Remote maintenance — the complete guide

Remote maintenance means remotely controlled access to a computer, server or other device over the internet or an internal network to perform maintenance, support or configuration — without the technician being physically present at the device. Related terms:

• Remote support — common in helpdesk context, often synonymous
• Remote desktop — describes the technical means: remote screen transmission
• Remote access — umbrella term that also includes pure VPN or SSH connections
• Screen sharing — sub-function of a remote maintenance tool
• Helpdesk tool — remote maintenance in the context of a service desk with ticketing

At its technical core, any remote maintenance is an interplay of three components: a host (the maintained device), a client (the technician's device), and a signaling path (how they find each other). The data channel itself runs in the modern stack as a P2P connection directly between host and client; older tools relay everything through a central cloud server.

Attended vs unattended access

Cloud-relay vs P2P

Browser-based vs native app

Permanent install vs portable

Behind this question sits the most common answer to the whole topic: build a VPN, then run Remote Desktop through it. It works, but it comes from a time when there was no alternative — and it solves a small job with a very large tool.

A VPN makes the technician's machine a member of someone else's network. That is exactly its purpose, and exactly its price: whoever is in, is in the whole network. A remote maintenance tool instead opens a session to one device that starts, gets logged, and ends.

When a VPN is still the right tool

• Access at network level — SSH to headless servers, database tools, the configuration interfaces of switches and firewalls. There is no screen to transmit there.
• Devices without an agent — anything you cannot install software on: printers, network hardware, controllers.
• Permanent site-to-site links — if two company networks are meant to grow together anyway, the VPN is the goal rather than the detour.

The combination worth avoiding

VPN plus RDP is the most common and at the same time the least fortunate pairing. Two reasons. The entry point is itself a rewarding target — compromised VPN credentials have opened many incidents over the past years. And once someone is inside, RDP sits exposed on the internal network and becomes the most convenient way to move sideways from machine to machine. Going through a single scoped session removes the ground from under both steps.

And if the VPN is already there?

Then it does no harm. A remote maintenance tool that builds its connection outward also runs through a VPN tunnel; it simply does not need one. Anyone already running a site-to-site link loses nothing — they just no longer have to keep it up for support cases, and no longer have to open it for every external technician.

WinDesk needs no port forwarding and no entry point. Both sides register with a coordination service that introduces them to each other; after that the connection runs directly between the two devices, and the screen data reaches no third-party server. Details on the security page.

Six typical use cases:

Three legal frameworks are relevant for Swiss remote maintenance:

Quick orientation — detailed comparison on the comparison table:

Detailed practice guide on the security page and in the remote desktop security blog post. At the core:

1. 01 End-to-end encryption (AES-256-GCM is standard)
2. 02 Multi-factor authentication (at least TOTP, better hardware-bound via WebAuthn/Passkey)
3. 03 Hardware-bound device tokens (Secure Enclave / TPM 2.0)
4. 04 Audit trail with immutable session logs
5. 05 Granular roles + permissions (no "all technicians may do everything")
6. 06 Endpoint hygiene: patched operating systems, no compromised technician machines
7. 07 Clear off-boarding process: when a technician leaves the company, their tokens must be invalidated within hours

OUTSIDE: CRYPTOGRAPHY · INSIDE: ORGANISATION

One of the most common mistakes in tool selection: only looking at your own OS. Modern IT is cross-platform:

If you currently use a remote maintenance tool and want to switch, a cutover plan is important — not a hard switch. We recommend 2–4 weeks of parallel operation. Concrete guides:

Three routes lead to remote maintenance, and all three cost something — just in different places.

Free tiers from commercial vendors

Almost every vendor has one, and almost every one is cut for private use. The usual limits are session length, number of managed devices or monthly hours; unattended access is normally missing entirely. The second catch is less visible: several vendors detect commercial use automatically and cut the connection mid-job. If you help people for a living, treat a free tier as a trial, not as an operating model.

Open source, self-hosted

RustDesk and comparable projects publish both the source and the coordination server. The software costs nothing, running it does: a reachable server, certificates, updates, monitoring, and somebody who steps in when the coordination service falls over at half past six in the evening. For a team with its own server estate that is a fair trade and sometimes the only option — in air-gapped networks, for instance. For a two-person IT provider it is a second product that wants maintaining.

One point is easy to overlook: self-built packages do not come signed. Without a signature Windows warns on every install, and macOS refuses to start the application until somebody lifts the block by hand. Anyone who talks end customers through an installation knows what that costs.

Paid tools

They take the operations off your hands and cost money, usually per technician per month. The differences lie less in the feature list than in the billing model: per technician, per device, per concurrent session, in bundles. Growth exposes that only later — which is why it pays to look at the tier above before signing.

The free routes are set against each other in detail under free remote desktop; the comparison with the best-known open-source contender is under RustDesk alternative.

One term, two fields. People searching for remote maintenance mean either computers — which is what this page is about — or installations: controllers in a production hall, a water treatment plant at the other end of the county, a lift, a solar array, a router at a site with no fixed line. The two worlds have little in common beyond the name.

Where the line actually runs

The dividing line is not the industry but the question of whether the device runs an operating system with a screen. An industrial PC on the shop floor, a Windows-based operator panel, a Raspberry Pi driving a display — all computers, all in scope. A controller speaking a fieldbus protocol, or the web interface of a router, is not: there is no screen to transmit, and a remote maintenance tool would be the wrong instrument.