Remote Desktop Limitations
Last updated: 2026-10-18 · Applies to: MantisRMM Remote Desktop on Windows endpoints
MantisRMM's remote desktop feature works in nearly every scenario, but there is one specific Windows behaviour that operators should know about before they encounter it during a support session. This page documents that limitation, explains why it exists, and gives you the simple workarounds.
The Windows 11 lock screen and login screen
Symptom: when a Windows 11 endpoint is at the lock screen (after the user pressed Win+L) or at the login screen (after sign-out or reboot), the operator's remote desktop view may show only a static wallpaper image — the password prompt, “Other user” tile, or Ctrl+Alt+Del message is not visible.
Why this happens
Microsoft deliberately restricts which processes can read pixels from the Windows secure desktop (the special desktop that hosts the lock screen, the login UI, and UAC consent prompts). This is a security feature designed to prevent malware from spying on credential entry. Remote-desktop tools need a privileged system component to display it, and behaviour varies by product, Windows build and configuration. For MantisRMM's capture paths:
- GDI screen-capture (the universal Windows graphics API) returns all-black frames when called against the secure desktop on Windows 11 24H2+, because the lock-screen UI is rendered via DirectComposition swap chains that GDI cannot read.
- DXGI Desktop Duplication (the modern high-performance capture API) returns
E_ACCESSDENIED on the secure desktop when called from any token other than Winlogon itself.
- Windows.Graphics.Capture and the Magnification API have the same restriction.
The MantisRMM agent already runs as a Windows service with LOCAL SYSTEM privileges — the highest unprivileged account Windows offers — and even that isn't enough to bypass the secure-desktop capture restriction by design.
What other remote-desktop products document
| Product | Vendor-documented lock-screen limitation? | Public reference (checked October 2026) |
|---|
| RustDesk (open source) | User-reported, no official statement | Issue #14874: on Windows 11 the unlock screen's password page doesn't display (April 2026) |
| AnyDesk | None found | AnyDesk Help Center: when installed, AnyDesk can interact with UAC elevation requests |
| TeamViewer | None found | TeamViewer KB “Control UAC during a TeamViewer session”: with the TeamViewer service running, UAC prompts and Windows logon can be controlled |
| ConnectWise ScreenConnect | None found | ConnectWise KB “Control Windows UAC dialogs”: access sessions run elevated through the installed agent |
What to do today
If you are an operator: ask the end user (via chat, phone, or in-session notification) to unlock their machine before you reconnect. If the user is already gone for the day, schedule the maintenance work for a window when the machine is awake and logged in.
Additional approaches that work well:
- Reboot the endpoint and reconnect immediately. The post-reboot login screen is captured through a different path that works reliably on Win11. Once you log in remotely, you have full session control.
- Use the “Send Ctrl+Alt+Del” toolbar action in the MantisRMM remote-desktop viewer. On some Windows configurations this brings the credential UI into a state that briefly becomes capturable.
- Schedule scripts and workflows for unattended maintenance. Script execution, software install, patch deployment, and file transfer all work regardless of lock state — only the visual remote-desktop view is affected. For unattended tasks, prefer the Scripts tab or a scheduled Workflow over remote desktop.
What we are doing about it
MantisRMM has a planned Q3 2026 milestone to ship a Windows Credential Provider DLL — the Microsoft-supported path for rendering a custom UI on the secure desktop. When that ships, the lock screen and login screen will become fully capturable inside remote sessions on all Win11 builds. This is on our roadmap and we will publish a release note when it's shipped.
We chose not to use the alternate workaround — installing a virtual display driver onto every endpoint — because it adds a synthetic monitor that's visible in the user's Display Settings and complicates multi-monitor scenarios. The Credential Provider path is invisible to the user and only activates on the lock/login screen.
Other remote-desktop limitations to know about
- UAC consent prompts on Windows 10/11 — if Group Policy enforces UAC's secure-desktop mode (the default), UAC prompts appear on the secure desktop and have the same capture limitation as the lock screen. The MantisRMM agent automatically disables UAC's secure-desktop mode for the duration of a remote session so UAC prompts remain visible and clickable; the original setting is restored when the session ends.
- Multi-monitor cursor on iOS Safari viewers — on iPhone Safari, the operator's cursor is rendered by the browser at touch coordinates only; precision pointer work on a 3+ monitor remote is best done from a desktop browser.
- Hardware-accelerated video playback — Netflix, Disney+, and other HDCP-protected video sources render as black frames on the remote view (Microsoft's HDCP enforcement). This is by design and matches every other remote-desktop product.
← Back to documentation