TruGrid SecureRDP - Offline Mode

Overview

Offline Mode allows users to keep signing in and connecting to machines when the internet connection or the TruGrid cloud is unavailable. The TruGrid Sentry on the local network takes over sign-in and machine list delivery, and sessions are established directly across the local network.

This article assumes the domain is already configured for On-Premises AD authentication. If you also use Remote Credential Guard for passwordless offline sign-in, complete the setup in TruGrid SecureRDP - Credentials Passthrough Setup and Prerequisites first, which in turn depends on TruGrid SecureRDP - Trusted Location Login.

Prerequisites

• TruGrid Sentry 7.4 or later, domain joined
• TruGrid Windows Connector 26.8.1 or later, installed per machine
• Working local network, DNS, and Active Directory
• Offline Mode enabled for the domain by TruGrid support
• Administrative rights on the Sentry host and on client devices
• Inbound TCP 44443 on the Sentry host from client subnets
• TCP 3389 from clients to target machines

For Sentry placement, redundancy, and multi-site considerations, see the enterprise Sentry design guide.

1. Ask TruGrid to enable Offline Mode

There is no toggle in the admin portal. Email TruGrid support (help@trugrid.com) with your TruGrid domain name. If you want passwordless offline sign-in, ask for Remote Credential Guard to be enabled for the domain at the same time.

2. Prepare the Sentry

1. Install or upgrade to Sentry 7.4 or later on the domain-joined server.
2. Allow inbound TCP 44443 on the Sentry host from your client subnets, and TCP 3389 from clients to target machines.

If the Sentry runs as Local System (the default), no further action is required. The host already owns the name the Connector asks for.

If the Sentry runs under a custom service account or a gMSA, register a service principal name on that account once. Kerberos requires it, because an account cannot write its own and the Sentry only verifies it:

setspn -s TruGridSentry/sentry01.corp.example.com CORP\svc-trugrid

If the SPN is missing, the Sentry logs this exact command and does not start its offline listener.

3. Install the Connector on client PCs

Run elevated, per machine:

TruGrid_Windows_Connector_<version>.exe /quiet InstallScope=1 ENABLE_RCG=1 SENTRYFQDN="sentry01.corp.example.com,sentry02.corp.example.com" SENTRYSIGNINGTHUMBPRINT="AABBCCDDEEFF00112233445566778899AABBCCDD,1122334455667788990011223344556677889900"

Always pass SENTRYFQDN. This is the setting that matters most. It tells the PC which Sentries to use when the cloud is unreachable, and it is what makes Offline Mode self-sufficient. A PC that has it can sign users in the first time it is ever needed, on either the passwordless or the password path. That includes a PC handed to a user in the middle of an outage.

Three rules for the value:

• Per machine install is required. Pass InstallScope=1 and run elevated. A per-user install ignores the offline settings silently.
• Use full host names, never IP addresses. Authentication is name based, so an IP address fails outright.
• List all your Sentries, comma separated. Failover between them is automatic.

Already deployed Connectors

No reinstall is needed. Create these values under HKLM\SOFTWARE\TruGrid\TruGridWindowsConnector (64-bit view) and restart the Connector:

These are exactly what the installer writes, so they are safe to deploy through Group Policy Preferences.

4. Test it

On one client PC, block internet access only. Keep the LAN, DNS, AD, and the Sentry up.

The block must produce timeouts or dropped packets. A captive portal or proxy error page counts as "internet is working" and Offline Mode will not engage. Do not test by stopping the Sentry service or disabling the network adapter.

Then open the Connector, sign in, and connect to a machine.

Verification

1. SentryFqdn present on the client:

reg query "HKLM\SOFTWARE\TruGrid\TruGridWindowsConnector" /v SentryFqdn /reg:64

If the value is missing, the install was per user or the parameter was not passed.

2. Sentry listening on 44443 and reachable from the client:

Test-NetConnection <sentry-fqdn> -Port 44443

3. With internet blocked, the Connector signs in and displays the yellow banner.
4. A machine opens and the remote desktop session connects over the local network.
5. When internet access is restored, the Connector returns to normal mode within about 2 minutes.

Part 2: Using Offline Mode (end users)

1. Open the TruGrid Connector from the desktop or Start menu. There is nothing to switch on and the sign-in screen looks the same as always.
2. Sign in. If passwordless sign-in is set up, you are signed in automatically. Otherwise enter your full sign-in address (for example jane.doe@corp.example.com) and your Active Directory password. The DOMAIN\username form is not accepted offline. No multi-factor prompt appears.
3. A yellow banner across the top of the window confirms offline mode: "Offline mode: connected through your local network. Some features are unavailable until the internet connection is restored."
4. Your machines and applications appear as usual. Search, sorting, and paging work.
5. Open a machine to start the remote desktop session. It connects directly over the local network.
6. When the internet comes back, the Connector returns to normal mode on its own within about 2 minutes. Multi-factor users are asked to sign in again, which is expected.

If the first session shows a Windows warning about an unknown or unverified publisher, click Connect. It is cosmetic and does not affect the session. Administrators can remove it, see below.

Note for administrators: removing the RDP publisher warning

Offline sessions launch from a signed RDP file, and Windows warns about the publisher until the signing certificate is trusted on the client.
Pass SENTRYSIGNINGTHUMBPRINT at install with each Sentry's thumbprint, comma separated, and the installer trusts the certificates for you. Read each thumbprint on its own Sentry host:

reg query "HKLM\SOFTWARE\TruGrid\Sentry" /v OfflineSigningCertThumbprint /reg:64

List every Sentry's thumbprint, otherwise the warning returns on sessions that use the Sentries you left out.

For fleets already installed, distribute the same thumbprints through the Group Policy setting Specify SHA1 thumbprints of certificates representing trusted .rdp publishers. If you replace a Sentry's certificate, redistribute the new thumbprint. Sessions keep working either way.

Each Sentry generates and renews its own certificates on its own host, and no TruGrid private key is placed on your infrastructure. If your policy requires certificates from your own certificate authority, ask TruGrid support for the two registry values that designate them.

Frequently Asked Questions

Q: Do users have to do anything to enter Offline Mode?
A: No. The Connector detects the outage on its own.

Q: Can a PC that has never signed in before be used during an outage?
A: Yes, provided the Connector was installed per machine with SENTRYFQDN set. This works on both the passwordless and the password path.

Q: Why is my DOMAIN\username login rejected?
A: Offline sign-in requires the full sign-in address, for example jane.doe@corp.example.com. The DOMAIN\username form is not accepted offline.

Q: Does Offline Mode work if the domain controller is down?
A: No. Offline Mode requires a working local network, DNS, and Active Directory. It covers loss of internet or cloud availability only.

Q: Does Offline Mode work for cloud-only (Entra ID) accounts?
A: No. Offline sign-in authenticates against On-Premises AD.

Q: What happens to multi-factor authentication?
A: No MFA prompt appears during Offline Mode. When the internet is restored, MFA users are asked to sign in again.

Q: Do I need to reinstall Connectors that are already deployed?
A: No. Deploy SentryFqdn (and optionally SentryLocalApiPort and SilentRcgEnabled) to HKLM\SOFTWARE\TruGrid\TruGridWindowsConnector through Group Policy Preferences and restart the Connector.

Updated on: 07/10/2026