This device has more than one monitor? No extra setup needed — once you press "Start Screen Share →" above, MeshCentral's own remote-desktop toolbar automatically shows a monitor selector so you can switch between, or view, each of that user's screens separately.

Want to watch every online device's screen at once, side by side (a CCTV-style wall of all users)? Use the "🖥️ Live Screens Wall" button in the top toolbar — it opens MeshCentral's own built-in group view, which is far more reliable than building this from scratch.

⚠️ Remote unlock is not possible: No operating system allows the screen to be unlocked remotely without the password — this is an intentional OS security limit that no software can bypass. A message can be sent to a locked PC to notify the user, but it cannot be force-unlocked.

An honest note about snapshots: This is not exactly a ""moment of the click"" picture — the agent takes a screenshot ~3 seconds after seeing a new URL (to allow time for the page to load), so this is a best-effort proxy, not pixel-perfect click timing.

Limitation: CPU temperature cannot be read directly on many Windows PCs (an extra tool is needed for the hardware sensor). Reading the hard disk’s SMART status on Linux/macOS requires smartmontools to be installed — if it’s not, "Unknown" will be shown — that isn’t proof there’s no problem. The graphics card check only shows driver status, not deep hardware diagnostics.

How it works: poller/network_health_monitor.py and network_poller.js run as a separate instance for each LAN segment (each with its own segment_name) in the config) — broadcast/ARP storms and congestion are detected independently on each segment, so one segment’s problem doesn’t affect another segment’s baseline. When a MAC address matches, the exact device responsible is shown by name.

⚠️ Setup Requirement: For broadcast/ARP storm detection, network_health_monitor.py must be run with admin/root permission (Npcap must be installed on Windows). For each segment (LAN block/VLAN), a separate copy of this script must be run on a PC connected to that segment — an instance simply cannot see traffic outside its own broadcast domain; this is a fundamental networking limitation that no software can work around.

🔌 How Port-Location Works: After adding a switch above, use that switch’s switch_id with poller/switches.json to configure node poller/snmp_port_locator.js and run it (SNMP v1/v2c must be enabled on the switch). From then on, storm/loop alerts will directly show "which switch, which port" it’s on, and any MAC can also be looked up manually via the search box above. This only works with managed/smart switches — unmanaged switches don’t have SNMP.

This policy only applies to devices with opt-in activity monitoring enabled (can be toggled in each device’s "Message & Command" modal). On a violation, that device’s admins get an automatic WhatsApp/Email alert, and it shows as a red flag in the browsing history — from where you can directly press "Warn" (send message) or "Block Site".

A CSV report can be printed directly from Excel/Sheets ("Print" after opening the file) — no separate print pipeline is needed. Every hit is also written to the standard alerts feed for compliance records. The same phrase on the same device is reported at most once per 10 minutes to avoid flooding.

Process-name based detection — a determined technical user could rename an executable to evade it. This stops casual/policy-violation VPN use, not a guaranteed bypass-proof block. Devices pick up policy changes at their next heartbeat (about a minute).

Enforced by the on-device agent (Windows: USBSTOR registry + WMI watcher; Linux: usbguard). Takes effect on the device's next heartbeat cycle.

Windows PCs only (Linux / macOS agents ignore these settings). Enforced by the on-device SYSTEM service within about one heartbeat (~45 s). A local administrator can undo a setting; the agent re-applies it on the next cycle. This is a deterrent, not a tamper-proof lock.

The score is calculated every 5 minutes, from the last 30 minutes of login/session data — new/unrecognized IPs, logins outside office hours, a successful login after multiple failed attempts, logins from multiple IPs in a short time, or an unusually high number of remote sessions — from the sum of these signals. A score of 40+ is "elevated", and 70+ is "critical" an alert is generated and admins are notified via WhatsApp/Email.

The "User or device name" box matches the assigned user, the device name or the hostname (part of the name is enough). Only entries from devices with opt-in activity monitoring enabled are shown here, scoped to the units your account can access. The date filter applies to when the page was visited (device local time as reported by the agent). Reports (detail CSV, per-user summary CSV, printable PDF view) use the filters above, in your browser's local time; leave the date range empty to export everything in scope.

This backend receives the report, it does not run the scan itself: A LAN scan cannot be run directly from the browser, so the poller/lan_scanner.js script must be run from any PC in your office (node lan_scanner.js --watch runs it repeatedly every hour). Setup steps are in the backend README.