Troubleshooting Web Remote connection limit errors

Resolve the "Remote connection limit exceeded" and "Connection count limit to session exceeded" errors that appear when you launch Web Remote. Use this article to identify the scope of the issue and apply the matching resolution.

Problem statement

When you launch Web Remote, you receive one of the following errors, or a generic Web Remote failure message related to session establishment:

  • Remote connection limit exceeded
  • Connection count limit to session exceeded

The issue can affect one device or multiple devices, one technician or multiple technicians, or a specific browser or workstation.

In most cases, stale Web Remote sessions remain associated with the endpoint after an unexpected browser closure, network interruption, or agent disconnect. Datto RMM supports a limited number of concurrent Web Remote sessions for each device, and orphaned sessions consume the available connections.

Other common causes include:

  • Browser-related Web Real-Time Communication (WebRTC) or WebSocket issues
  • Firewall or proxy restrictions
  • Missing Web Remote permissions
  • Endpoint connectivity issues
  • Agent service problems
  • Back end session association issues that require Support investigation

Resolution

To resolve this issue, find the scenario that matches your situation and complete the steps for that scenario.

Only one target device is affected

You receive the error when you connect to one specific endpoint, and Web Remote works on other devices. The likely cause is stale Web Remote sessions on the affected endpoint.

  1. Confirm the endpoint is online and checking in to Datto RMM.
  2. Verify that no other technician is connected to the endpoint through Web Remote, Agent Browser, or another remote-control session.
  3. In Agent Browser, restart the Datto RMM Agent service by running the following command:

    net stop cagservice && net start cagservice

  4. Retry Web Remote.
  5. If you can't restart the service, reboot the endpoint.
  6. Wait approximately 10 to 30 minutes for abandoned sessions to expire automatically.
  7. Test Web Remote again.

If Agent Browser works but Web Remote doesn't, complete the following steps:

  1. Verify connectivity to the following addresses:
    • tunnel-ips.centrastage.net
    • tunnel.rmm.datto.com
    • webrtc.rmm.datto.com
  2. Verify that outbound User Datagram Protocol (UDP) port 3478 is open.
  3. Confirm that no firewall, web filter, or proxy device blocks WebRTC traffic.

If the issue persists, refer to Collect information for support.

NOTE  Web Remote doesn't use the proxy settings configured for the Datto RMM Agent. The Agent Browser can function while Web Remote fails because of proxy restrictions.

One user is unable to connect to all devices

One user can't establish Web Remote sessions to any endpoint, but others can connect. The issue usually relates to the user account, browser, workstation, or network path rather than the target devices.

  1. Confirm the user's security level grants them permission to use Web Remote. Refer to Security levels.
  2. Verify that other users can connect to the device. If so, refer to Another user can connect to the same device.

    NOTE  If no users are able to connect to the device, refer to Only one target device is affected.

  3. Validate the users browser and workstation by completing the following tests:
    • Try a different supported browser.
    • Open an InPrivate or Incognito session.
    • Clear the browser cache and cookies.
    • Temporarily disable browser extensions.
    • Test from another workstation using the same Datto RMM account.
  4. Compare your results with the following table to identify the likely cause.
    ResultLikely cause
    One or more browsers work, while others failBrowser-specific issue
    Alternate workstation worksLocal workstation issue
    All browsers failNetwork or account issue
  5. Validate network connectivity from the user's device by verifying access to the following addresses:
    • tunnel-ips.centrastage.net
    • tunnel.rmm.datto.com
    • webrtc.rmm.datto.com
  6. Verify that the following ports are open:
    • 3478 (outbound)
    • 49152-65535 (required WebRTC ranges, where applicable)
  7. Check for the following network conditions:
    • Proxy authentication requirements
    • Firewall inspection rules
    • Deep packet inspection
    • Secure Sockets Layer (SSL) inspection
    • WebSocket filtering
  8. Select an affected endpoint and confirm the following:
    • The device is online.
    • The initial audit has completed.
    • The Datto RMM Agent service is running.
    • The Agent Health Check completes successfully. Refer to Agent Health Check tool.
  9. Review the CagService logs, the AEMAgent.exe logs, and WebRemote.log. Refer to Agent log files.

If all validation steps pass and you still can't connect to any endpoint, refer to Collect information for support.

NOTE  A proxy that returns the error 407 Proxy Authentication Required can prevent Web Remote tunnel establishment.

Another user can connect to the same device

A user is unable connect to an endpoint using Web Remote, but another user connects successfully. This pattern strongly suggests an issue with the technician account state, browser session, workstation, source network, or back end session association rather than the device itself.

  1. Test multiple endpoints.
  2. Test multiple supported browsers.
  3. Test a private browsing session.
  4. Sign in with the affected account on another workstation.
  5. Ask another technician to sign in on the affected workstation.
  6. Compare your results with the following table to identify the likely scope.
    Test resultLikely scope
    The affected account fails from every computerAccount or session association
    The affected account works elsewhereOriginal workstation or browser
    Every account fails from one computerWorkstation or network
    The affected account fails on one device onlyTarget-specific condition
    Both accounts fail on the same endpointEndpoint-side issue

If the issue persists, collect the information in Collect information for support, include confirmation that another technician can connect, and escalate to Kaseya Support.

Multiple users fail to connect to one device

Several technicians receive the same error, and the issue is isolated to a single endpoint. The likely cause is a target device issue, such as stale sessions, agent communication issues, firewall restrictions, proxy restrictions, Domain Name System (DNS) filtering, or display driver or desktop duplication issues.

  1. Confirm the device is online.
  2. Confirm the initial audit has completed. Refer to Audits.
  3. Open the Services console (services.msc), locate the CagService entry, and restart it.
  4. Attempt a Web Remote connection.
  5. If the error continues, reboot the endpoint.
  6. Wait 10 to 30 minutes for sessions to expire.
  7. Run the Agent Health Check. Refer to Agent Health Check tool.
  8. Collect the logs listed in Collect information for support.

When you review the logs, look for errors such as "No display output available for display duplication" or "ERROR_BUSY". These errors can indicate endpoint display subsystem issues that affect Web Remote.

Collect information for support

If the issue persists after you complete the steps for your scenario, gather the following information before you escalate to Kaseya Support:

  • Technician information: user name, security level, browser, browser version, source Internet Protocol (IP) address, and source network
  • Endpoint information: hostname, site name, agent version, and operating system
  • Session details: exact error message, approximate time of occurrence, session ID, and tunnel ID
  • Log files: WebRemote.log, CagService logs, AEMAgent.exe logs, and Agent Health Check results
  • Testing results: whether another technician, browser, workstation, or network succeeds

Web Remote sessions start successfully after the stale sessions clear or the underlying browser, network, or endpoint issue is corrected.

Tips and tricks

Restarting the agent service or rebooting the endpoint is most effective when the issue is isolated to a specific target device and you suspect stale sessions. If you fail against all endpoints while another technician connects successfully, focus on your account, browser, workstation, or network environment instead of repeatedly rebooting endpoints.