MSKeyHole as the launcher
Users find their published applications in MSKeyHole and open them in one click. Free, Pro and Enterprise are the same app: moving to Enterprise means activating a licence.
MSKeyHole Enterprise · KeyHole RemoteApps
Your Windows applications, opened like local apps
Publish the applications installed on your Windows Servers (Excel, a CRM…). Your users open them from MSKeyHole: one click, the company VPN connects and only the application appears, with no remote desktop.
- 1MSKeyHoleThe launcher on each user's PC: the company's apps sit next to their hosts.
- 2Your company VPNAdmins and users connect through it, each group with its own rules.
- 3KeyHoleCentralAdminThe console: an Ubuntu Server VM on your infrastructure, never on the Internet.
- 4Agents on Windows ServerOne agent per application VM, outbound connections only.
How it works
Three parts, all on your side
KeyHole RemoteApps adds application publishing to MSKeyHole. Nothing goes through a third-party cloud: the console and the application VMs stay on your network, behind your VPN.
The KeyHoleCentralAdmin console
An Ubuntu Server VM installed by your company, next to the application VMs. It installs from a deployment file generated by MSKeyHole.
An agent on each Windows Server VM
An agent pack (signed MSI + configuration file) installs on every VM of a customer. Agents are unlimited.
Benefits
Simple to deploy, comfortable to use
No AD, no RDS farm
One Windows Server VM per end customer, without Active Directory, Connection Broker or RD Web.
Everything stays with you
The console runs on your infrastructure, next to your application VMs. No third-party cloud.
Unlimited agents
The same agent pack installs on all the VMs of a customer.
Normal Windows windows
Each application opens in its own window (taskbar, Alt+Tab) or in a MSKeyHole tab.
A named exchange folder
Save and open files through an exchange folder that users recognise.
Closing the app ends the session
No session left open on the server after the user is done.
Settings as checkboxes
Clipboard, printers, drives and session timeouts, per VM or group of VMs.
One application
Free, Pro and Enterprise are the same MSKeyHole: everything in Pro is included.
Security first
Nothing exposed on the Internet
The console is never exposed on the Internet. Administrators and users reach it only through the company VPN, each on its own port. VPN-only access is the rule, not an option.
The console's only outbound connection to the Internet: HTTPS to keyhole.vigilancex.io, for its licence.
VPN only
Neither the console nor the VMs are exposed on the Internet. Admins and users go through the company VPN, with different rules per group.
No reachable RDP port
Port 3389 listens only locally on the VMs. Agents make outbound connections to the console only, and there is no route between the VMs of different customers.
Closed-command agent
The agent never runs a script or a program it receives: only a closed list of signed commands.
Passwords not kept
The console does not keep passwords, and the .rdp files are signed by your company's console.
Separate roles
One port for administration, one for users. Each user sees and opens only their own applications.
Editions
RemoteApps comes with MSKeyHole Enterprise
| Edition | Content | Price |
|---|---|---|
| Free | 2 hosts, without the built-in AI, DashLink or OpenVPN. | Free |
| Pro | All of MSKeyHole: unlimited hosts, DashLink, OpenVPN, AI assistant, MCP control, updates. | €24/year |
| Enterprise | All of Pro + RemoteApps. Pack of 5 minimum: 1 RemoteApps Admin (console) + 4 RemoteAccess (users), extensible. | On request |
Licences are assigned by e-mail address from MSKeyHole: the user activates MSKeyHole with that address and receives the Enterprise licence automatically. MSKeyHole licences are separate from App Store purchases.
Requirements
What your company provides
Application VMs
- Windows Server 2022 or 2025.
- Outside any domain: no Active Directory needed.
Console
- An Ubuntu Server LTS VM installed by your company on its infrastructure, on the private network of the application VMs.
- Not exposed on the Internet, with a single outbound HTTPS connection to keyhole.vigilancex.io.
Company VPN (mandatory)
- For example Sophos XGS.
- One group for the administrator, one for the users.
Microsoft licences
- Up to 2 simultaneous sessions per VM without RDS CALs.
- Beyond that, your company provides its CALs, which the agent installs. Microsoft compliance remains the company's responsibility.
Frequently asked questions
Do I need Active Directory or an RDS farm?
No. One Windows Server 2022 or 2025 VM per end customer, outside any domain, is enough: no Active Directory, no Connection Broker, no RD Web.
Is the console exposed on the Internet?
Never. Administrators and users reach it only through the company VPN. Its only outbound connection is HTTPS to keyhole.vigilancex.io, for its licence.
Which VPN should I use?
Your company VPN, for example Sophos XGS, with one group for the administrator and one for the users. It is mandatory.
How many users can I add?
The Enterprise pack starts at 5 licences: 1 RemoteApps Admin for the console and 4 RemoteAccess for users. More RemoteAccess licences can be added. Each Enterprise licence includes everything in MSKeyHole Pro.
Do I need Microsoft RDS licences?
Up to 2 simultaneous sessions per VM work without RDS CALs. Beyond that, your company provides its CALs and the agent installs them. Microsoft compliance remains the company's responsibility.
Is RemoteApps available on Mac or iPad?
No. RemoteApps and the Enterprise edition exist only in MSKeyHole for Windows. KeyHole for Mac and iPad is a separate App Store app.
Publish your Windows apps with MSKeyHole Enterprise
Pack of 5 licences minimum, price on request.
Request a quote
Write to contact@vigilancex.io