ScreenConnect on a Mac or PC: What Dental Staff Should Know (2026)

The technician is on the phone, you have typed the session code, and the front-desk Mac has just asked whether "ScreenConnect Client" may record your screen. Or the technician says the session is connected but all they can see is black. And someone in the office chat has just shared a story about a practice that let a fake "Microsoft technician" in.

This guide is written for the person at the front desk or the office manager, not the technician. It explains what the tool is, how to join a session on a Mac and on a Windows PC, what each permission box means in Apple's and Microsoft's own words, how to tell a genuine session from a scam that uses the same software, what to do in the first hour if a stranger got in, and what your IT provider should have configured on its side. Vendor and government pages were checked on 6 November 2026.

What is ScreenConnect, and why does your IT provider use it?

ScreenConnect is remote-support software from ConnectWise. A technician opens a session on the provider's ScreenConnect site; you join it by typing a short code and running a small client program, and the technician can then see your screen and, with your permission, move the mouse and keyboard. Providers also install it on managed computers for after-hours work.

There are two ways the tool reaches an office computer, and it helps to know which one you are looking at.

A support session you join. You call or email your IT provider, a technician gives you a code, and you type it into your provider's own ScreenConnect web address. ScreenConnect's feature notes describe this as a "5-digit session code" that connects you to one specific session. You download and open the client, the technician appears on your screen, and when the work is done the session ends. On a Mac the program is named "ScreenConnect Client", or "ConnectWise Control Client" on older installations, because the product was sold as ConnectWise Control for several years.

An unattended access agent. On computers your provider manages, a small agent stays installed so the technician can connect without anyone typing a code. That is how patches get installed on a Sunday night and how a server gets looked at before the first patient arrives. It is normal, and it is also the reason the list of machines carrying an agent, and the people allowed to use it, matter so much (more on that in the IT side section).

ScreenConnect is one of several tools in the same category. TeamViewer, AnyDesk, Splashtop and LogMeIn do the same job, and the advice on this page applies to all of them. The reason a dental IT provider works this way most of the time is simple: a technician who can see the Dentrix error on your screen while you describe it fixes it faster than one who has to drive over. Our guide to what dental IT can fix remotely and what needs a technician draws that line in detail.

Which kind of remote access is this? The three doors into a dental office

Before you click Allow on anything, work out which door is being opened. A support session you started, an agent your provider installed, and a vendor's own remote tool are three different things with three different owners. The table below tells them apart by how they start, what you see and what to check before you approve.

The first two doors belong to your IT provider and should appear in your agreement. The third is where offices lose track: a sensor company, a practice-software vendor and a phone vendor may each have left a tool behind. Our dental cybersecurity risk assessment checklist has a check for exactly that. Keep the register on one page: each tool, the computer it sits on, who installed it and who can use it.

How do you join a ScreenConnect session on a Mac?

You open your provider's ScreenConnect address, type the session code, download and open the client, then allow it in two places under Privacy & Security: Screen & System Audio Recording and Accessibility. Quit and reopen the client afterwards. Until the first permission is granted the technician sees a black screen; until the second, they can see but not click.

Apple requires both permissions for any remote-control tool, not only this one. In Apple's words, "Some apps and websites can access and record the screen and audio on your Mac. You can decide which apps and websites are allowed to record your screen and audio." And for control: "When a third-party app tries to access and control your Mac through accessibility features, you receive an alert, and you must specifically grant the app access to your Mac in Privacy & Security settings."

Here is the sequence on a current Mac (macOS 13 and later use System Settings; older versions call it System Preferences and the Security & Privacy pane, and some versions label the first permission simply Screen Recording, but the two permissions are the same).

1. 1. Open your provider's ScreenConnect address. Type it from the written note or bookmark your IT provider gave you. Do not search for it, and do not use a link from an unexpected email or pop-up.
2. 1. Enter the session code the technician read out, and join.
3. 1. Download and open the client. It arrives as a zip file; open it from Downloads and double-click the "ScreenConnect Client" (or "ConnectWise Control Client") app. If macOS asks whether you want to open an app downloaded from the internet, that is the normal first-run check for any downloaded program.
4. 1. Allow screen recording. Choose Apple menu, then System Settings, then Privacy & Security, then Screen & System Audio Recording, and turn the switch on next to the client. Apple's instruction is "For each app listed, turn the ability to record on or off." You will be asked for the password you use to unlock this Mac, not any work login.
5. 1. Quit and reopen when prompted. The permission takes effect only after the client restarts. If the technician still sees black, quit the client fully and open it again.
6. 1. Allow accessibility. Back in Privacy & Security, open Accessibility and turn the switch on for the same client. This is what lets the technician move your mouse and type.
7. 1. Watch the session. You can see every click. If anything looks wrong, quit the client; the connection ends with it.
8. 1. When the work is done, the technician ends the session. If you prefer, drag the client app from Downloads to the Trash, and ask the technician to confirm nothing was left installed.

Why does the technician see a black screen?

The black screen is the Screen & System Audio Recording permission. The connection is real and the session shows as connected, but macOS has not yet allowed the client to capture the display, so the technician receives an empty frame. Grant the permission in step 4, then do step 5; the restart is the part people skip.

Why can the technician see my screen but not click?

That is the Accessibility permission. Screen recording lets the client send your display out; only Accessibility lets it send mouse and keyboard input in. Grant it in step 6. Both permissions have to be set on each Mac, by someone at that Mac; administrators on ConnectWise's own product-feedback forum point out that Apple does not let a configuration profile switch the screen-recording permission on for them, which is why your technician has to walk you through it.

Do you need the admin password?

Changing Privacy & Security settings asks for the login of an account on that Mac. The Illinois State University support guide puts it plainly: "Use the same username and password you use to unlock your computer after a restart." If your office runs standard (non-admin) accounts, the manager or the IT provider holds the admin password, and granting the permission becomes a two-person step. That is a feature: no single person can hand a stranger control of the computer without a second person noticing.

Some providers also ask for Full Disk Access. The two permissions above are enough to view and control the screen; the university guide confirms that after Accessibility and Screen & System Audio Recording are set, "The TSC Analyst should now be able to view and interact with your Mac computer." Full Disk Access is for moving files, so ask what it is needed for before you grant it.

Which computers in a dental office are Macs?

Most server-based practice software runs on Windows, so the Macs in a dental office are usually at the front desk, in a consult room or in the doctor's office, running browser-based software. Curve Dental, for example, says "all you need is a typical PC or Mac and high speed Internet access", lists macOS 12 through 14 in its requirements, and supports Chrome as the browser. If you are deciding what to buy next, our batch guide on which computers to buy for a dental office covers the Mac question.

How do you join on a Windows PC, and what does the User Account Control box mean?

On Windows you open the same provider address, type the code and run the downloaded program. If a task needs administrator rights, Windows dims the screen and shows a User Account Control box naming the program and its publisher. Approve it only inside a session you started, with a technician you called yourself.

Microsoft describes two versions of that box. "The consent prompt is presented when a user attempts to perform a task that requires a user's administrative access token." An administrator just clicks Yes. "The credential prompt is presented when a standard user attempts to perform a task that requires a user's administrative access token," and it asks for an administrator's password. Either way, "The secure desktop dims the user desktop and displays an elevation prompt that must be responded to before continuing."

Two practical points for the front desk:

• • A dimmed screen and a password box mean someone is asking for administrator rights. If you are a standard user and the box appears while a technician you called is connected, the technician will usually enter their own credentials. If it appears when nobody you know is connected, click No and call your IT provider.
• • Remote tools can run without installing. That is convenient for support, and it is also why a scammer's download runs just as easily. CISA's advisory on this exact abuse notes that portable executables of remote tools "launch within the user's context without installation" and so do not need administrator privileges. On Windows, the prompt is not the safeguard; who started the session is.

What should a genuine remote-support session look like?

A genuine session starts with you. You called your IT provider's known number or opened a ticket, a named technician gave you a code, you typed it into your provider's own address, and you can watch and end the session. Nobody asks you to sign in to the bank, a payer portal or payroll while connected.

Run through this list before you type a code:

• • You made the first contact. A session that begins with an inbound call, a pop-up or an email you did not expect is not a support session until you have hung up and called your provider back on the number you already have. Our guide to reporting a dental IT problem shows what a real ticket looks like.
• • The address is your provider's own. Providers run ScreenConnect on their own web address. Keep it written down next to the phone number and compare it character by character.
• • The code came from a person you called. Codes are read out by the technician in the call you started. A code in a text message or a pop-up is a red flag.
• • The technician's name matches the ticket. Good providers use named accounts for every technician; the IT side section explains why that matters for your records too.
• • You can see the session and end it. On a Mac, quitting the client ends the connection; on Windows, closing it does the same. ScreenConnect also lets the technician remove you from the session from their side.
• • Nothing is asked of you that the task does not need. A technician fixing a printer does not need you to sign in to the bank, read a code from your phone, or buy anything. Apple's scam guidance is direct, "never share your Apple Account password or verification codes with anyone", and the same rule applies to Microsoft 365, payer portals and the practice bank account.
• • The session ends when the work ends. If a technician asks to leave a "temporary" tool behind that is not the agent your provider already uses, ask why and check with your provider's main office.

How do scammers abuse ScreenConnect and other remote tools?

Scammers use the same remote tools your IT provider uses. They start with a fake warning or call, talk the victim into downloading a portable copy of ScreenConnect, AnyDesk or similar, then work inside the computer while the victim watches. Because the software is real and signed, antivirus may stay silent. The weak point is the invitation, not the tool.

The clearest public account is a joint advisory from CISA, the NSA and MS-ISAC (AA23-025A). It describes "help desk-themed phishing emails" that either carried a link or asked the recipient to call, after which the actors steered them to a site that delivered the remote software. In CISA's words, "the actors downloaded AnyDesk and ScreenConnect as self-contained, portable executables configured to connect to the actor's RMM server." Once connected, they ran a refund scam: they "enticed the recipient to log into their bank account while remaining connected to the system." The advisory's conclusion applies to every office: "threat actors can maliciously leverage any legitimate RMM software."

The numbers are not small. In its 2025 Internet Crime Report, the FBI's Internet Crime Complaint Center recorded 47,794 tech support complaints with reported losses of about 2.13 billion dollars, and said that of the year's total losses, which passed 20 billion dollars, "Investment-related fraud was once again the largest component of these losses, followed by business email compromises and tech support scams."

Dental offices are used as bait too. In June 2026 a software engineer described an email his partner received that looked like an invitation from her dentist's office, complete with the right logo and signature, whose link downloaded a signed remote-access tool in place of the promised eCard. His observation is the whole lesson: "The remote access tool used in this scam was a real product." The person who received it caught it because, as he wrote, "invitations don't download files."

Microsoft's and Apple's own guidance gives you two tests you can apply in seconds. Microsoft: "Remember that real error messages from Microsoft, or other big tech companies, never include phone numbers for you to call them," and "Microsoft and other legitimate tech companies will never cold call you to tell you that there's a problem with your device." Apple lists "Misleading pop-ups and ads that say your device has a security problem" and "Scam phone calls or voicemails that impersonate Apple Support" among the schemes to expect. The FTC describes the same pattern: a bogus warning, then a request for remote access to "scan" the computer.

For the full anatomy of these calls, including the versions that impersonate your own IT company, see our batch guide to fake IT support scams aimed at dental offices. Because the refund version of the scam targets whatever is signed in on that computer, it is also worth reading how to protect payer portal logins with MFA across a dental group.

What should staff do if a stranger got in?

Disconnect the computer from the network, leave it switched on, and call your IT provider on the number you already have. Do not type any password on that machine. From a different device, change the passwords of every account that was open during the session, note the time and what was shown, and report the contact to the FTC.

1. 1. Cut the connection, not the power. Unplug the network cable or turn off Wi-Fi. Leaving the computer on preserves what your IT provider needs to see; ConnectWise's own guidance for a suspected compromise is to isolate the affected systems first and keep them offline until they have been investigated.
2. 1. Call your IT provider's known number. Not a number from the screen. Say exactly what happened: what you clicked, what you downloaded, how long they were connected, what was on the screen.
3. 1. Change passwords from another device. Start with any account that was signed in during the session: email, practice software, payer portals, the bank. Apple's advice after a scam contact is to change the password "immediately and ensure that two-factor authentication is enabled"; our guide to password management and MFA for dental teams covers how to do it without reusing anything.
4. 1. Tell the office manager and the practice owner the same day. Write down the time, the caller's story, the tool they used and the screens they saw. The practice's privacy officer, not the front desk, decides what kind of event this is and whether patient information was involved; that decision may need counsel and is outside this article.
5. 1. Let your IT provider do the clean-up. Removing the tool is the start, not the end. CISA's advisory recommends reviewing logs for remote software run as portable executables, and ConnectWise's bulletins tell administrators of a compromised instance to review every user, reset passwords and force technicians to sign back in. On an office computer that means checking for anything left behind to reconnect later, and reviewing what the attacker could reach from that machine.
6. 1. Report it. Apple and the FTC both point to the same place: ReportFraud.ftc.gov. Your cyber insurer may also require notice within a set time; check the policy.

If the stranger did more than look, for example if files were encrypted or the practice software stopped, follow the first-hour steps in our guide to ransomware and phishing protection for dental practices.

The IT side: how a well-run dental IT provider sets up its remote tool

A well-run provider treats its remote tool as its most sensitive system. That means a named account and multi-factor sign-in for every technician, a written list of which office machines carry an unattended agent, session logs it can show you, prompt patching of the tool itself, and controls that stop any other remote tool from running in your office.

Those are the controls you should expect, in the order they matter.

Named technicians and multi-factor sign-in

ScreenConnect supports it: the vendor's security page lists "Role-based permissions, brute-force attack prevention, and detailed audit logs" and the option to "Require multi-factor authentication for all users". The reason this matters to a practice is in the HIPAA Security Rule's technical safeguards, which require covered entities to "Assign a unique name and/or number for identifying and tracking user identity" and to "Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information." A remote tool that lets several technicians share one login, or that keeps no log of who connected to the front-desk computer, makes both of those harder for the practice. That is a question for your provider, not a legal opinion; your compliance adviser interprets the rule.

Consent, notice and the agent list

Unattended agents are legitimate; silent, unlisted ones are not. Your provider should be able to hand you a list of every computer and server carrying its agent, say which technicians can use it, and explain whether staff see a notice when a technician connects to a machine in use. ScreenConnect's security page describes "Audit logs track login attempts, password changes, and session access" and optional "Video session recordings" of remote engagements; a provider that uses them can answer "who was on the server last Tuesday night" in a minute.

Patching the remote tool itself

Remote-support software is a target because it is a door. Since 2024, four ScreenConnect vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog, which lists flaws confirmed to be used in real attacks. ConnectWise's cloud-hosted service is updated by the vendor; self-hosted servers have to be updated by whoever runs them, which is why the question "is your ScreenConnect server patched?" is a fair one to put to any provider.

The last entry is worth a second look because it concerns the client on your computer, not the server: ConnectWise says the fix "addresses a condition in the ScreenConnect client that may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances," and adds that after upgrading, administrators should reinstall host clients and update access agents. A provider that runs the cloud service received the fix automatically; one that self-hosts had to apply it. ConnectWise's post-patch advice is also a good description of routine hygiene: review "users and removing any that are not recognized, reviewing users' roles and permissions, changing passwords, and enabling MFA."

Stopping every other remote tool

The most effective defence against the scam described above is to make sure only your provider's tool can run. CISA's mitigations are specific: "Audit remote access tools on your network to identify currently used and/or authorized RMM software", "Implement application controls to manage and control execution of software, including allowlisting RMM programs", ensure those controls "prevent both installation and execution of portable versions of unauthorized RMM software", and "Block both inbound and outbound connections on common RMM ports and protocols at the network perimeter." In an office this is done with managed endpoint protection and firewall rules rather than policy memos; our batch guide to EDR versus antivirus for dental offices explains the tooling.

These controls sit inside a provider's dental cybersecurity services, and they are also a fair test when you compare managed IT services for dental practices: a provider that cannot show you its own technician list, agent inventory and patch dates for its remote tool is asking you to trust the one door it uses most.

What other remote tools are already in your office?

Most dental offices carry more than one remote tool. The sensor or CBCT vendor may have installed its own during setup; the practice-software vendor's support line uses another; the phone vendor a third. Each is a door with its own owner, and the person who should know every one of them is your IT provider.

Ask for the inventory as part of your next review, and if you want to build it yourself first, start from the remote-access checks in our dental cybersecurity checklist.

What to ask your IT provider about remote support

How Legend Networking can help

Legend Networking is a Dallas-based dental IT company that has served over 3,500 practices since 2004. Support is remote-first nationwide, with onsite dispatch by appointment across served dental markets, and the work is done by in-house engineers; no outsourced first-level triage. The author, Ian Lynch, has 22 years in dental IT and oversees the NOC, onsite dispatch and client technology roadmaps. Legend holds a 4.8 rating from 173 Google reviews.

You can see the groundwork behind a secure office in a recent technology installation covering computers, networking, software, imaging integration, backups and security configuration, and practices in North Texas can start with dental IT support in Dallas–Fort Worth.