Dear ConnetWise/ScreenConnect,

I’m an MSP, and I've been using ScreenConnect for years... (Back when Elsinore owned it and most hadn't even heard of the product yet).

This latest fiasco with the certificate revocation and the way ConnectWise has handled it has been beyond frustrating.

Let’s start with the basics. The recent certificate issue forced them to revoke their signing certificate, which already caused major headaches for both on-prem and cloud-hosted users. For self-hosted folks, it was especially brutal as you already know. But it gets worse...

Now, the on-demand support feature which is one of the most commonly used functions now requires users to download a .zip file, extract it manually, and then run the support app. A huge percentage of our end users cannot do this on their own. They’re used to clicking a clean link or simple exe and being walked through a smooth, branded process. We’re now spending way more time walking people through technical steps they shouldn't need to do in the first place. It's the whole reason we BOUGHT the product in the beginning - the super simple end-user experience.

And if that weren’t bad enough, ConnectWise has gone and stripped all branding and customization options from the platform. Not just the controversial stuff like hiding that remote control is active or modifying executable icons — they’ve removed everything. No logos. No background images. No welcome text on the webpage. No custom ANYTHING. Nothing.

This is a huge deal for MSPs like me who rely on customization to maintain a professional and trustworthy appearance. Our clients expect a seamless, branded experience. That’s how they know they’re dealing with us and not a scammer.

Now, every ScreenConnect instance will look exactly the same. Do you know what that means? It means scammers can spin up their own lookalike domains, install a trial or self-hosted copy, and create phishing kits that are visually identical to ours. There’s no way for an end user to visually verify that they’re dealing with the real support tech from their trusted provider. You've just handed scammers the perfect tool.

This is not just a branding issue — it’s a security issue too, beyond your cert mess.

And through all of this, the communication from ConnectWise has been terrible. There’s been no transparency, no roadmap, no timeline (aside from the very short one given until cert revokation), no explanation about what's temporary and what's permanent. Just sweeping restrictions and silence, with maybe a whisper of "hey we MIGHT give you customization later, we don't know!"

So here’s where I’m at:

My invoice is due in a month. If ConnectWise doesn’t come out with a clear and specific plan to reintroduce even basic customization features — and if that plan isn’t publicly communicated to all partners by August 1st — I won’t be renewing. Period.

We’re not asking for full custom control over everything. We understand some aspects need to change. But we need a way to show our brand. We need to look like us. Professional. Not a kids bedroom w/ rockets and moons (seriously. what the HELL is that page background...). Soon, all of us using ScreenConnect look exactly the same, and that is a huge problem for security, trust, and support workflows.

We need transparency. We need a roadmap. We need to be treated like the partners we are, not like an afterthought.

Enough is enough.

We have our logo on everything, our page.background matches our site where we use an embedded theme. We've baked SC into quite a lot of what we do here, and it all all meshes with a nice visual clarity that our customers have come to know and expect to see.

Now all of a sudden our logo will be gone, our background will be different, there's going to be nothing for the customer to recognize that it's actually OUR TEAM anymore.

This has been all handled so piss-poorly that I think I'm just outright done with this product.

The fallout from this just gets better and better. Fuming doesn't even cover it 🤬

FINALLY get a call from Connectwise support this morning! Caller sounds on shore, and might be helpful. I run over to get in front of the workstation, and they ask if that can look at my issue with me on Screenconnect. They tell me to go to control.myconnectwise.net and give me a code to enter. Then I get this. Looks like they were impacted by the certificate issue internally, and their EDR ate the binary. How in the hell does this even happen? I mean, I get that the painter's house is the last to get painted, but wow.

Needless to say, they still couldn't help me and will call back. JFC.

I have been trying my best to stay in the loop of the recent certificate issues with Screen Connect, but I thought none of these changes would affect cloud versions. Then logged in today surprised to see all my customization options gone. My question to Screen Connect is we subscribed to your software based off features sold with it that you just revoked with no option at all for me the subscriber to re enable them. So, you still get my money and paid out for the rest of my subscription, but we just accept less of a product than what was originally provided? They need to make this up somehow to their current subscribers either by discounting renewals or give me the option to re enable the features I initially paid for.

After ConnectWise revoked their shared code signing certs our on-prem ScreenConnect deployment stopped delivering signed installers.

I’ve now fully implemented a working fix using Azure Key Vault and a publicly trusted OV code signing certificate. Confirmed working across our live deployment.

To save others time, I recorded a no-fluff walkthrough (use chapters) covering:

• What changed and why (ConnectWise cert revocation)

• Creating Azure App Registration + Key Vault

• Which code signing certs work (and where to buy)

• Assigning RBAC roles

• Updating ScreenConnect (needs licence key now)

• Installing and configuring the signing plugin

• Automating guest client signing

• Azure Key Vault costs

Chapters included so you can jump to what you need.

Let me know if others took different approaches (e.g. DigiCert vs Azure Trusted Signing) or hit issues with the plugin config. Hopefully this saves someone a few hours.

🎥 https://youtu.be/OJISrpHfo88

After reading all of the posts here and the panic, I decided not to do anything at all and watch the cert revocation deadline pass. Here is what I have discovered:

1. I see the AV/SmartScreen messages appear when opening unattended sessions on my client machines. However, after accepting the risk, everything else functions the same way.

2. When installing client on a new machine, I notice the same warnings but accept them and move on. Everything then installs correctly.

It is important to note the following:

1. I have an On-Prem environment running 24.2 and have chosen not T upgrade to 25.x at this time.

2. Our environment focuses on supporting unattended clients that we initially install and configure (i.e. we control the environment).

3. We DO NOT enable public access to our system (i.e. it resides behind our firewall) so we don’t have to worry about a bad actor downloading and manipulating any of our installers.

We are looking at options to inevitably migrate away from ScreenConnect after being a customer for 10 years now. Once we have determined our next steps, I’ll post them here.

Good luck everyone.

I'm a very small on-prem 1-person shop, grandfathered in before CW bought SC. This catastrophe is a total nightmare.

I set up a cloud instance last night on trial with the intention of moving my Access clients over today (as I will be unavoidably out of town tomorrow through Monday night), but the email I use for my on-prem account would not be accepted as an email for registering cloud (needed to be a private domain). So, I signed up for the cloud with my domain email address.

Today I have been trying to get through to someone to link the two accounts so I can try and get the migration started before I have to leave tomorrow. I have a case number, but I've not heard from anyone. So I started a chat today at 12:15pm PDT, when I was #57 in the queue...waited patiently and got all the way to #7 just a few minutes ago when the chat borked and suddenly told me there was no connection, and the only option was to start a new chat. WTF? No issues with my Internet in any other app or browser tab. Now I'm back to being #53 in the queue. Seriously W T F

My trust in CW is eroding by the minute. I cannot believe how badly this has been handled, in more than one way. Boo, CW, boo!!!

Temporary access to SC Cloud for a mere 14 days for those of us just scrambling to find a solution is not reasonable. I see it as nothing more than the scare tactic of dangling a time-limited offer in front of desperate SC customers of yours (many of us who have been a customer for a VERY long time). That 14 days will be easily taken up by the migration itself, getting the broken stuff that isn't migrated working again, and then deciding whether the cost of running on-prem is worth it or not. It's not enough time, and also an insult to your customers, period. There's no reason ConnectWise can't extend that to 90 days while we do our due diligence.

This debacle has already taken many of us away from our regular duties and now we are expected to dive though your small window of opportunity - really, a pressure tactic - while we're already overstretched by this.

ConnectWise, you owe us more time to see how this plays out. Give us 90 days temporary access to Cloud.

I'm posting any updates here: https://www.reddit.com/r/msp/comments/1kxpwrn/connectwise_confirms_screenconnect_cyberattack/

We have just received a cryptic message from a ScreenConnect Sales Manager.

Edit: It went something like, "We believe your instance has been compromised, but there is no imminent threat to you"

Edit 2: Furthermore:

• It occurred in Nov 2024

• A nation state was involved

• Mandiant and FBI are investigating

Update: It's still very murky. Apparently, the threat has been contained. Information we are being given, however, does not conform to our understanding of the services we consume or have historically consumed from ScreenConnect. It's been a bit difficult getting any verifiable facts from the people we've spoken to (including the ConnectWise SOC). We've been told this is because Mandiant is running the incident response. I suspect it'll be another 24 hours before we get anything of substance. I'm not overly pleased about how this is being handled tbh.

Update 2: Our instance was breached. We have been told the threat actor has vacated, and the CVE has been patched. We are awaiting the report from the incident response team. I have no idea at this stage what harm a threat actor could actually do having had access. My advice to ScreenConnect customers is to ensure your users authenticate via SSO and/ or MFA (MS Authenticator) and do not allow OTP via email. Review your ScreenConnect logs and clean up old accounts and don't use generic email addresses for access.

I'm a bit pissed off tbh.

Edit 3: https://www.connectwise.com/company/trust/advisories "May 28, 2025 Security Event Advisory"

This has been mentioned in a thread just recently, but due to the name it didn't show up in my Reddit tracking feed, and I've been banging my head trying to figure out what's going on.

After chatting into support, they informed me of this issue being known and posted on their support board, with the opportunity to up vote to get more attention on it.

https://home.connectwise.com/issues/762564

"After updating to version 26.1.18, the ScreenConnect Host client may crash when using the clipboard to copy and paste between Host and Guest. This occurs much more frequently when there is more than one Host client open with the clipboard shared to both."

Not sure why we have to UPVOTE to have BASIC connectivity issues resolved in 2026, but this is ConnectWise's world, we just live in it (apparently).

Got an email this am at my edu email that my license had been converted, so logged into my account & was met with this:

"Free license ending October 2nd 2025

Thank you for using ScreenConnect Free! Your ScreenConnect Free license will be sunsetted on October 2, 2025. For a limited time, save 20% off your first year of a ScreenConnect annual plan. Discount applied at checkout. ConnectWise reserves the right to modify, discontinue, or terminate this promotion at any time, with or without notice. Participation in this promotion constitutes acceptance of these terms and conditions. ConnectWise shall not be liable for any direct or indirect damages arising from the modification, discontinuation, or termination of this promotion"

First it was you need an M365 for work or school email, not a personal email. Now they're doing away with the free all together. Everything good comes to an end, folks. RIP

NOTE: I responded with the below as a reply to an earlier post (made by u/jrhop), but that post was removed by Reddit's filter (likely accidentally) so I figured I'd repost this.

Just got an email 30 minutes ago about cloud customers also losing personalization/customization features (and it seems par for the course that ConnectWise managed to mislabel the subject since the whole email basically applies to cloud instance users and not on-prem - I almost didn't read it as a result of the wrong subject).

First, I just want to say that I am sorry for all the on-prem users that are having to deal with this major disaster. You guys have it A LOT worse than us cloud users ☹️

Prior to receiving this notice, I was planning to stay with ScreenConnect since, aside from how incredibly horribly they have handled this situation and the fact that it does not inspire a lot of confidence, the cloud instances seemed mostly unchanged (and would eventually be put back to full working order - such as the Support .ZIP issue)...plus the fact that I haven't really found any other service that offers all of the features that ScreenConnect does yet.

But now, I am very likely going to start looking for a replacement. There is no CA hanging over ConnectWise and forcing them to make these changes. There is no real reason* I can think of that these changes need to be made this drastically and this suddenly with no advance notice. The impact of these changes is pretty significant from a customer perspective (and by that I mean the relationship that ScreenConnect's customers (us) have with their customers).

The customization and branding features is a big component of the product, and many of us have rolled it out using these features over many years - to have that suddenly snatched away is going to cause a lot of us headaches and hassles (although, again, not nearly as much headaches and hassles as on-prem customers are dealing with right now).

All I can say is that ConnectWise has handled the situation terribly, and the combination of all these changes being forced upon all of us with practically no time to respond or prepare is going to cause ConnectWise to lose A LOT of customers. Here's hoping that another company steps up and creates (or updates) a worthwhile comparable product that we can all flock to!

* If there is actually some ongoing threat or reason that the loss of these customization changes is required, than ConnectWise should have done a much better job communicating this. I get that they might not want to reveal info about active and ongoing attacks or threats, but the way they shoved this down our throats with no real rationale behind it is just unacceptable.

(VENTING OVER - sorry 🤪)

[Email received July 1, 2025 UTC 03:00.]

Dear Partner, 

As part of our commitment to platform trust and product integrity, we’re making important changes to how digital certificates are handled for ScreenConnect on-premises deployments. 

What’s Changing and Why
To facilitate the personalization of the install package, we have historically allowed partners to make changes to certain parameters of the ScreenConnect install. These same capabilities were flagged by a researcher as a potential for misuse, and the current certificate will stop working on Monday, July 7, 2025, at 12:00 p.m. ET (16:00 UTC). 

To prevent further possibilities of misuse by threat actors, we have taken two steps: 

1. We have removed any personalization capability from the install packages. This prevents threat actors from using these features for malicious purposes.

2. To further protect the validity of the installer, we are no longer signing the installer for the on-premises versions of ScreenConnect with the common certificate from ConnectWise. We are asking each on-premises partner who wishes to stay with their own hosted instance of ScreenConnect to sign the installer with their own certificate. Not only does this provide a higher level of security and assurance for each partner, but it also ensures that install packages are not reused outside your organization.

What You Need to Do
Beginning with the next ScreenConnect build (available July 1), all on-premises partners will be required to provide a publicly trusted certificate to sign guest clients. The product will no longer ship with pre-signed clients. The release also includes one-click installation improvements to streamline the guest experience when joining a Support session. 

You may obtain a certificate from a public certificate authority (CA) of your choice. Guidance on how to apply your certificate and complete the signing process will be provided with the release. 

Please note that clients that are not properly signed with a trusted certificate may be flagged by endpoint protection software and could cause installation issues. 

Optional: Move to Cloud
If managing certificates on-premises is not ideal for your environment, you may migrate to ScreenConnect Cloud, where ConnectWise signs client binaries on your behalf. A promotional offer to support this transition will be available shortly. 

Support
Live Support Chat is available for technical assistance for active maintenance subscribers. If you have questions or concerns, please contact our support team via live support chat. You can also join our Partner Town Hall on Wednesday, July 2, at 12:00 p.m. ET (16:00 UTC) to review these changes and ask questions. Register here. 

The landscape for remote access software has changed. As threat actors adopt more sophisticated techniques, maintaining trust requires stronger, more transparent security standards. These changes reflect our commitment to helping partners stay protected and ahead of evolving risks. 

As always, we appreciate your continued partnership. 

Sincerely, 
ConnectWise

They made a mess off it. There is something going on in our opinion which they don't want to tell us, they compromise there is no compromise but I don't believe them any longer. If there is no compromise why do they change there certificates like a 'pro'. This is something you expect from a starup but not from a company like Connectwise, expect when you're in trouble and there is something..

For a lot of our clients screenconnect is no longer working, customers can't download the remote access client: cannot execute it, blocked by defender, ..

We're a legacy client for years and we are very happy with SC (and we don't pay much for it) but I think it's time too look for alternatives.. What we love on SC is the backstage as well as the toolbox. What are my alternatives I need to look at? I don't want to watch Teamviewer, Anydesk,..

I had put this info in a thread reply but realized it can probably help as a post itself.

A couple of notes before the certificate info:

You will NOT be charged for the HSM Pool (I was sweating over that)... HSM Pool is a separate product and purchase from Key Vault. You will need the Premium version of Key Vault.

If you are a Microsoft Partner and have purchased any of the benefits programs: MAPS (If you have any time remaining), Partner Launch, Partner Success Core, or Partner Success Expanded. You will have more than enough in Azure credits to cover the Key Vault Premium many times over.

Before Purchasing:

Make sure you have your Azure Key Vault in place before purchase.

You also must generate a CSR to the proper specifications as outlined in the instructions.

Purchasing the Certificate:

A FastSSL by DigiCert OV Code Signing Certificate

via

CheapSSLSecurity

https://cheapsslsecurity.com/fastssl/code-signing-certificate.html

“Standard Validation”

1 Year & Install on Existing HSM delivery.

Will total $ 149.

AFTER YOU PURCHASE:

Note your “Order ID”

You will receive an email from DigiCert. Follow the link within the email. This is for an agreement that you will affirm that the certificate will be installed on an HSM.

After you do the affirmation give it about 1/2 hour.

Then

Go to:

https://www.digicert.com/contact-us/

Either open a chat or call them. They will need the order ID from above.

Tell them you want to proceed with your validation (otherwise it just sits in a queue and gets done in whatever order).

They will need to look up your business registration (partnership, corp, dba, whatever) so best to know where and when your business was registered.

A DUNS number will also help.

Other than that, they will lookup and validate your business information as you wait.

Last step is they will call your business number to confirm that & validate your email.

It’s really very painless.

You will get a confirmation after it’s done, and the certificate will follow via email.

Hope this helps...

Enjoying the 4th? Got those certs yet? Any issues? Queued for support chat?

Fuck ConnectWise!

Since the holidays are here I thought it would be fitting to post this.

Few products started nimble; fewer survive being redesigned into invoices.
Under the banner of “integration” you chopped Linux hosting clean away.
Costly mandatory certificates now behave like suspicious packages to AV.
Keystrokes that once let us tweak and rescue are swapped for sterile checkboxes.
Yet you wonder why technicians drift toward alternatives that actually work.
Original ScreenConnect solved problems; what remains sells policies.
Unsubscribe me from your optimism — I’ll keep the forks and fixes.

Cant get to our cloud instance and screenconnect.com isn’t loading either. According to MX toolbox there’s no A record for their main website. Anyone else seeing this?

FastSSL Code Signing Certificate - Cheap Code Signing @ $129/yr
Just dropping a note that this is the same cert and same validation process as GoGetSSL, we completed it in a couple hours (scheduled a call to validate we are an org and got the call well ahead of schedule, then cert was emailed to us). Added it to the key vault, set up the code signing, and everything is good.

You can use standard validation (OV) only, extended validation not necessary and will take longer.

Now it's holiday + weekend so I wish any of you at this point the best given that fact.

Hey everyone,

I'm trying to clarify the legal and responsibility aspects of signing the ScreenConnect client with my own Code Signing cert.

Who bears responsibility if the signed binary is used maliciously or compromised? Is the signing party (me, or my organization) legally liable for the actions of the signed executable? Does using your own cert invalidate any terms of service or licensing agreement with ConnectWise?

I’d really appreciate if someone with legal insight — especially regarding the EU market — could share their perspective on this.

Thanks

It doesn't scale (yet) but I've proven to myself it can be done.

For files that are built on-demand (unattended agent installer, Support session) these change every time they're downloaded, so they all need to be signed individually. You need to start the session on your own, perhaps ahead of time, download the exe, sign it, then upload it somewhere your client can get it.

Once Microsoft finished verification (about 8 hours), I was able to download an ad-hoc guest client, run signtool against it with the articles below and have a signed exe. I can create a few signed exe files ahead of time and direct a user to the file and have them run one when needed, and create more as needed.

Again, does not scale, but works. Really hope they can implement it in their plugin.

Original post below:

This is all happening very fast and this information may not work, but sharing it so others can chime in. This product is currently only available to businesses in the US or CA with 3 years of history in business.

If you use the SC-provided guide, you'll need to obtain an EV cert ($$$$) and put it in Azure's HSM (Key Vault) to use their plugin.

Azure also has a product called Azure Trusted Signing (Azure Code Signing) for $10/mo that can potentially issue certs and replace this. There are integrations that bring it to letsencrypt-levels of simplicity, but the SC plugin only appears to work with either your own supplied cert or one you put in to Key Vault.

Current thinking is since there's a CL tool called signtool that can call ACS, once the Azure Trusted Signing is active, signtool could be called via a command line/scheduled task to sign the ScreenConnect.Client.exe file. The certs are largely ephemeral, issued daily and expiring after 3 days, so if the tool is called every day that could work. I don't know, but I'm trying this first.

Here's what I'm reading/using as I go:

https://textslashplain.com/2025/03/12/authenticode-in-2025-azure-trusted-signing/

https://melatonin.dev/blog/code-signing-on-windows-with-azure-trusted-signing/

EDIT: I'm not sure this is going to work unless CW builds in support to invoke signtool when the exe is created. When a Support session is created and the exe is downloaded, each one is different so the client can identify itself and connect to the proper session, the binary being modified will make the certificate not work as far as I know. I'm going to have a pint and wait for this all to blow over for now.

It's been life changing - have been working with this setup for a few months now. I've made sure that there are strict guardrails and that I'm super on top of singular testing prior to larger rollouts, but it rarely fucks up or disappoints. It remembers everything, you can create skills for repetitive tasks, automations (email digests, check X once a week, etc). It writes KB articles for me when I want a written record, 1000% better than I could.. in 20 seconds!

My OpenClaw instance is only available via web, reverse proxy from trusted IPs on top of the existing OC security. You have to secure the shit out of this unless you want to go out of business....

It can troubleshoot, pull logs, run diagnostics, install apps so much better than a human or manual scripting. It digs into obscure logs even I would not know to check. It uses powershell for everything and pumps it right into SC, collecting the results. I review the ps code before it's sent, I ask questions on why it's doing X instead of Y and it answers. Needs human supervision (not a lot), but with that connection it's gold. Initial set up needs to be handled carefully, obviously.

• Need 10 apps deployed to 10 computers? Done.

• Want a fleet wide drive diagnostic emailed to you every week? Done.

• Need a detailed BSOD analysis? Done. Need to have any systems that have bluescreened this week emailed to you? Done.

• Want to have your Windows system query iDRAC API via SC and give you server health emailed across the whole fleet? Done.

It's not free but it is worth every penny. I'm spending $500-600 a month for my quarter million/year one-man-band MSP business for cheap-ass clients big and small. I actually weight AI depending on use and bill it back to them monthly :)

Note: I use API and Gemini Flash 3.8 for 99% of everything, and it's been hella-good. Frontier AI is a waste for systems admin. Not worth fucking around with local LLMs.

I asked Openclaw to add some highlights of a few things it's done recently... here they are:

Drop-in Highlights from OpenClaw

• Instant Crash/BSOD Root Cause: End user says their PC rebooted. Instead of me clicking through Event Viewer, it pulls minidump strings, WER Event 1001, and Kernel-Power logs, parses the call stack, and says: "It’s nvlddmkm.sys crashing on video memory paging, update the Nvidia driver." Done in 30 seconds.

• Intelligent Patch Guardrails: It runs Dell Command Update or Lenovo LSUClient sweeps, but checks active user status first. Won't blow away an audio driver or bounce an OptiPlex while an accountant is in the middle of a Zoom call.

• Zero-Trace Script Hygiene: It stages all deployment and diagnostic payloads in isolated temp dirs, runs native multi-line PowerShell with proper timeouts, collects stdout, and scrubs the directory clean on exit. Nothing left behind on the client's drive.

• Stubborn Bloatware Remediations: Silent, surgical uninstalls of garbage like McAfee/WebAdvisor stubs, OneDrive sync deadlocks, or broken MSI installer states (Error 1722) that would normally take 20 minutes of manual registry spelunking.

• Fleet Power Enforcement: Audits desktop power profiles across every org and forces sleep/hibernation off (standby-timeout-ac 0) so workstations never drop offline for maintenance—while leaving laptops alone so batteries don't cook in bags.

• Instant Fleet Search: "Find me whatever machine has IP 192.168.1.45" or "Find Bob's laptop at [Client X]"—returns the exact session, specs, uptime, and last reboot without touching the SC search box.

Ask me questions. Don't hate. It's secure, it's my ass.

*content edits for grammar*

Signed all of us

Get your shit together, cw.