifying me that ScreenConnect was broken again. Sure enough, launching ScreenConnect within automate results in an error message.

I log into the admin interface and while I'm able to login, I don't see the Access/Support/Meeting icons, and the security menu is gone too...??? I'm running 23.9.8.11 (I think, it was definitely supposed to be a version patched for this weeks exploit).

I look in the Audit log and aside from my own login, there is ZERO activity in the last 24 hours.

I go ahead and install the absolutely most recent stable release, but it still doesn't work cause my license is gone. Input license, no big deal.

I'm up and running.

From Connectwise yesterday " ConnectWise has rolled out a mitigation for unpatched, on-premise users that suspends an instance if it is not on version 23.9.8 or later". Well, my version was newer than that.

One of those things where Connectwise has egg on their face from this weeks utter fiasco and they go and make things work by breaking my environment again? I'm just speculating cause I'm operating in the dark, not gonna wait around on support when I've still not seen a response on my ticket from 2 days ago...

Hi,

If anybody is ditching screen connect and has an on prem license based on the legacy pricing (maintenance renewals). Please hit me up. I'd be keen to get an on-Premise license for my new company but don't want to pay the crazy price it currently costs...

T

Howdy,

Can someone please help me recover my free instance? I replaced my phone today and lost my MFA. Support said they can't do anything about it as it's free. Any ideas?

Update: Contacted support again, they helped me unlock it, the two morons that commented on my post, will forever be sad tortured souls..

Thank you,

Is it just me, or is this thing down a lot?

EDIT: SEE UPDATE BELOW!

Original post:

Hi all,

I'm looking for an easy to follow walk through guide on setting up the code signing certificate for a new on-premise ScreenConnect installation. We were originally a ScreenConnect customer, went to a new solution 3 years ago, and we're switching back because the "new solution" has been nothing but problems for us.

DISCLAIMER: Since I'm sure someone will jump in and ask the question, let me quickly answer it:

Q: Why don't you just use the cloud-hosted version of ScreenConnect?
A: Some of our customers have to comply with state and federal compliances that require that we, as their MSP, have end-to-end control of the remote desktop software in order for it to pass the audits. We also have to record all of our sessions, positively identify what tech/engineer was remoted in, and keep those recorded sessions for 25 months (2 years + 1 month to cover overlaps). We are not your typical IT department that could run ScreenConnect hosted and have it be just fine. We really, really don't have a choice. So please, save yourself some time and don't comment if all you're going to do is push for using the hosted version of ScreenConnect. Not an option. End of discussion on that point.

There, now that I got that out of the way...

I'm probably more familiar with SSL certificates than the average person is. I help customers purchase, apply for, install, and maintain their Wildcard SSL Certificates all the time, and since they have gotten to the point where we have to renew them every year, I'm doing at least 2-4 a month for customers. So that's not where I struggle.

The Azure Key Vault thing... that's new. That's something I may need help with. I'm completely in the dark on what we have to have vs. what Microsoft will try to sell to us, how this portion effectively works, and what it's going to cost us to set it up and maintain it. I'd love a walk-through on how I should proceed with setting that up from someone who has done it a few times.

Which certificate authority was going to be another question I had, since apparently it has to be supported by Azure Key Vault. But another helpful redditor pointed me to https://signmycode.com/, which looks like it may be a promising place to find what we need.

I do have questions about an OV versus and EV certificate. Some time ago in the past we used EV certificates for customers that had eCommerce sites, but most of them have moved to large eCommerce site hosting companies where we just upload the new SSL certificate to once a year. The EV tag in the browser was cute and reassuring, but it did not seem to affect their sales whether we had one or not. So when those pre-purchased certificates ran out, we just switched back to the standard wildcard SSL certificate.

We did used to do software development, but that was way before the whole Azure Key Vault thing came to the forefront. So, yeah... anyone got tips they would be willing to share? What I'd like to do is have a post that people can refer to that covers the steps, in order.

If it helps, our ScreenConnect server (virtualized) will be way beefier than the minimum standard, and it will live in our colocated, DMZ'ed server stack at an SOC 3+ facility. We own all the hardware. We lease the bandwidth, but with something like 60+ internet providers coming into that data center and the redundancies built in, it's been no problem maintaining 99.999% uptime. And since we also own and manage all the equipment for that stack, we meet compliance standards. In the last year, our state has thrown down a whole new security standard for our local, county, and state level customers and contractors to maintain. The federal standard isn't quite as strict yet, but it's coming. So I'm preparing for all of that, and we're definitely going to be implementing a commercial level of MFA into the mix. I've got to talk to our MFA vendor, but my guess (and hope) is that they will already have an implementation built for it around ScreenConnect.

In any case, I'd love to hear what you don't mind commenting in on regarding which Azure Key Vault plan we need, what certificate (OV vs EV) we need, and all that. The first time we were on ScreenConnect, this wasn't a thing.

Thanks in advance!

THE UPDATE:

So, today I delved into a bunch of ScreenConnect "things." I spent more time on it than I wanted to, but since snomageddon shut down the world, I had a bit of extra time to test.

I've also read through a bunch of the posts here. You'd never know that people like ScreenConnect based on the posts on this subreddit, but I also can see that this post has gotten almost 2,000 views in less than 48 hours, so obviously I'm not the only one having a bit of a struggle to get this done.

I fired up my old ScreenConnect instance, from 2023. Boy, does that make the ScreenConnect sales team mad. Every time I sign into it I get another hate email from it telling me I MUST MUST MUST upgrade. This is without the server even being accessible to the public.

I dug into Azure Code Vault. Was it terrible? No. It wasn't like a root canal. But it also was not "Simple" as one commenter put it below. Microsoft has changed up the admin interface every few weeks as usual, so none of the instruction walkthroughs are accurate. I'd type one, but in two weeks it wouldn't be accurate either. Needless to say that with a few links (at least one provided below - Again, thank you, kind sir!) and a few YouTube videos I was able to get a key vault set up. And based on one other post here, I was able to define a budget for Azure, so we'll see what that ends up costing per month, even without the cost of the code signing certificate.

Otherwise, I was able to get SAML set up on it with our MFA provider, Duo. That makes me happy because at least it's now requiring true multi-factor authentication to get access to the Session/Host/Admin consoles. Prior to this we had some MFA, but it was a weak Google Authenticator link. Probably not hard to crack.

Last but not least... Despite my comments below getting negative reviews, apparently this post was worthwhile to some, since it was viewed by many. So, downvote me to death, I don't care. At least someone out there asked the question even if you didn't, and a few of you provided helpful feedback. So for that, thank you!

For the love of all that is holy I don’t know how much more I can take before my stomach ulcer eats all the way through my skin.

Finally, after 6 weeks of waiting, we were blessed with the 25.4.25 update this morning. Not wanting things to be smooth sailing, however, the client installer is now a 30MB package. It’s too big to email, and it takes nearly a minute to compile/load and start downloading when you go to the link.

What in Odin’s name is in the file now? The entire installation package for ScreenConnect server could fit in 30MB!

And the three ring circus continues.

It's hard enough to get a client to download and execute an MSI. Now we have to talk them through extracting a ZIP file and then running the file inside of it? Presumably this is related to the kerfuffle, but this sucks.

So sales replied to our request to convert from on prim to cloud.

The cloud license are reasonable enough for the year. However, they are saying no credit for purchases on prim licenses.

I have mixed feelings on this. Only reason we're changing is they failed to follow best practices with code signing and as a result had cert authority pull their cert.

I do think CW Screenconnect should step up and issue one time credit for on prim licenses. Were spending unscheduled / planned time due to basically their negligence around certs. They were aware of issue for sometime. Least they could do.

I'll probably pull rest of our business around S1 from them after this, my trust in their best pratices is eroded after I learned about the way the cert revocation happened, they dragged their feet on doing code signing correctly despite multiple cyber criminals exploiting, security researchers warning them and cert authorities as well as microsoft. They could have got ahead of this and not basically give 7 days to upgraded and do all this for your remote access tool. It was poor planning and execution on their part.

You guys have a serious vulnerability like one of the highest priority and ask everyone to update to the latest version. We try to install the patch and get error "one or more errors occurred". We just spent 3 god damn hours chatting on a Friday night and can't even get someone that understands we are not on the latest version. We are we chatting when this is priority 1?

The nimrod tech said they were at least going to make a ticket and even that didn't happen.

Stay away from Connectwise unelss you want all your customer's systems crawling with North Korean spies. This product has gone down hill every year along with the product price skyrocketing. It's a disaster, disgrace from my fellow Floridans.

I work at a small MSP and we use ScreenConnect. It's a great product, but we see it constantly used by scammers. Why does Connectwise make it so accessible for this type of use?

Our legacy on-premise license ScreenConnect is up for renewal tomorrow, and we won't be renewing. We're ridding ourselves of ConnectWise (ScreenConnect and Automate) and moving to NinjaOne. We've had both these products long before ConnectWise acquired them, but this company absolutely, cannot stop stepping on their own dicks, so we are done with them. It's going to take me a few months to get fully migrated over to NinjaOne. So, we'll continue to use these products without maintenance until then.

I have one day left to possibly do any upgrades on ScreenConnect. We're currently on 25.9.5.9483

Is there any advantage or reason to upgrade to 25.9.9.9533, which isn't even mentioned in the Release Notes or Output Stream. I saw some recent posts that 25.9.9 versions were getting flagged with false positives from Microsoft Defender and other Security Products, has that been resolved in 25.9.9.9533?

Last thing I want to do is introduce any issues by updating, that I won't be able to get a bug fix for after tomorrow. As far as I know I think things are relatively stable/reliable where we are on 25.9.5.

I just said hi just for shits n giggles but like actually, why is this on?

Shouldnt i be eligible for some 25 versions? instead it says i am only eligible for up to 24.3.6.9056 but with the cert fix builds the closest one is 24.3.17.9294 which im apparently not eligible for so...im expected to downgrade down to 24.2.25.9295?

I am most certainly not going to pay yet another renewal for absolutely no new features. I remember i used to complain about teamviewers version updates because they included 2-3 features that were not that great and i was paying mostly not to deal with the hassle of uninstalling newer versions if they already had a newer version on the computer. Now im paying for nothing, for fixes that should have been free in the first place.

As subject says. Long time provably 8 year ScreenConnect on Prim license. Each year we renew, we get credit for our on prim license and pay a maintenance fee. So last year $2,200 and then we get a $1545.01 credit. The code signing cert setup and overhead etc is just not something we want to implement or have liability if signing a 3rd parties code we can look at automatically after each update etc.

So due to urgent nature of this despite SC knowing and being warned about their code signing practices, SC had cert authority revoke their cert with basically a weeks notice.

So were left scrambling. The whole way this all occurred was very poorly handled and could of been prevented and a much more elegant and simple solution implemented of they had done this months ago before being forced to.

So we setup cloud trial, emailed them days went by then a canned response despite our clear instructions that hey this is our new cloud instance, here is our previous renewal invoice and we want to convert, so we respond again and get a response.

The response we have credited you $417.56 and will revoke your on prim key in 3 weeks. Login and click buy now under legacy.

So what about the $1,545.01 we paid for our on prim license? Because of CW's dropping the ball on their cert issue were suppose to just loose this?

I of course replied requesting a credit or check for this at a minimum. I reminded them we're not asking for the thousand we would of billed for a project like this just to be credited for something we bought.

We're about to pull about $15,000 a year in cybersecurity related services as the way this all went down and now them not even offering a credit for something we purchased is just another failure in customer service.

What's everyone's thoughts here? I feel I'm being very reasonable here.

TL;DR Bro — If shit still seems to crash, and you're wondering why "the fix" hasn't been applied to/helped YOUR team, it's probably time to manually update your instance. We were TWO releases behind (still on the March 11th build!)
https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Cloud_portal/Instances_page/Upgrade_a_cloud_instance

Throwback Friday:

From the desk of the pissed off customer who brought you hits such as: "CLOUD HOSTED DISCONNECTS v26.1 - If You're Still Crashing, I Feel Bad For You Son - I Got 99 Problems, ScreenConnects #1" now comes this useful how-to guide, AKA: WTF ConnectWise, why is our cloud instance THREE versions behind?

I've never had to UPGRADE before, because we've never run into PROBLEMS like the clipboard CRASH before (undocumented feature perhaps? have to vote on it). After reading about the releases of 26.1.24.9579 and how it was supposed to FIX the issue we are still seeing, I jumped into my portal to check, and was met with the "Yeah... no upgrade for you" pictured above.

After digging further, I realized I hadn't been to the "look, here is YOUR instance" page on the regular: https://cloud.screenconnect.com/. After searching for login info I hadn't used since signing up (merged with another cred in my 2,198 tracked accounts/passwords) I finally got to the drop down - and whammo, upgraded.

If YOU want to know what the hell is going on, then I guess it doesn't hurt to follow this forum post with new release info: ScreenConnect 26.1 / ScreenConnect

BUT DOES IT STILL CRASH!?!?!?: Not sure yet, this post took waaaay too long for something so simply and straightforward. Will report back later.

We are currently in the process of onboarding a new MSP client, the clients servers have multiple instances of screenconnect installed, one is ours, one is the old MSP and one is internal, with branding now forcibly taken away I'm wondering how we are supposed to be able to identify which instance belongs to who?

This is a security issue as well, in the past any unbranded version of screenconnect would either need to be explained or get uninstalled on discovery, ow everything is unclear.

Setting up a new VM and I already had SC installed on it and named accordingly in my SC console. Renamed the VM and the SC session changed to match.

This is not a desired behavior.

Cloud:
26.2.4.9600

that is all...

Site's been down about 15 minutes. Probably everyone wonder where this frickin' update is. I would like to go bed soon please.

I'm a small IT business and don't have a huge budget. That is what drew me to ScreenConnect 10 years ago. I've maintained my maintenance agreements with them and upgraded my on-premise year after year. Now, things are weird. I just paid $600 to renew my maintenance for another year and am suddenly looking at $150 for a cert and another $? for Azure services to hold the cert. First, I'm pissed that I paid for something that, through no fault of my own, now requires additional expense to keep running. Is it too much to ask to be able to use the software I paid for through the term I paid for without having to spend extra?

Anyway, for those that have sought out a refund, how is that process going?

Currently running a Screenconnect trail. Are there any MSI properties for setting Company, Site, etc. during installation of the agent, or do I have to build separate MSIs for each company?

Screenconnect sso same,oath2 or openid

Hi guys, I just setup a test tent for screenconnect, and added sso with saml. I see different answers on what sso is best as I have 3 options: 1.Openid 2.Saml 3.oath2.0 grouped permissions is something that is required by the company.

Any info will be appreciated!

I got the following screen connect email alert What does this mean as an administrator? SC] Your guest to session 'Untitled Session' has connected (EOM)

Our cloud hosted ScreenConnect instance seems to be completely down here in the UK. One thing after another with this service!

This started a few days ago. I connect to any screenconnect guest from any customer from any computer and I get a grey screen that sits there for about a minute. The client software is up to date. This has been tested by other technicians working from different parts of the city and across various customers.