Vault: Connect over RDP without seeing the password

IdentityMesh Connect opens an RDP session as a governed account straight from a check-out. The password is released once, to the launcher on the operator’s PC, and never rendered in the portal.

Administrator

List targets. Vault → Configure → Governed Accounts → Targets on the account. Add each host (DNS name or IP) the account may be used on; port defaults to 3389. Connect is offered only for these hosts.
Set the download URL. Same tab, “IdentityMesh Connect download URL”. Point it at where you host IdentityMeshConnect-<version>.msi (a file share exposed over HTTPS, an intranet page). Leave blank and operators are told to ask you.
Install Connect on operator PCs. The MSI installs for the current user by default (no admin rights, under %LOCALAPPDATA%\Programs) and registers the identitymesh-rdp:// handler. On the folder page, Install for → All users of this computer puts it under Program Files for everyone and asks for administrator rights. Needs the .NET 10 Desktop Runtime. Silent: msiexec /i IdentityMeshConnect-<version>.msi /qn installs for the current user; add MSIINSTALLPERUSER="" for all users. Upgrades replace an earlier copy installed in the same scope (per-user copies by the same account, or the all-users copy). A copy in the other scope is not touched: the dialog tells you when one exists and defaults to its scope. To change scope, remove the old copy first.

Connection targets are stored in a new database table, IM_VaultedAccountTargets. The installer’s database step creates it during the upgrade. A database updated outside the installer needs the database step run before the upgraded Admin API starts; every vault account list fails until the table exists.

Operator

Check the account out as usual, then Connect on the check-out card (a dropdown when the account has several targets). The browser hands the link to IdentityMesh Connect, which signs the RDP session in. Show password and the one-time token are spent by Connect: one release per check-out. The link is valid for two minutes; if nothing opens, install Connect and check out again.

Audit

VaultConnectRequested on the session records host, port and the logon name; the existing credential-token redemption row records the IP that collected the password.

Limits

A target whose policy forces “Always prompt for password upon connection” still prompts and the operator cannot answer it. Fix the policy, or do not list that host.
While the session is open the credential is in the operator’s own Windows Credential Manager (DPAPI-protected), removed when mstsc closes or the check-out expires. It is hidden from the screen, not from a determined operator with local tooling.
An unredeemed link expires with the check-out; check in and check out again to retry.