A support ticket is closed, the supplier has changed and the employee has logged out. None of those facts, by itself, tells you which remote-support paths remain available to a company computer. The useful question is who can connect, through which tool and under whose approval.
Remote support can be essential for maintaining business systems. It needs an access lifecycle, including a documented way to remove access. This guide focuses on unattended device access and supplier handover; it is not an assertion that any particular product or current connection is malicious.
The artwork represents a remote-access review conceptually. It is not a product screenshot, security audit result or real client installation.
Distinguish a consent-based session from continuing access
Microsoft documents Quick Assist as a session flow with a time-limited code, permission to share the screen and a separate request for control. Staff should verify the helper through their established support channel before approving a session.
By comparison, AnyDesk's unattended-access documentation describes connecting without a person present to accept. Its guidance also notes that portable and installed versions can support unattended access. An installed-app list alone is therefore not a complete access review.
Identify the actual tool, platform, version and configuration. Do not infer the consent or authentication model from a familiar logo. Closing a window or locking Windows is not sufficient evidence that every other remote-access route has been revoked.
Build a register around access paths
As a proposed inventory format, record one row for each tool and device group: business purpose, accountable owner, supplier, administration portal, authorised users, authentication method, permitted actions, available session evidence and removal procedure. Record approved exceptions with a review date.
Cover the finance PC, reception machine, servers and shared devices as well as ordinary laptops. Ask whether a device is managed from a supplier's account or your organisation's account. Do not put passwords or recovery codes in the register; record where the approved credential process is owned.
A business cybersecurity review of remote-access tools and supplier permissions can establish the scope. Request a Remote Access Review if the current provider cannot explain every approved connection path.
Check controls on the actual remote endpoint
AnyDesk's security and offboarding guidance covers unattended-access passwords, two-factor authentication and access-control lists. It also distinguishes address-book and licence administration from endpoint access controls. Removing someone from a portal should not be treated as proof that a shared endpoint password no longer works.
Ask for a demonstration of the intended restrictions on a designated test device. Which account or client may connect? What can it do? Is additional authentication required for the relevant connection mode? Does the approved support team retain a controlled way to help after a change? Exact options depend on the product, platform and subscription.
A review should also ask who can alter those restrictions and how configuration changes are detected. A setting that only one departing technician understands is an operational dependency, even if it was originally configured correctly.
Make supplier exit an explicit access change
Use a planned handover with a named business owner. The following is a suggested exit checklist to adapt to your tooling:
- Identify the departing people's accounts, endpoint credentials, approved client identities and device groups.
- Confirm the replacement support route before removing a live maintenance dependency.
- Revoke relevant identities and sessions, rotate shared secrets where applicable and update endpoint restrictions using the vendor's documented process.
- Review deployed agents, portable tools and configuration packages; remove or reconfigure what the approved support plan no longer needs.
- Perform an authorised negative test on a test device or with a designated test identity, and a positive test for the retained support route.
- Record the outcome, remaining exceptions and the person responsible for closing each gap.
Do not ask a former technician to reconnect to a production computer merely to prove revocation. Agree a controlled verification method with the administrator. If a tool offers no meaningful record of a session, document that limitation rather than claiming a complete audit trail.
Separate uncertainty from an active incident
An unexplained remote tool needs investigation. Evidence of a suspicious session, unauthorised changes or a live attempt needs prompt handling through the organisation's incident process. Preserve useful records and obtain qualified help before deleting evidence or making broad changes that could complicate the investigation.
For routine prevention, teach employees how to contact the real support team and challenge unexpected requests. A caller's urgency does not establish authority. Do not ask staff to share credentials through a support chat or approve a remote session initiated by an unverified caller.
Keep this connected to offboarding
The Microsoft 365 employee-offboarding checklist covers another identity layer. Include remote-support tools in the same handover without assuming disabling one Microsoft account automatically removes vendor-managed endpoint access. The final evidence should identify which path was tested and when, not simply say “access removed”.
Request a Remote Access Review to discuss approved support tools, unattended access and supplier-exit checks. Share product names and the business concern in the form below; do not include remote IDs, passwords or active session codes.
Official Microsoft and AnyDesk guidance reviewed 21 October 2026. The register and handover checklist are proposed review methods, not a certification or completed assessment of your devices.
