Loading...
One Platform. Complete Control.
Powered byTotal Access Platform
Loading...
One Platform. Complete Control.
Loading products
Finding the right tools for your business
Total Solutions. Total Control.
Loading products
Finding the right tools for your business
Total Solutions. Total Control.
Real Active Directory semantics. No Windows Server, no on-prem domain controller.
Kerberos, Group Policy, and domain trust — delivered as a hosted bridge, mastered by the portal.
AD Bridge connects Windows devices to a real Samba4 Active Directory domain — Kerberos, NTLM, SYSVOL, and Group Policy included — while the Total Access portal remains the authoritative directory. One shared bridge serves the environment; every client is isolated in its own Organisational Unit. The Total Connect Agent still runs on every device, carrying the WireGuard tunnel that makes domain sign-in work from anywhere.
The Total Connect Agent is always the management plane. AD Bridge adds real domain authentication and Group Policy on top — it never replaces the agent. Choose per device: the same portal manages both.
| Feature | Agent only TotalAccess | Agent + AD Bridge |
|---|---|---|
| Windows 10/11 Home supported | Home: agent path only | |
| Windows 10/11 Pro / Enterprise / Education | ||
| macOS & Linux | Agent path (domain join is Windows-only) | |
| Sign-in mechanism | Managed local account, portal-verified | Kerberos/NTLM against the hosted DC |
| Accounts roam across machines | ||
| File shares, mapped drives, SYSVOL | ||
| Domain Group Policy (GPOs) | ||
| Agent policy engine (tca_* policies) | ||
| Password authority | Portal (bcrypt) | Portal — verified then synced to AD |
| Offline sign-in | DPAPI-cached verifier | Cached domain credentials + tunnel reconnects |
| EDR, SIEM, patch & vulnerability management | ||
| Phone-approved sign-in tile | Managed local accounts only | |
| Client isolation boundary | Portal client_id | Dedicated OU on the shared bridge |
| Enrolment | Install script / .ppkg / connect key | Domain join + GPO auto-installs the agent |
| Requires anything on your LAN | ||
| Uninstall / leave | Portal-issued code | Same — plus domain-leave from the portal OU |
Whether a device is agent-only or domain-joined, the user types the same portal password. What happens underneath is different — and deliberately so.
The Total Access credential provider presents managed-account tiles at the Windows sign-in screen. It verifies the password against the portal — or a DPAPI-protected PBKDF2 verifier when offline — then serialises credentials for the matching managed local account (client-user). The agent creates, syncs, and disables those local accounts; the user's profile and files are preserved when an existing account is taken over. Works on Windows Home because nothing ever joins a domain.
A domain-joined device authenticates with standard Windows machinery — Kerberos to the hosted DC, falling back to NTLM/cached credentials. The agent's embedded WireGuard tunnel (wg-ad) runs as a SYSTEM service before logon, so the DC is reachable at the credential prompt even off-LAN — UDP 51820 first, with TCP 443 and UDP 4500 fallback for captive or UDP-blocked networks.
When a user sets or changes a password, the portal verifies it with bcrypt — users.password_hash remains the single source of truth. The verified plaintext is sent transiently over TLS to the DC API, which sets unicodePwd in AD. AD never authenticates portal logins, and nothing in AD ever writes back — the same one-way flow as the credential manager, extended to the domain.
AD Bridge provisioning is API-driven, idempotent, and self-repairing — re-running it fixes drift instead of duplicating objects. No client-side Samba, no per-customer scripts.
The DC-side API creates the client's OU under OU=TotalAccess, with the correct delegation and SYSVOL ACLs. Re-run it and the existing OU is reused — nothing duplicates.
Portal users are provisioned into the client OU. Passwords flow one-way: bcrypt-verified in the portal, set as unicodePwd in AD. Disabling a portal user disables the AD account on the same cycle.
A per-client enrolment GPO (immediate scheduled task) is written to SYSVOL and linked to the OU. At the next gpupdate it downloads and installs the Total Connect Agent with the connect key — zero touch per machine.
Any Windows Pro device joined to the client domain inherits the GPO, enrols into TCD automatically, and reports posture, telemetry, and inventory back to the same console — whether it's on the office LAN or remote over WireGuard.
Microsoft doesn't allow domain join on Windows Home — that's an OS limitation, not ours. The agent path deliberately doesn't depend on it: every identity, policy, and security feature works on Home because the agent manages local accounts directly. Only the domain-join step itself requires Pro, Enterprise, or Education.
Full agent feature set — managed local accounts, policies, SIEM, response, VPN.
Everything above plus optional domain join to the AD Bridge.
Agent path — enrolment, WireGuard, DNS filtering, heartbeat, session control, auto-update.
The AD Bridge adds domain trust — it doesn't take over management. Disable or unbind the bridge and every enrolled device keeps working through the agent exactly as before.
The AD Bridge is provisioned per contract — talk to us about enabling it for your client. Every device keeps the full agent feature set either way.
Real Active Directory semantics. No Windows Server, no on-prem domain controller.
Kerberos, Group Policy, and domain trust — delivered as a hosted bridge, mastered by the portal.
AD Bridge connects Windows devices to a real Samba4 Active Directory domain — Kerberos, NTLM, SYSVOL, and Group Policy included — while the Total Access portal remains the authoritative directory. One shared bridge serves the environment; every client is isolated in its own Organisational Unit. The Total Connect Agent still runs on every device, carrying the WireGuard tunnel that makes domain sign-in work from anywhere.
The Total Connect Agent is always the management plane. AD Bridge adds real domain authentication and Group Policy on top — it never replaces the agent. Choose per device: the same portal manages both.
| Feature | Agent only TotalAccess | Agent + AD Bridge |
|---|---|---|
| Windows 10/11 Home supported | Home: agent path only | |
| Windows 10/11 Pro / Enterprise / Education | ||
| macOS & Linux | Agent path (domain join is Windows-only) | |
| Sign-in mechanism | Managed local account, portal-verified | Kerberos/NTLM against the hosted DC |
| Accounts roam across machines | ||
| File shares, mapped drives, SYSVOL | ||
| Domain Group Policy (GPOs) | ||
| Agent policy engine (tca_* policies) | ||
| Password authority | Portal (bcrypt) | Portal — verified then synced to AD |
| Offline sign-in | DPAPI-cached verifier | Cached domain credentials + tunnel reconnects |
| EDR, SIEM, patch & vulnerability management | ||
| Phone-approved sign-in tile | Managed local accounts only | |
| Client isolation boundary | Portal client_id | Dedicated OU on the shared bridge |
| Enrolment | Install script / .ppkg / connect key | Domain join + GPO auto-installs the agent |
| Requires anything on your LAN | ||
| Uninstall / leave | Portal-issued code | Same — plus domain-leave from the portal OU |
Whether a device is agent-only or domain-joined, the user types the same portal password. What happens underneath is different — and deliberately so.
The Total Access credential provider presents managed-account tiles at the Windows sign-in screen. It verifies the password against the portal — or a DPAPI-protected PBKDF2 verifier when offline — then serialises credentials for the matching managed local account (client-user). The agent creates, syncs, and disables those local accounts; the user's profile and files are preserved when an existing account is taken over. Works on Windows Home because nothing ever joins a domain.
A domain-joined device authenticates with standard Windows machinery — Kerberos to the hosted DC, falling back to NTLM/cached credentials. The agent's embedded WireGuard tunnel (wg-ad) runs as a SYSTEM service before logon, so the DC is reachable at the credential prompt even off-LAN — UDP 51820 first, with TCP 443 and UDP 4500 fallback for captive or UDP-blocked networks.
When a user sets or changes a password, the portal verifies it with bcrypt — users.password_hash remains the single source of truth. The verified plaintext is sent transiently over TLS to the DC API, which sets unicodePwd in AD. AD never authenticates portal logins, and nothing in AD ever writes back — the same one-way flow as the credential manager, extended to the domain.
AD Bridge provisioning is API-driven, idempotent, and self-repairing — re-running it fixes drift instead of duplicating objects. No client-side Samba, no per-customer scripts.
The DC-side API creates the client's OU under OU=TotalAccess, with the correct delegation and SYSVOL ACLs. Re-run it and the existing OU is reused — nothing duplicates.
Portal users are provisioned into the client OU. Passwords flow one-way: bcrypt-verified in the portal, set as unicodePwd in AD. Disabling a portal user disables the AD account on the same cycle.
A per-client enrolment GPO (immediate scheduled task) is written to SYSVOL and linked to the OU. At the next gpupdate it downloads and installs the Total Connect Agent with the connect key — zero touch per machine.
Any Windows Pro device joined to the client domain inherits the GPO, enrols into TCD automatically, and reports posture, telemetry, and inventory back to the same console — whether it's on the office LAN or remote over WireGuard.
Microsoft doesn't allow domain join on Windows Home — that's an OS limitation, not ours. The agent path deliberately doesn't depend on it: every identity, policy, and security feature works on Home because the agent manages local accounts directly. Only the domain-join step itself requires Pro, Enterprise, or Education.
Full agent feature set — managed local accounts, policies, SIEM, response, VPN.
Everything above plus optional domain join to the AD Bridge.
Agent path — enrolment, WireGuard, DNS filtering, heartbeat, session control, auto-update.
The AD Bridge adds domain trust — it doesn't take over management. Disable or unbind the bridge and every enrolled device keeps working through the agent exactly as before.
The AD Bridge is provisioned per contract — talk to us about enabling it for your client. Every device keeps the full agent feature set either way.
