Client policy determines which incoming sessions are permitted and what a connected operator may do. Risk increases when unattended access is deliberately enabled with weak or reused authentication material, allowlists and multifactor authentication are omitted, saved access tokens are not revoked, or permission profiles grant more capability than required. These are configuration findings, not universal defaults. AnyDesk, for example, documents that Unattended Access is disabled by default and requires a configured password; interactive requests otherwise require a user decision according to the selected policy.
# on a host, review the client configuration for the open settings
# unattended access enabled? allowlist configured? approval required? 2FA on?
# (locations: TeamViewer/AnyDesk registry and app-data config)
reg query 'HKLM\SOFTWARE\WOW6432Node\TeamViewer' 2>nul # inspect settings
# record the actual values and compare them with the organization's policy
Exploitation notes#
- Unattended access can provide recurring entry when its valid authentication requirements are met; see unattended access.
- Confirm whether an allowlist, interactive approval, multifactor authentication, account assignment, or device trust provides an additional gate.
- Review saved access tokens and their revocation behavior as well as passwords; AnyDesk documents device-specific tokens for saved logins.
- Assess the permissions granted after authentication, because successful connection does not necessarily imply unrestricted control.