Remote support software
Free remote support software for IT teams and MSPs
For IT teams and managed service providers (MSPs) who support a queue of machines, not one. Nelkira gives every PC you look after a nine-digit number. You get in by password, or the person at the desk clicks Allow. The machine keeps a record of what was done.
Two ways in, for two kinds of support
Unattended: the password or a remembered device lets you in
Every machine shows an access password. On machines you own or manage, type it with the number and you go straight in, with nobody at the desk; on a machine installed for use while someone is here (Setup’s default), as long as someone is signed in to Windows there and Nelkira is running. From release 0.4.1 that password is a new one each time Nelkira starts, so for a machine you will reach unattended, connect once with the password and Remember ticked (a remembered device needs no password and keeps working when the password changes; Allow alone remembers nothing), or set a fixed password there with the Agent__AccessPassword setting, which every Windows account that can read where it is set can read (beside Nelkira.exe, too, on a PC set up for access when nobody is there). After a restart, a machine installed for use while someone is here waits until someone signs in. From release 0.5.0 an administrator can set a machine up for access when nobody is there instead; the security statement says what that changes. From release 0.5.0 a pause made at the machine with Stop sharing lasts across restarts and updates: until someone there presses Start sharing, it refuses everyone, remembered devices included. A viewer on 0.4.0 or newer uses the password only with a PC on 0.4.0 or newer; with an older PC someone there must click Allow until it is updated.
Attended: the person clicks Allow
Leave the password blank and the person at the machine sees a prompt. They allow you or reject you. With no answer in 60 seconds, the connection is turned away.
From a phone, on the way
Nelkira Go runs in the phone’s browser at nelkira.com/app, nothing to install. The same nine digits work from a PC and from a phone. Open Nelkira Go.
Built for a support queue
Several sessions open in tabs, one per machine, with a plus for the next one. Files copy and paste in both directions, and the record names every file that moved. A short line drop reconnects on its own.
View only when you only need to look at a problem. Privacy screen hides what you are doing from people walking past. It blocks local input only where Nelkira runs with administrator rights or, from release 0.5.0, on a PC set up for access when nobody is there. It is not for hiding from the machine’s own user. A far machine with several screens shows all of them. Updates arrive quietly, signed with a release key, and install while nobody is connected; a PC installed for everyone with release 0.4.x moves to 0.5.0 only when someone there chooses Install for everyone, or an IT rollout does it.
A record your customer keeps
Every session leaves a record on the machine that was accessed, not on the engineer’s laptop. It says who connected, how they got in, when it ended, which files moved and their names, and clipboard transfers by size. It never contains content: no clipboard text, no file contents, no keystrokes, no screenshots.
Evidence of what was done to a computer belongs to whoever owns it, and a customer who can read the record can check what the engineer did. The record is a plain file today, not yet tamper-evident; anyone with a Windows account on that machine can alter or delete it (from release 0.5.0, on a PC set up for access when nobody is there, only administrators can). The acceptable use policy asks four things of support companies. Agree access in writing. Make sure the people at those machines know. Give each engineer their own way in rather than one shared password, and remove access when someone leaves. Leave the record alone.
Your relay, on your servers
A connection tries the local network and a relay at the same time and keeps whichever answers first. On a customer’s own network, two PCs on the same subnet normally talk straight to each other where Windows Firewall allows it. From your office, where a firewall refuses a direct path, the session goes through a relay on port 443. No port forwarding and no public IP on either side.
The directory, the relay and the record run on servers you control, in the country you choose. Installing your own relay is one command on a Linux box. The two machines agree their keys with each other, so a relay, ours or yours, carries encrypted bytes it holds no key for. Two limits: a connection approved by clicking Allow with no password is encrypted but not proof against an active attacker in the relay path, and nor is a password sign-in from a viewer older than release 0.4.0 (from 0.4.0 the password is proved, not sent; SPAKE2, RFC 9382): an older viewer still sends it to whichever machine answers the number. Everything else is in the security statement.
What to tell a customer before you install
They need no account
The person you help does not sign up. The installer from the download page is enough, and nothing is recorded beyond an anonymous platform and country count.
SmartScreen will ask
The installer is not code-signed, so Windows SmartScreen asks before it runs. Check the SHA-256 on the download page until that changes.
No certification yet
No ISO 27001, SOC 2 or HIPAA attestation, and no third-party audit so far. Where we gain one, it will be published on the security statement.
Their staff should know
Tell the people at those machines that remote access is installed and how to spot a session: an amber ‘Screen shared’ pill sits on screen the whole time, except on Windows’ lock, sign-in, Ctrl+Alt+Del and administrator-prompt screens.
Questions support teams ask
Is there a limit on technicians, devices or sessions?
No. There is no device limit, no session timer and no seat count to negotiate. Paid plans for organisations are planned for 2028, and the shape will be published on the pricing page well before anybody is asked to pay.
Does it work through the customer’s firewall?
That is what the relay is for. Where a firewall refuses a direct path, the session goes through a relay on port 443. Two PCs on the same subnet still talk straight to each other where Windows Firewall allows it.
Can the customer see what I did?
Yes, and that is deliberate. The record on their machine shows who connected, how, when, and which files moved by name. It holds no content, so it never shows what was typed or what was on the screen.
See also: free remote desktop software for Windows, remote desktop for hospitals, and the full features page.