This article covers everything your IT team needs to prepare before deploying Desktop Connect: system requirements, network configuration, firewall rules, and proxy considerations.
Supported Platforms
Windows:
- Minimum: Windows 8 and above
- Recommended: Windows 10 or Windows 11 for best performance and feature support
- Server: Windows Server 2012 R2 or later (for server deployments)
- Both Home and Pro editions are supported.
macOS:
- Minimum: macOS 10.11 (El Capitan) or later
- Architectures: Intel (x86_64) and Apple Silicon (ARM64)
Deployment methods:
- Manual install
- MDM (Microsoft Intune, Jamf Pro, Mosyle, Kandji)
- RMM, Group Policy, SCCM
Hardware Requirements
- Processor: Any modern processor (Intel Core i3 equivalent or better)
- RAM: 2 GB minimum. 8 GB recommended.
- Storage: 500 MB free space for installation. SSD recommended.
- Display: Standard display. No special requirements.
Resource Footprint
Desktop Connect is a lightweight, headless agent with no graphical interface. It runs as a background process with minimal resource impact.
- CPU: Typically less than 1% average, under 5% at peak. Per user session.
- Memory: 30 to 90 MB per session. Range depends on active module count.
- Disk: Under 100 MB installed. No local data caching.
- Network: Minimal bandwidth. Lightweight metadata payloads only (timestamps, durations, identifiers).
The agent scales linearly in VDI and multi-session environments (Citrix, AVD, VMware Horizon) without creating resource contention, even at high user density on a single host.
Network Configuration
Desktop Connect requires outbound HTTPS access (port 443) to communicate with the Prodoscore cloud. No inbound ports need to be opened.
Finding Your Organization’s Domain
Several endpoints below reference your organization’s unique subdomain. To find it:
Example: If your platform URL is https://acme.ag.prodoscore.com, your base domain is acme.
Domain Whitelisting (HTTPS / Port 443)
For the most resilient configuration, whitelist the wildcard domain. This covers all current and future Prodoscore agent endpoints.
Recommended (wildcard):
- *.ag.prodoscore.com — all Prodoscore agent endpoints
- origin.hrsaastech.com — licensing server
- storage.googleapis.com — cloud storage services
Explicit subdomains (if your policy does not allow wildcards):
- api.ag.prodoscore.com
- auth.ag.prodoscore.com
- portal.ag.prodoscore.com
- <your_base_domain>.ag.prodoscore.com
- origin.hrsaastech.com
- storage.googleapis.com
IP Address Whitelisting
If your firewall requires IP-based rules in addition to domain rules, allow HTTPS traffic to the following licensing server IPs:
- 104.26.15.125
- 172.67.72.141
- 104.26.14.125
- 104.21.48.128
- 172.67.151.154
Note: For the most complete coverage, whitelist both the static IP addresses above and the dynamically resolved IP addresses of the domains listed in the previous section.
Proxy and Web Security Suites
Organizations using web security gateways (Zscaler, Netskope, or similar) must exclude the Prodoscore domains listed above from SSL inspection and from any authentication challenges. If the gateway intercepts and re-signs HTTPS traffic to these endpoints, the agent cannot establish a trusted connection and will fail to transmit data.
Verify the following:
- All Prodoscore domains are on the SSL inspection bypass list.
- The domains are excluded from captive portal or authentication prompts.
- If your proxy requires explicit per-application configuration, the agent uses the system proxy settings on both Windows and macOS.
Antivirus and Endpoint Security
If your computers run antivirus or EDR software, add process exceptions for Desktop Connect:
Standard Mode (Windows):
- C:\Program Files\Prodoscore\MyZenV2\MyZenV2.exe
- updater.exe
Stealth Mode (Windows):
- C:\Program Files\zs\zs\MyZenV2s.exe
- zsrvc
- updater.exe
macOS:
- /usr/local/zs/zs.app
If not whitelisted, antivirus may block the agent, causing installation or runtime failures.
macOS Permissions
macOS requires configuration profiles to pre-approve Accessibility and Screen Recording permissions for silent deployment. Without these profiles, end users receive system prompts asking them to grant access manually.
Two .mobileconfig profiles are required (provided by Prodoscore upon request):
- Notifications profile: Suppresses the “Background Items Added” notification on first launch.
- Accessibility profile: Pre-grants Accessibility permissions so the user is never prompted.
Deploy these profiles through your MDM before or at the same time as the PKG installer. See the Jamf Pro Deployment Guide or Intune Deployment Guide for platform-specific steps, or contact support@prodoscore.com to request the profile files.
Important: If your organization does not use an MDM for Macs, the end user will need to manually approve Accessibility and Screen Recording permissions in System Settings > Privacy & Security after installation.
What the Agent Transmits
Desktop Connect collects activity metadata only. This includes application names, window titles, URL domains visited, and time spent in each context. All data is transmitted to the Prodoscore cloud over encrypted HTTPS connections.
The agent does not perform keystroke logging, screen recording (unless explicitly enabled by the administrator), or content capture. It does not cache data locally on the workstation.
For full details on data collection scope and privacy controls, see Data Collection Transparency and How Desktop Connect Respects Employee Privacy.
Connectivity Test
To verify the agent can communicate with Prodoscore servers after deployment:
See Common Questions & Answers for additional troubleshooting steps.
Support
If you have questions about network configuration or need help preparing your environment for Desktop Connect, contact support@prodoscore.com.
