Antivirus and EDR
Processes and drivers
This page is for the administrator writing process and driver allow-lists. The four drivers are Microsoft attestation-signed; everything else is signed by Computle Limited.
Processes
Section titled “Processes”| Process | Runs as | Service | Purpose |
|---|---|---|---|
ComputleRemotleService.exe | SYSTEM | ComputleService | Supervises the host, checks the licence, writes the status file |
ComputleSessionServer.exe | Local Service | ComputleSessionServer | Runs each session; owns the network connection |
ComputleBroker.exe | SYSTEM | ComputleBroker | Connection to the connection service; drives the display, audio and camera drivers |
ComputleCaptureWorker.exe | SYSTEM | ComputleCaptureWorker | Captures the sign-in screen when nobody is signed in |
ComputleClockSync.exe | Local Service | ComputleClockSync | Sets the clock from the connecting device |
ComputleUSBClient.exe | SYSTEM | ComputleUSBPresent | Presents the client’s USB devices |
ComputleUpdater.exe | SYSTEM | ComputleUpdater | Host updates. During a self-update a copy named ComputleUpdaterStage.exe runs briefly from C:\ProgramData\Computle\Remotle\Update\. |
ComputleEnrolment.exe | SYSTEM | ComputleEnrolment | Obtains and renews the workstation’s certificate |
ComputleRemotleServer.exe | The signed-in user | Screen capture and encoding, during a session | |
ComputleRemotleDisplay.exe | The signed-in user | Virtual monitor layout, during a session | |
ComputleInputController.exe | The signed-in user | Applies keyboard, mouse and clipboard input, during a session | |
ComputleRemotleAbout.exe | The signed-in user | The Host Status Window, when a user opens it | |
powershell.exe running host-setup.ps1 | SYSTEM | During install, repair and uninstall only |
DLLs loaded into Windows processes
Section titled “DLLs loaded into Windows processes”| DLL | Loaded by | Purpose |
|---|---|---|
ComputleShellButton.dll | StartMenuExperienceHost.exe | Adds a Computle entry to the Start menu |
ComputleCredentialProvider.dll | LogonUI.exe | A sign-in tile for silent logon. It shows nothing unless a connection is signing someone in, and performs no authentication itself. |
softcam.dll, ComputleMfCameraSource.dll | Windows Frame Server | The client’s camera, as a camera on the workstation |
ComputleIdd.dll | WUDFHost.exe | The virtual display driver |
Drivers
Section titled “Drivers”| Driver | Class | Hardware ID | Purpose |
|---|---|---|---|
Computle Virtual Display Adapter (ComputleIdd) | Display | root\ComputleIdd | Virtual monitors |
Computle Virtual HID Mouse (ComputleVhidMouse) | HID | root\ComputleVhidMouse | Pointer input |
Computle Virtual Audio (ComputleAudioDriver) | Media | ROOT\ComputleAudioDriver | Speakers and microphone for the session |
Computle USB VHCI (ComputleVhci) | USB | Root\ComputleVhci | The client’s USB devices |
Services
Section titled “Services”| Service | Runs as | Purpose |
|---|---|---|
computle-hostd | The computle-host account | The host |
computle-session | Each user’s GNOME session | Virtual monitors and capture |
computle-host-updated | root | Host updates. Listens on a root-only Unix socket, /run/computle-hostupdate.sock. |
computle-enrolment | root | Certificate enrolment and renewal |
computle-usb-attach@, computle-render-grant@, computle-kms-capture@, computle-greeter-logon | root, started on demand | USB devices, GPU access, capture, sign-in screen |
Related
Section titled “Related”Questions
Section titled “Questions”Why does the host inject a DLL into the Start menu?
Section titled “Why does the host inject a DLL into the Start menu?”To add a Computle entry to the Start menu. It is the only injection the host performs, and the service unloads the DLL the same way.
Why do host processes run as SYSTEM?
Section titled “Why do host processes run as SYSTEM?”Driver control, service supervision and starting processes in a user’s session need it. The session server, which holds the network connection, runs as Local Service instead.