Machine Connection

Machine connection turns an existing Windows computer into a Cerberus resource. Cerberus keeps the machine as a governed workspace resource instead of publishing it as an open remote-access target.

After installation, enrollment state, workspace activation state, service state, network signal, remote-desktop readiness, and command results become visible to Cerberus. These signals feed the “is the resource ready?” part of the session decision.

What the connection agent reports

• Enrollment and workspace activation state.
• Heartbeat and last-seen signal.
• Windows, network, RDP, firewall, security, and runtime snapshot sections.
• Command result and error information.
• Connection agent lifecycle such as active, quarantined, revoked, or upgrading.

What readiness is used for

A resource appearing in inventory does not mean a session can open. Cerberus checks resource state before launch:

• is the Windows connection agent active?
• is the resource visible in the workspace?
• is the last heartbeat stale?
• is the remote desktop or terminal target usable?
• is the resource quarantined or revoked?
• is the resource assigned to the user?

If readiness is missing, the session does not open. This is part of the product’s security behavior; a blocked launch is as meaningful as a successful one.

Zero Port relationship

The resource port is not handed to the user as an externally open target. Cerberus reads resource state, the portal makes the launch decision, and the runtime opens work in the browser.

Making a machine governable is different from exposing a machine to the internet. Cerberus uses the governable-resource model.

Revocation

When a Windows connection agent is revoked or a kill switch is applied, new sessions are blocked. If work is open, the closure path runs and the event is attached to evidence. Access has both a start decision and a withdrawal decision.

Connection agent lifecycle

Enrollment is the first step; workspace activation is the second. After activation, the resource becomes visible inside the workspace. In active state, heartbeat and snapshot data are current. In quarantine or revoked state, the resource no longer follows the normal launch flow.

This lifecycle matters because machine existence and machine readiness are not the same thing. Cerberus makes that difference visible.

Command and result model

The Windows connection agent reports state and can receive controlled commands. Success, error, timeout, and invalid state can all affect resource readiness.

The useful question is whether the resource is governable and whether the outcome can be seen.

Meaning in the resource screen

The resource screen does not merely show a machine name. Last-seen signal, readiness indicators, assignment relationship, and pre-session usability are read together. The browser session is not independent from those signals.