Approving remote access is a business decision, not a technical one. Here are the questions every owner asks, with answers that do not hide the uncomfortable parts.
If you are the IT person proposing home access, your real job is answering the owner — and owners ask sharper questions than technicians expect. This page takes the six standard questions in order and answers each the way this series sets things up: a mesh VPN, named accounts with MFA, a gateway into the office LAN, and Remote Desktop for real work. Where the honest answer is 'that depends on your discipline', it says so. Take this page into the meeting.
Only the people the admin has invited, each with a personal account protected by a password plus a phone code (MFA), connecting from devices the admin can see in a list. There is no public door: nothing in the office listens on the internet, so random attackers scanning the internet find no office to attack. Compare that with the old way — an RDP port open to the world — where the answer to this question was honestly 'anyone who guesses or buys a password'.
Then two locks matter. First, the laptop's own Windows login and disk encryption protect what is on it. Second, and decisively, the admin disables that person's VPN account and removes the device from the console — a five-minute job that slams the office door regardless of the laptop. The honest condition: this works only with named accounts. A shared login cannot be revoked for one thief, which is why this series treats shared logins as a firing offence for a setup.
Only if you set it up that way. A subnet route makes the network reachable; Windows passwords and share permissions still decide what each person can actually open — the same controls as in the office. For tighter control, most mesh VPN tools also offer access rules (which users may reach which addresses and ports), so the accountant can be limited to the accounts server and their own PC while the IT admin reaches everything. Reachable is not the same as permitted, and you want both layers.
Not by design. With the Remote Desktop pattern, files are opened on office machines and only the screen travels home. Honesty requires the footnote: a determined insider can still photograph a screen or copy what their permissions allow — remote access does not create that risk, being employed does. What the setup does give you is a log of who connected and when, which the 'sneak a pen drive in the office' method never did.
Three honest risks remain. A staff member's home PC is compromised — answered by the hygiene rules in this series and by disconnecting when not working. An account is phished despite MFA — rare, answered by device lists, logs and fast revocation. The gateway PC fails — an inconvenience, answered by a backup gateway. Notice what is not on the list: the internet-wide attacks that hit exposed RDP and file shares every day. Removing the public door is the single biggest risk reduction in the whole design.
For a small office, the tools in this class have free tiers that cover a handful of users, and paid tiers priced per user that remain cheaper than one day of office closure. The honest total cost also includes the admin's setup time and the discipline in these pages. What it replaces is worse: staff carrying data on personal pen drives, emailed spreadsheets, and the 'just open the port, it is only for a week' decisions that end in ransom notes. Approved properly, this is not the risky option — it is the replacement for the risky ones already happening quietly.
Watch the video for the full setup the boss is being asked to approve.
▶️ Watch Full VideoYes, and that is the smart way to start. Invite one trusted staff member, watch the logs for a few weeks, and let the owner see exactly who connected and when. A visible, controlled trial answers more doubts than any presentation.
The VPN console shows connections by named account with times, and the office server's own logs show file access. Together they give a fair picture: when each person connected, from which device, and what they opened on the server. It is accountability without spy software on anyone's home PC.
It is fully reversible in minutes: disable the members, or switch off the gateway. Because nothing was ever opened on the router and no data was moved to homes, stopping is clean — there is no exposed port to hunt down and no copies of the data to recall.