> ## Knowledge Base Index > Fetch the complete knowledge base index at: https://help.trugrid.com/sitemap.xml > Use this file to discover available pages before exploring further. > Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash). # TruGrid SecureRDP - Offline Mode ## Overview Offline Mode allows users to keep signing in and connecting to machines when the internet connection or the TruGrid cloud is unavailable. The TruGrid Sentry on the local network takes over sign-in and machine list delivery, and sessions are established directly across the local network. | The Connector detects the outage on its own. There is nothing for the end user to switch on, and the sign-in screen is unchanged. || Offline Mode covers a loss of internet connectivity or cloud availability while the local site remains healthy. It does not cover remote users outside the office, a domain controller outage, a LAN or power outage, or cloud-only (Entra ID) accounts. This article assumes the domain is already configured for On-Premises AD authentication. If you also use Remote Credential Guard for passwordless offline sign-in, complete the setup in [TruGrid SecureRDP - Credentials Passthrough Setup and Prerequisites](https://help.trugrid.com/en/article/trugrid-secure-rdp-credentials-passthrough-setup-and-prerequisites-c7rlae/) first, which in turn depends on [TruGrid SecureRDP - Trusted Location Login](https://help.trugrid.com/en/article/trugrid-secure-rdp-trusted-location-login-1ho6aes/). ## Prerequisites * TruGrid Sentry **7.4 or later**, domain joined * TruGrid Windows Connector **26.8.1 or later**, installed per machine * Working local network, DNS, and Active Directory * Offline Mode enabled for the domain by TruGrid support * Administrative rights on the Sentry host and on client devices * Inbound **TCP 44443** on the Sentry host from client subnets * **TCP 3389** from clients to target machines For Sentry placement, redundancy, and multi-site considerations, see the enterprise Sentry design guide. ## 1. Ask TruGrid to enable Offline Mode There is no toggle in the admin portal. Email TruGrid support ([help@trugrid.com](mailto:help@trugrid.com)) with your TruGrid domain name. If you want passwordless offline sign-in, ask for **Remote Credential Guard** to be enabled for the domain at the same time. || Keep the internet connection up while this is done. The Sentry has to download its first configuration copy from the cloud. The Sentry service restarts once or twice, taking under a minute. ## 2. Prepare the Sentry 1. Install or upgrade to **Sentry 7.4 or later** on the domain-joined server. 2. Allow inbound **TCP 44443** on the Sentry host from your client subnets, and **TCP 3389** from clients to target machines. **If the Sentry runs as Local System (the default), no further action is required.** The host already owns the name the Connector asks for. **If the Sentry runs under a custom service account or a gMSA**, register a service principal name on that account once. Kerberos requires it, because an account cannot write its own and the Sentry only verifies it: ``` setspn -s TruGridSentry/sentry01.corp.example.com CORP\svc-trugrid ``` If the SPN is missing, the Sentry logs this exact command and does not start its offline listener. ## 3. Install the Connector on client PCs Run elevated, per machine: ``` TruGrid_Windows_Connector_.exe /quiet InstallScope=1 ENABLE_RCG=1 SENTRYFQDN="sentry01.corp.example.com,sentry02.corp.example.com" SENTRYSIGNINGTHUMBPRINT="AABBCCDDEEFF00112233445566778899AABBCCDD,1122334455667788990011223344556677889900" ``` | Parameter | Required | Purpose | | `InstallScope=1` | Yes | Per machine install | | `SENTRYFQDN` | Yes | Sentry host names, comma separated | | `ENABLE_RCG=1` | Recommended | Signs the user in automatically at Windows logon, no password | | `SENTRYSIGNINGTHUMBPRINT` | Optional | Removes the RDP publisher warning, see the note below | | `SENTRYLOCALAPIPORT` | Optional | Only if the Sentry port was changed from 44443 | **Always pass `SENTRYFQDN`. This is the setting that matters most.** It tells the PC which Sentries to use when the cloud is unreachable, and it is what makes Offline Mode self-sufficient. A PC that has it can sign users in the first time it is ever needed, on either the passwordless or the password path. That includes a PC handed to a user in the middle of an outage. Three rules for the value: * **Per machine install is required.** Pass `InstallScope=1` and run elevated. A per-user install ignores the offline settings silently. * **Use full host names, never IP addresses.** Authentication is name based, so an IP address fails outright. * **List all your Sentries**, comma separated. Failover between them is automatic. ### Already deployed Connectors No reinstall is needed. Create these values under `HKLM\SOFTWARE\TruGrid\TruGridWindowsConnector` (64-bit view) and restart the Connector: | Value | Type | | `SentryFqdn` | String | | `SentryLocalApiPort` | String, optional | | `SilentRcgEnabled` | DWORD, `1`, optional | These are exactly what the installer writes, so they are safe to deploy through Group Policy Preferences. ## 4. Test it On one client PC, block **internet access only**. Keep the LAN, DNS, AD, and the Sentry up. The block must produce timeouts or dropped packets. A captive portal or proxy error page counts as "internet is working" and Offline Mode will not engage. **Do not test by stopping the Sentry service or disabling the network adapter.** Then open the Connector, sign in, and connect to a machine. ## Verification 1. `SentryFqdn` present on the client: ``` reg query "HKLM\SOFTWARE\TruGrid\TruGridWindowsConnector" /v SentryFqdn /reg:64 ``` If the value is missing, the install was per user or the parameter was not passed. 2. Sentry listening on 44443 and reachable from the client: ``` Test-NetConnection -Port 44443 ``` 3. With internet blocked, the Connector signs in and displays the yellow banner. 4. A machine opens and the remote desktop session connects over the local network. 5. When internet access is restored, the Connector returns to normal mode within about 2 minutes. ## Part 2: Using Offline Mode (end users) 1. **Open the TruGrid Connector** from the desktop or Start menu. There is nothing to switch on and the sign-in screen looks the same as always. 2. **Sign in.** If passwordless sign-in is set up, you are signed in automatically. Otherwise enter your **full sign-in address** (for example `jane.doe@corp.example.com`) and your **Active Directory password**. The `DOMAIN\username` form is not accepted offline. No multi-factor prompt appears. 3. **A yellow banner across the top of the window** confirms offline mode: "Offline mode: connected through your local network. Some features are unavailable until the internet connection is restored." 4. **Your machines and applications appear** as usual. Search, sorting, and paging work. 5. **Open a machine** to start the remote desktop session. It connects directly over the local network. 6. **When the internet comes back**, the Connector returns to normal mode on its own within about 2 minutes. Multi-factor users are asked to sign in again, which is expected. If the first session shows a Windows warning about an unknown or unverified publisher, click **Connect**. It is cosmetic and does not affect the session. Administrators can remove it, see below. ## Note for administrators: removing the RDP publisher warning Offline sessions launch from a signed RDP file, and Windows warns about the publisher until the signing certificate is trusted on the client. Pass `SENTRYSIGNINGTHUMBPRINT` at install with each Sentry's thumbprint, comma separated, and the installer trusts the certificates for you. Read each thumbprint on its own Sentry host: ``` reg query "HKLM\SOFTWARE\TruGrid\Sentry" /v OfflineSigningCertThumbprint /reg:64 ``` List **every** Sentry's thumbprint, otherwise the warning returns on sessions that use the Sentries you left out. For fleets already installed, distribute the same thumbprints through the Group Policy setting **Specify SHA1 thumbprints of certificates representing trusted .rdp publishers**. If you replace a Sentry's certificate, redistribute the new thumbprint. Sessions keep working either way. Each Sentry generates and renews its own certificates on its own host, and no TruGrid private key is placed on your infrastructure. If your policy requires certificates from your own certificate authority, ask TruGrid support for the two registry values that designate them. ## Frequently Asked Questions **Q: Do users have to do anything to enter Offline Mode?** A: No. The Connector detects the outage on its own. **Q: Can a PC that has never signed in before be used during an outage?** A: Yes, provided the Connector was installed per machine with `SENTRYFQDN` set. This works on both the passwordless and the password path. **Q: Why is my `DOMAIN\username` login rejected?** A: Offline sign-in requires the full sign-in address, for example jane.doe@corp.example.com. The `DOMAIN\username` form is not accepted offline. **Q: Does Offline Mode work if the domain controller is down?** A: No. Offline Mode requires a working local network, DNS, and Active Directory. It covers loss of internet or cloud availability only. **Q: Does Offline Mode work for cloud-only (Entra ID) accounts?** A: No. Offline sign-in authenticates against On-Premises AD. **Q: What happens to multi-factor authentication?** A: No MFA prompt appears during Offline Mode. When the internet is restored, MFA users are asked to sign in again. **Q: Do I need to reinstall Connectors that are already deployed?** A: No. Deploy `SentryFqdn` (and optionally `SentryLocalApiPort` and `SilentRcgEnabled`) to `HKLM\SOFTWARE\TruGrid\TruGridWindowsConnector` through Group Policy Preferences and restart the Connector.