Release notes

Video that moves, sound that plays, and printing people recognise

DartRelay 2.3 is about what a session feels like to use. Moving pictures can now reach the browser as video rather than as a sequence of images; sound plays for the first time; the pointer and keyboard stay responsive while the host is busy drawing; and printing is one switch that sends the document to the browser's own print dialog, or straight to the printer for anybody who installs the optional Print Helper. The audit log is now searchable and exportable in full.

Video and sound

• Video to the browser. Where a host sends video, the browser decodes it itself instead of DartRelay turning each frame into a picture: smoother video, 3D and scrolling, on noticeably less bandwidth. It covers desktops and published applications alike.
• No more jumping. The page tells the decoder that frames arrive in order, so each one is shown as it arrives rather than in bursts.
• On the host side, Windows uses video where things move. The Prioritize H.264/AVC 444 policy makes the whole screen arrive that way, which suits a desktop used for video or graphics work and is not recommended on an application host.
• Sound plays. It never did before. It starts at the first click inside the session tab, because browsers will not play sound before somebody has clicked.
• A pointer that keeps up. Mouse and keyboard are now handled while the host is busy drawing. Before, a host playing video or redrawing constantly made the pointer crawl and clicks land late, in every session.

Printing

• One switch per application group and desktop. The document comes back to the browser and opens its print dialog straight away, so people print to whatever they normally print to. No driver is deployed on the host.
• DartRelay Print Helper 1.0 for Windows, an optional add-on for people who print all day — receipts, labels, batches. Once installed and paired, documents go straight to the printer with no dialog. It is a per-user install that IT can push silently, one copy serves every browser on the machine, offline printers are offered, and it can be paired with several DartRelay installations at once.
• A Print Helper page inside the portal, reached from the profile menu, explaining what it is and who needs it.
• Printing no longer interrupts the session. The connection is held while the browser's print dialog is open, which fixed the reconnects people saw while printing receipts.
• Java applications that print to “(Default)” now find the session's printer: hosts get a small task that copies it to where Java looks for it.

Console and portal

• The audit log keeps everything and now shows it. The page pages through the whole log, with one live search box covering user, portal address, tenant, host and network address, lists for type and result, a date range, and a CSV export of everything or of the filtered view.
• Every event and session records the portal address and tenant it belongs to, and the Sessions page has a Portal column.
• My account and Print Helper open inside the portal page, so open applications stay open.
• A forced password change for an administrator now happens in the console itself.
• Fewer flickers when a session is resized, and held keys are released when the tab loses focus — the cause of a stuck Alt key opening menus.

Known at release

• Opening an application a few seconds after the last one closed can fail once with Session Ended, while Windows is still signing the previous session out. Opening it again works.

A load balancer of its own, and sessions that ride through a failover

DartRelay 2.2 brings the Relay Balancer (HALB), a high-availability load balancer built into DartRelay for sites without an appliance of their own. Open tabs now reconnect by themselves when a server stops, with the same windows and no second password prompt. Every browser on a shared session gets a tab for every program, and licensing works entirely from what the installation was given at activation.

Relay Balancer (HALB)

• No appliance needed. One server in the pool answers for it, hands each launch to the least busy healthy server, and keeps a person's applications together. If it stops, another server takes over within about ten seconds.
• Floating address for servers on one office or data-centre network: a spare address moves from server to server, and your firewall forwards to it.
• DNS name for servers in a cloud, on VPSs or at several sites: the portal's name is pointed at the server answering for the pool, in Cloudflare, Amazon Route 53 or Azure DNS, or by a script of your own for any other DNS service. A Test button checks the credentials first.
• Each server's public address is detected, or set by you. A built-in safeguard stops a server pointing the name at an address it shares with another server behind one firewall.
• Move it by hand with Move address here or Answer from here.

Failover

• Tabs reconnect by themselves. When the server a tab ran through stops, the tab says Reconnecting to your session… and comes back through another server.
• Nothing opens twice. The reconnected tab is handed the program's windows back instead of starting another copy, and the other programs return as their own tabs.
• No second Windows password prompt. A temporary, encrypted copy of the password is kept for the pool and removed at sign-out.
• Deliberate endings are said out loud. A session an administrator ended, an idle sign-out or a released seat now says so, and does not reconnect.

Sessions and the portal

• A tab for every program, in every browser. When one session is open in several browsers, each browser gets a tab for the programs opened in the others, and follows which one is in front.
• Session buttons follow the theme. Reconnect, Close and the other panel buttons take the theme's button colours.
• Faster file browser. Rename, delete and new folder answer at once, folders on network shares list much faster, and files show proper type icons.
• Where files are kept is chosen per desktop and per Remote Apps group, on the DartRelay server or on a network share, with file management switched per group.

Licensing

• Refresh licence. Bought more seats or renewed? Press Refresh licence on the Activation page and the new seats, extra and expiry apply at once, across the pool.
• No calls home after activation. Once activated, DartRelay works entirely from the licence it holds and contacts the activation service only when you activate, deactivate or press Refresh licence.

Sign-in

• Two-factor per address, with domain accounts enrolling on first sign-in, a choice between authenticator and email when both are allowed, and one list of methods under My account.

Fixes

• A saved Relay Balancer form that is refused keeps what was typed.
• A Windows password entered in one browser is no longer lost when another browser signs out.
• DOMAIN\user works for a directory service account.
• Theme images can be up to 250 KB.

Sign in with Microsoft, never type a Windows password, and publish documents

DartRelay 2.1 adds Microsoft Entra ID and OpenID Connect sign-in — Okta, Google or any other provider — and Relay Pass, which logs people on to Windows with a certificate so they never type a Windows password. Documents can now be published on the portal beside applications, themes gain a new set of sign-in and category options, hosts get finer control over what happens when one person uses several devices, and the complete online documentation arrives at dartrelay.com/docs.

Signing in

• Sign in with Microsoft. Microsoft Entra ID confirms who the person is, with its own conditional access and multi-factor checks, and DartRelay signs them in as the Active Directory account they are synchronised from.
• Sign in with Okta, Google or any OpenID Connect provider. Add a Sign in with Okta or Sign in with Google button, or one for any other OpenID Connect provider, with the provider's own multi-factor checks. Okta and Google start with ready-made settings; DartRelay matches the person to exactly one Active Directory account, and an Allowed domains list keeps out accounts from other organisations. See OpenID Connect sign-in.
• Sign-in buttons per address. Each address chooses which sign-in buttons it shows, or sends people straight to one provider. It is enforced, not just hidden.

Relay Pass — no Windows password at all

A Pass-Through resource used to need the password typed at sign-in, and asked for it again when there was none — after a Microsoft or OpenID Connect sign-in, a sign-in made on a load balancer, or a launch handled by another server in a pool. Relay Pass removes that prompt. DartRelay requests a short-lived logon certificate for the person from your own Active Directory Certificate Services and presents it to the host like a smart card. Nothing is installed on the hosts or per user; a Certificate sign-in card on each host page checks and prepares the host for it.

Sessions and hosts

• Sessions for the same person. Choose per host whether a person's applications follow them to their newest device, stay live on every device, or get a separate session per device. A tab left behind says Opened on another device with Reconnect and Close.
• End disconnected sessions after a time you choose, set from the host page, and a button to sign out disconnected sessions on demand.
• Programs already running get their own tabs. Come back to a session with programs still open and each published one appears as its own tab, without being started again.
• A clear message when an application does not appear. If a session connects but the application's window never shows, a panel says so and offers Keep waiting or Close, instead of an empty tab.

Documents

• Publish documents beside applications. A new Catalog → Documents page uploads guides, forms, policies and other files. Each document is a resource like a web application: an icon, categories, a Doc flag on its card, and a star for Favourites. It opens in a new browser tab, or downloads, without touching running sessions.
• Who sees it. All authenticated users, or only chosen users and groups — and a document filed only in folders someone cannot see cannot be opened by its link either.
• A Documents tab at the top of the portal lists everything a person can see, with search. Themes can hide it or change its icon.
• Where files are kept: the server's own folder, or a network share for pools, with a test before saving and documents moved automatically when the location changes.

Themes

• Sign-in buttons styled per provider. Each button — Microsoft and every other sign-in pass — can be shown or hidden, reworded, given its own icon and its own colours, which start from the theme's button colours. Choose stacked, side-by-side or icon-only layouts, above or below the form, with an optional divider.
• Buttons-only sign-in pages. Hide the username and password form so a page offers only its sign-in buttons. The form comes back by itself whenever no button would be shown.
• Eight category tab styles — underline, raised, pills, segments, curved, cabinet, buttons and chevron — with switches for category icons and item counts, and tab colours.
• A domain list that matches the form. The domain drop-down now takes the look of the username box, with its own themed list and full keyboard support.
• The Apps panel's container takes the theme's panel colours by default.

Documentation

A complete online help centre is now at dartrelay.com/docs: installation, hosts and publishing, sign-in and security, branding and tenancy, licensing, pools and load balancer integration, troubleshooting, and plain-language pages you can send straight to your users.

Fixes

• An expired password and a password an administrator has asked to be changed are now told apart, each with the right message.
• New announcements start on the sign-in screen.
• The Themes list pages correctly when there are more than twenty themes.

Every domain you have, and a portal only your networks can see

DartRelay 2.0 signs people in from several Active Directory domains, including ones that do not trust each other, lets you limit the portal and the console to the networks you choose, and handles shared Windows logins by itself.

Several Active Directory domains

• A Directories list. A new Directories page lists every domain DartRelay accepts, filled automatically from the server's own domain and its trusts. Each sign-in goes to exactly one domain — chosen from DOMAIN\name, the name@suffix, or the default — and a password is never tried against several domains in turn, so nobody is locked out in a domain they never meant to use.
• Domains with no trust. People in a separate forest can sign in too: DartRelay talks to that domain's own domain controllers directly, with a service account of its own and a choice of where in the directory to look.
• A domain for each address. Under Tenancy & Branding, every address can have its own default domain and its own domain list on the sign-in page — or hide the list entirely, so one address signs in to one domain.

Security

• Network access rules. Limit the portal, the console, or both to the network addresses and ranges you list, installation-wide or for a single address. A change that would lock you out of the console is refused, and the console can always be opened from the server's own desktop.
• Blocked addresses. Turn away a scanner or a persistent bad-password source with one click from the audit log, with a note saying why.
• Keeping robots off public addresses. An address that admits visitors without a sign-in can ask them to prove they are a person first, so crawlers never become guest sessions.

Sessions and hosts

• Shared Windows logins handled automatically. When several people use one saved Windows account, each device gets its own Windows session and the session is signed out when its last tab closes, so nobody sees anyone else's work and no disconnected sessions pile up. The host is prepared for this in the background.
• Domain users can sign in to newly prepared hosts. Installing the Remote Desktop Session Host role can now add the domain's users to the host's Remote Desktop Users group, so a freshly joined host no longer refuses everyone but administrators.
• A clear refusal message. When a host refuses an account, the portal now says You are not authorized to use this application, naming it, and the log records the host's real reason.

Fixes

• Installing the Remote Desktop Session Host role works on a host in a different domain from the DartRelay server. The host's management account only needs to be a local administrator on that host, and a failure now names the account and the reason.
• After a host restarts with the role installed, its page no longer shows the install panel beneath the green confirmation.

Seats count devices, and one portal can run on several servers

The largest release since 1.0. A Relay Seat now counts a device rather than a person, several servers can serve one portal behind a load balancer, one licence can cover several installations, an address can be opened to the public without a sign-in, and people can reset their own passwords.

Licensing and seats

Signing in to the portal costs nothing at all — the seat is taken by the first launch and returned when the last session on that device ends. A device is a browser profile on a machine, recognised by a cookie. Nothing is fingerprinted.

The consequences, stated plainly:

• Two browsers on one machine, used at the same time, are two seats. Close one and open the other and it is one seat throughout.
• A desk PC and a laptop in use at once are two seats.
• Clearing cookies does not cost a seat.
• One person moving between three machines during the day holds one seat at a time, as long as they sign out or their sessions end.

The unit changed because credentials are shareable. Five accounts used by a hundred people read as five people, and a hundred people were served for the price of five. Two people at two screens are two devices whatever account they type.

A page that shows you the evidence

System → Seats gives one row per device, with the accounts that used it, live sessions, first seen and last active, address, tenant, and — in a pool — the server it is on. It carries the highest number of devices in the last thirty days, which is the figure to hold a renewal conversation on, a CSV export, and a Release control that ends a device's sessions and returns its seat. Two flags mark a likely second browser and a device seen from several addresses at once; both are reports, and neither changes the count.

One licence across several installations

Any activated installation can share its seats with others, so sites that cannot share a database — or cannot reach the internet — still draw on one pool. The installation holding the key issues a single-use enrolment token, lasting 24 hours, and lists every installation using it with its seat usage and a Revoke control. An enrolled installation keeps working on its own if the key holder cannot be reached, up to an allowance based on what it has actually been using. Open sessions are never cut.

Grace, and a notice you cannot miss

Grace now covers expiry as well as an unreachable key holder: applications keep launching after a licence expires until grace ends, with the date shown. A licence notice appears above every console page from ten days before expiry, turning red for the last three days and while an installation is running on grace. It cannot be dismissed, and it clears the moment the licence is renewed.

Licences now also carry an Extra percentage, allowing a short burst above the licensed number rather than a refusal. Seventy seats at five per cent is seventy-three, and the console says so in those words.

Running more than one server

DartRelay now runs as a highly available, active/active pool: several servers sharing one database, behind your load balancer, on a hostname of their own. Each extra server is added during installation and needs no licence key of its own. Every server serves the portal and launches applications, and you can drain one server, patch it, and put it back without a maintenance window.

System → Load balancer is a new page holding the settings once for every server: trusted proxies, forwarded-header handling, the public address used in email, sign-in by header for appliances that authenticate in front of DartRelay, and the sign-out address. A value set in a server's own configuration file still overrides the console for that server, and the page shows it as locked.

Getting in

An address can admit visitors without a sign-in

Nominate one guest account for the installation, then turn it on either installation-wide or for a single address. A bound address decides this on its own, so turning the installation switch on can never open a customer's branded address. Pair it with an automatic-launch rule and a public address becomes one application and nothing else.

People can reset their own password

A Forgot your password? link on the sign-in page emails a one-time link, for portal accounts and Active Directory accounts alike. It needs two switches — one on the theme, one on the Security page — so that branding permission alone cannot open it. The page gives the same answer whatever is typed, so it cannot be used to discover which usernames exist, and the link always goes to the address already held for the account.

Sessions and hosts

• A separate Windows session for each device, as a per-host option. One person in two browsers gets two Windows sessions instead of sharing one.
• Sign out of Windows when the last tab closes, as a per-host option. Stops abandoned disconnected sessions being offered to the next arrival. Published applications only.
• Applications follow the window. Going full screen, or leaving it, now resizes the application to fit instead of leaving it at its old size.

The portal

• A single-application portal. An address can be reduced to one application with no catalogue behind it: the Home tab hidden, the application opening by itself, and a Start again panel when the person closes it.
• Automatic launch is chosen per address. Open an address under Tenancy & Branding and add rules to it in the order you want them. The rule still decides what opens and who it applies to; the address decides where.
• File transfer settings moved. One card holds the path, the account and what people may do in the drive, and any individual desktop or application can override all of it.

Maintenance

Fixed a permission check that was refusing the console's own keep-alive requests and filling the log with denials.

A real file browser

Upload and download became one panel behind a single button in the session toolbar.

Move up and down folders, filter, drag files in, and take several files or a whole folder out as a zip. Delete, rename and create folder arrived with it, each separately controlled by the administrator.

The Download folder that used to appear in the drive root is gone. Files are taken out by selecting them in the browser, rather than by saving into a specially named folder — which had the side effect of deleting anything written there.

Tenancy, and a brand for every customer

• Tenancy & Branding. An address can be bound to a tenant with its own brand, its own seat allocation, its own announcements and its own terms of use — from one installation, without a second licence.
• Seat allocation per tenant, enforced on top of the licence rather than instead of it, with the allocated-against-licensed comparison on the page.
• Announcements and agreements aimed at chosen tenants, and notices that can be placed where you want them on the page.
• Certificates that renew themselves, issued and renewed automatically.
• Restricted categories — a folder of resources and everything in it hidden from anyone not granted it.
• Idle timeout measured at the keyboard, a password age policy, and a fuller theme editor.

The foundations

DartRelay 1.0 was released on 7 September 2024. Over the releases that followed, the product grew from a way of putting a Windows application in a browser into the platform described above.

What was laid down across these releases, all of which is still here:

• Publishing applications and desktops from Windows hosts with nothing installed on them — no agent, then or now.
• The portal: a catalogue of resources, sessions as tabs, favourites, search and sort.
• Web applications alongside published ones.
• Sign-in against portal accounts, local Windows accounts and Active Directory, with two-factor authentication and a verification challenge.
• Administrator roles and permissions, and an audit log.
• Themes and a block editor that builds the sign-in and home pages piece by piece, rather than tinting a fixed design.
• Categories, automatic launch, file transfer, printing to PDF, email delivery and templates, and five shipped portal languages with the means to add more.