SDE Remote · Secure desktops, VDI and vApps on Proxmox · for colleges and secure environments

Secure desktops, apps and devices, from anywhere. Nothing sensitive leaves your network.

Q: Can I use my own Arduino, Raspberry Pi or 3D printer with a remote desktop?

Yes, where IT allows it. USB and serial devices plugged into your laptop are relayed by the SDE Remote app to the Linux or Windows machine inside SDE, through the same encrypted connection, with no extra networking or ports.

Q: Is it suitable for sensitive data?

Yes. Data stays on the inside, sharing is controlled centrally, and access is personal and recorded.

SDE Remote gives every student, member of staff, contractor and analyst one place to reach the computers and software they need. They sign in once with their normal account, click a tile, and their desktop, a fresh desktop from a pool, or a single app such as Blender, GitLab or an older Moodle site opens. The software runs on your own servers, the data stays inside your network, and IT decides centrally what may be copied, printed or saved. New: USB and serial passthrough, so an Arduino, Raspberry Pi, printer or 3D printer plugged into a laptop works on any Linux or Windows machine inside SDE, with no extra networking or ports.

Ask for a demonstration USB and serial passthrough

1 portEverything over one encrypted web connection

4 modulesStart with SDE Core, add VDI, vApps and Redirector

MinutesTo publish a new internal web app as a tile

USB + serialLaptop devices relayed to Linux and Windows machines

The SDE modules

One platform, four modules

SDE Remote is built from four modules. SDE Core is the foundation every deployment starts with; SDE VDI, SDE vApps and SDE Redirector add desktop pools, single apps and device passthrough when you need them.

sde-coreFoundation

SDE Core

Remote tool, gateway and broker

The secure front door. Users sign in once, see their tiles and connect, through the SDE Remote app for Windows or any browser, over one encrypted web port.

SDE Remote app for Windows and browser access
Gateway: one encrypted entry point, nothing else exposed
Broker: decides who reaches which desktop or app
Active Directory sign-in, MFA, password change
Remote access to existing Windows and Linux machines
Data controls per desktop and app, plus site-wide switches
Security procedures gate at sign-in
Session records and usage reporting

add the modules you need

sde-vdi

SDE VDI

Remote pools and management

Desktop pools such as "Windows 11 Desktop" or "Linux Desktop": a fresh desktop in seconds from a master copy, warm spares for busy periods, domain join and clean-up, and GPU pools for 3D and game engines, all managed from simple admin pages.

Desktop pools in detail

sde-vapps

SDE vApps

Remote machine and kiosk apps

Single apps as tiles, with no desktop to get lost in: applications on your own machines, RemoteApps from a Microsoft RDS farm, and sealed, locked-down kiosk browsers for modern and legacy web apps, published in minutes.

Single apps in detail

sde-redirectorNew

SDE Redirector

USB and serial passthrough

Arduinos, Raspberry Pi boards, microcontrollers, printers and 3D printers plugged into a user's laptop, relayed to any Linux or Windows machine inside SDE, inside the encrypted session, with no extra networking or ports.

SDE Redirector in detail

What users see

One sign-in. A tile for everything they are allowed to use, and nothing else.

SDE Remote opens as a clean app or a web page. No server names, no connection settings to type and no software to hunt for: users click the tile and the desktop or app opens.

What does SDE stand for? Secure Desktop Environment, or Secure Development Environment when it gives development and computing teams a safe place to build and test. The name depends on who is using it; the platform is the same.

One sign-inTheir usual organisation account. If the password has expired, they change it right there.

Tiles, not addressesEach user sees only the desktops and apps their groups entitle them to.

Pick up where they left offClose the window, come back later and return to the same work, where the organisation allows it.

Shortcuts and linksAny tile can be a desktop shortcut, or a link on a web page or in a course that opens a web app at a particular page.

SDE RemoteSigned in as j.smith · Creative Media

Desktop pools

Windows 11 Desktopfresh desktop

Linux Desktopfresh desktop

GPU StudioBlender, Unreal

My Lab PCreconnect

Apps

GitLabweb app

Old Moodlelegacy, sealed

n8nweb app

My devicesArduino on COM4

Why organisations choose SDE Remote

Built for further education and for secure environments

The same platform answers two different problems: getting specialist software to students wherever they are, and letting people work with sensitive data without it ever leaving the secure network.

For further education

Specialist software anywhere. 3D, games design, engineering and media software from home, the library or a student's own laptop, with nothing heavy to install and no powerful computer needed.
More from expensive licences and hardware. High-end machines and software are shared across the college rather than tied to one room.
Older systems keep working. Courses that depend on an older Moodle site or legacy learning content carry on, safely separated from everything else.
Fewer lab rebuilds. Less time on "it works on that PC but not this one".
Real hardware from home. Electronics and computing students plug their Arduino or microcontroller into their own laptop and program it from a college Linux or Windows desktop.

For secure environments

Data stays inside. Users see and work with it, but it does not end up on their laptops unless policy allows it.
Every connection is attributable. Tied to a named person and recorded: who, what, when and from where.
Procedures first. Users can be required to accept the security operating procedures before they connect.
No extra holes in the firewall. The service reaches the outside world through a single secure web port, the same one a website uses.
Devices without new routes. USB and serial devices are relayed inside the existing encrypted session, so no new network paths or ports are opened to reach them.

What it delivers

Remote desktops, desktop pools and single apps

What each module puts in front of your users. Every deployment starts with SDE Core; SDE VDI and SDE vApps add pools and single apps on top.

SDE Core

Remote desktops

Users reach the organisation's existing Windows or Linux desktops and servers securely from wherever they are. Each user sees only the systems they are entitled to.

SDE VDI

Desktop pools

Instead of a fixed PC each, users click a pool such as "Windows 11 Desktop" or "Linux Desktop" and are given a fresh, ready-made desktop in seconds.

Always clean. Built from a master copy IT maintains, cleared away and replaced after use.
Ready when they arrive. Spare desktops kept warm, with more ready for lesson starts, exam weeks and deadline evenings.
Capacity that follows demand. Desktops exist while people need them, not idle in a classroom.
Fits your identity. Desktops join your domain for single sign-in, usual drives and settings; retired desktops are tidied out of the directory automatically.
GPU pools. Pools on hardware with graphics cards for Blender or Unreal Engine.

SDE vApps

Single apps

Sometimes a user only needs one application. SDE vApps publishes individual apps as tiles: click Blender, GitLab or Old Moodle and get that app on its own, with no desktop to get lost in.

Other apps. Applications on your own servers, such as Blender or engineering software, and RemoteApps from an existing Microsoft Remote Desktop Services farm (Word, Excel, line-of-business systems).
Sign-in that suits the app. The user's own account so the app knows who they are, or a shared kiosk account for open resources where everyone should get the same clean view.

Web apps in minutesIT types in the address of an internal website, chooses who should see it and clicks Create. SDE builds a small, locked-down, dedicated browser for that site and publishes the tile automatically.

Modern and legacy web appsModern apps such as GitLab, n8n and internal dashboards, and legacy apps for older sites that modern browsers no longer handle well, each kept in its own sealed box.

No wandering offEach web app can reach only the sites it is meant for. A user cannot browse the wider internet from inside it.

NewSDE Redirector · USB and serial passthrough

Plug it into your laptop. Use it on any machine inside SDE.

SDE Redirector, the newest SDE module, relays USB and serial devices from the user's own laptop to the Linux or Windows machine they are working on inside the SDE network. Arduinos, Raspberry Pi boards, microcontrollers, printers and 3D printers appear on the remote machine as if they were plugged straight into it.

The device traffic travels inside the same encrypted session as the desktop itself, through the same single web port. There is no VPN to set up, no extra networking, no ports to open, and the remote machine never needs a route back to the user's home network.

Devices on this laptopSession: Linux Desktop (pool)

Arduino Uno R3COM4 on the laptop → /dev/ttyACM0 on the desktop

Prusa 3D printerUSB → visible to the slicer on the desktop

Raspberry Pi PicoUSB serial → /dev/ttyACM1

USB-to-serial console cableReady for a switch or router console

Label printerBlocked by policy for this pool

Illustrative example. What can be relayed, and to which desktops and apps, is set centrally by IT.

Arduino and microcontrollers

Compile and upload sketches and firmware from the IDE on a college desktop, and watch the serial monitor, with the board on the student's own desk.

Raspberry Pi

Pi boards and Pi Pico over USB or a serial console, for flashing, debugging and headless set-up from inside SDE.

3D printers

Slice on a GPU-backed desktop pool and send the job straight to the 3D printer at home or in the workshop.

Printers

Local USB printers, for the desktops and apps where printing is allowed by policy.

Serial consoles

USB-to-serial adapters and console cables for network kit, lab equipment and embedded boards.

To any machine in SDE

Relay to Linux or Windows: desktop pools, existing desktops and servers inside the SDE network.

Plug in

The user connects the device to their laptop and opens their desktop in the SDE Remote app.

Relayed in-session

The device is carried inside the existing encrypted connection: no VPN, no extra ports, no new firewall rules.

Controlled centrally

USB and serial relay are data controls like copy or print, allowed or blocked per desktop pool and per app, with a site-wide off switch.

Attributable

Device use sits inside a named, recorded session, so it is tied to a person, a time and a place.

Three ways to connect

A browser, the app, or a stream

Nothing to install

In a web browser

Any device: shared PCs, personal laptops and Chromebooks.

Best everyday experience

The SDE Remote app for Windows

Full screen, multiple monitors, sharp graphics, desktop shortcuts, and local printers, USB and serial devices where allowed. Can be deployed centrally.

For fast-moving graphics

Streaming Optional

3D work, video and game engines delivered as a smooth, low-delay video stream.

Control over data

IT decides what crosses between the session and the device, per desktop and per app

For every desktop pool and every app, IT chooses what may move between the session and the user's own device:

copying out and pasting in, set separately
saving files to, and opening files from, the user's device
printing
sound and microphone
USB and serial devices (from the Windows app)
picture quality versus speed

A site-wide setting can switch any of these off everywhere, whatever an individual app allows.

Built-in usage reportingWho is using the service, which systems and apps, how they connect and when, with charts and export to Excel. Useful for:
licence planningengagement and attendance evidencecapacity decisionsfunding bidsaudit

Policy: Analyst Desktop (secure)site-wide overrides apply

Copy out of the sessionBlocked

Paste into the sessionAllowed

Save files to the deviceBlocked

Open files from the deviceApproved types

PrintingBlocked

Sound and microphoneAllowed

USB and serial relayBlocked

Policy: Electronics Lab (Linux)FE computing

Copy and pasteBoth ways

Files to and from the deviceAllowed

USB and serial relayArduino, Pi, 3D printers

Illustrative policies. Every setting is chosen by your IT team.

Use cases

Where SDE Remote earns its keep

Further education

Creative and digital courses from homeGames design and 3D students open a GPU-backed desktop pool from their own laptop and carry on their coursework at night, with nothing heavy installed.

An older Moodle that cannot be retired yetLast decade's course content becomes a single sealed "Old Moodle" tile, and links in the new Moodle course open the old activity directly.

Computing, DevOps and electronicsGitLab or n8n published as apps inside the college network, and students' own Arduinos and Pi boards relayed into a Linux desktop for programming and testing.

Shared rooms, fewer rebuildsClassroom PCs become simple access points; specialist software lives in the pool, kept up to date in one place.

Bring your own deviceStudents and staff on personal laptops or Chromebooks get the same tiles through a browser.

Remote and part-time staffTutors, assessors and apprentices' workplace mentors reach exactly what they need, and nothing more.

Secure environments

Data that must not leaveAnalysts work on sensitive data inside a secure network with copying out, file saving and printing switched off.

Contractors and third partiesA single app or desktop for a fixed purpose, on a named account that can be removed in one place, with no access to the wider network.

Separated networksSystems on restricted networks are published as tiles without opening those networks to users' devices.

Hardware work without new network pathsEngineers program and test devices on isolated build machines, with the device relayed through the session rather than a new route into the network.

AccountabilityUsers accept the security operating procedures before they connect, and every session is attributable to a person, a time and a location.

Older systems that must keep runningLegacy web systems that cannot be upgraded are isolated in their own locked-down browser, limited to the one site they need.

Security at a glance

Designed for sensitive data from the start

Area	How SDE Remote handles it
Sign-in	Your existing Active Directory accounts. No separate passwords to manage; existing password rules, lockouts and multi-factor sign-in still apply.
No stored passwords	The app never saves a user's password to disk.
One entry point	Everything travels over a single encrypted web connection. Desktops, servers and apps are never exposed to the internet directly.
Least privilege	Users see only what they are entitled to, controlled by groups IT already manages.
Central data controls	Copy, paste, files, printing, sound, USB and serial are allowed or blocked centrally, per desktop or app.
Device relay (SDE Redirector)	USB and serial devices travel inside the encrypted session, with no extra ports, VPNs or network routes.
Locked-down web apps	Each published website runs in its own sealed container that can reach only that site.
Procedures gate	Users can be required to accept security operating procedures at sign-in.
Records	Who connected to what, when and from where, plus a usage report.
Privacy	No tracking, analytics or calls to outside services. The app talks only to your own server.

Proven open-source foundations

Apache Guacamole and Proxmox VE, with the management on top

SDE Remote does not replace two widely trusted platforms; it adds the management, security and user experience on top. Because both are open source and widely used, you are not locked into one vendor, and both are well understood by IT teams and security reviewers.

Apache Guacamole

The remote access gateway from the Apache Software Foundation, used by universities, governments and businesses worldwide. It handles sign-in, decides who can reach what, and delivers sessions to any web browser. SDE Core adds the Windows app, the broker, the data controls and the reporting, with desktop pools, single apps and device relay in the SDE VDI, SDE vApps and SDE Redirector modules.

Proxmox Virtual Environment

An enterprise-grade, open-source virtualisation platform. Desktop pools and web apps run on it, on your own servers. There are no per-seat hypervisor licences, and SDE uses its own restricted permissions so it can only manage what belongs to it.

Works with what is thereFits alongside your existing Active Directory, and alongside an existing Apache Guacamole portal if you have one. The existing portal keeps working so users move over at their own pace.

ModularStart with SDE Core, then add SDE VDI, SDE vApps and SDE Redirector as separate modules when you need them.

Managed for youEITS installs, configures, monitors and keeps the service up to date. Your IT team runs the day-to-day through simple admin pages: who gets what, which apps are published, and the master desktops.

Frequently asked questions

SDE Remote questions

Do users need to install anything?

No. Everything works in a web browser. The SDE Remote app for Windows adds the best experience (multiple monitors, smoother graphics, desktop shortcuts and local devices) and can be deployed centrally.

Can students use their own devices?

Yes. Because the work happens on the organisation's servers, the device only needs a browser or the app. The data controls decide whether anything can be saved to it.

Can I use my own Arduino, Raspberry Pi or 3D printer with a remote desktop?

Yes, where IT allows it. Plug the device into your laptop and open your desktop in the SDE Remote app: USB and serial devices are relayed to the Linux or Windows machine inside SDE, through the same encrypted connection, with no extra networking or ports.

Do we need every module?

No. Every deployment starts with SDE Core (the remote access tool, gateway and broker). SDE VDI, SDE vApps and SDE Redirector are separate modules you add when you need desktop pools, single apps or USB and serial passthrough.

Can we keep our existing remote access portal?

Yes. SDE Remote is added alongside it, not instead of it.

How quickly can a new web app be made available?

Usually within minutes. IT enters the address and chooses who gets it, and SDE builds and publishes it automatically.

Is it suitable for sensitive data?

Yes. That is what it was designed for: data stays on the inside, sharing is controlled centrally, and access is personal and recorded.

What does it run on?

Your own servers: Apache Guacamole for secure access and Proxmox VE for desktop pools and web apps, alongside your existing Active Directory. We can also advise on the servers and Linux support behind it.

See SDE Remote on your own network

We will show desktop pools, a published web app and a USB device relayed from a laptop, and talk through how it fits your Active Directory and firewall.

Book a demonstration Moodle hosting and support