|
XDESK – Terms & Conditions
Security baseline, session controls, account lifecycle rules, and support boundaries for XDESK.
|
Overview
This page outlines the baseline policies applied to XDESK (hosted desktops and remote app access). These policies apply to all users unless a specific written exception is recorded for your organisation.
Security Baseline Policies
Our baseline is designed to align with the intent of the ACSC Essential Eight (strong identities, least privilege, and safe session behaviour), while keeping policies practical for end users.
1) Password policy (passphrase-first)
- Minimum length: 15 characters.
- Must not include: the user’s name or username.
- Complexity requirement: passwords must meet complexity requirements by using characters from at least 3 out of these 4 categories: uppercase letters, lowercase letters, numbers, and special characters.
- Recommended format: long passphrases (easy to remember, hard to guess) that still satisfy complexity requirements. Example: Everysummerisfishingtime2025!! or OnTh3C4llalwayz or I met him and I laugh3d!!
- Reuse protection: the last 10 passwords are remembered and cannot be reused.
- Change timing: users must wait at least 1 day between password changes.
Password expiry: passwords must be reset at least every 365 days (1 year). Earlier password resets may also be required where there is evidence of compromise, suspected compromise, or on request by the Client for compliance or security reasons.
2) Account lockout policy (brute-force protection)
XSTRA enforces account lockout settings to reduce the risk of credential stuffing and brute-force login attempts.
These settings form part of our baseline security posture. For more information on the ACSC Essential Eight framework, see: ACSC Essential Eight.
3) Multi-Factor Authentication (MFA)
MFA significantly reduces risk from stolen passwords. Where available and feasible, XSTRA recommends MFA for all remote access. MFA may be required for privileged/admin access, and can be deployed using XSTRA security services where contracted.
For information on XSTRA’s cybersecurity services, see: XFORCE.
Session Management
Idle session disconnect policy
XDESK sessions that are active but idle (no keyboard/mouse input) will be automatically disconnected after 2 hours of inactivity.
- Reduces the risk of unattended sessions being exploited
- Frees resources tied to inactive sessions
- Encourages better session hygiene for shared environments
Important: save your work before disconnecting
XDESK sessions are often persistent between logon/logoff events, however sessions can be terminated to facilitate maintenance and administrative tasks. Users should always save all work before disconnecting.
To understand when maintenance may occur, refer to: XDEVICE – Maintenance Schedule.
Backup & Recovery Statements
For clarity regarding statements about data protection, cyber protection, and the scope of backups vs real-time threat prevention, please refer to the dedicated policy page:
XDESK – User Account Disablement & Deletion Policy
Often clients forget to disable a user account with us and incur costs that should have been avoided. Unless we have written directives from the Client to the contrary, XSTRA will apply the following:
Retention / legal hold note: If your organisation requires retention, archiving, or legal hold, you must provide written directives to XSTRA so account actions align with your policy and compliance obligations.
XDEVICE – PC Edition Subscription (Mandatory)
To maintain the security and integrity of each Client’s XDESK environment, all Windows PCs owned and used within the Client’s environment must be covered by an XDEVICE PC Edition subscription. This reduces cyber risk from unmanaged endpoints, improves visibility, and simplifies supportability.
Included entitlement (effective 1 July 2025)
Each XDESK user subscription includes one complimentary XDEVICE PC Edition subscription. If the number of PCs exceeds the number of active XDESK users, additional XDEVICE PC Edition subscriptions will be billed separately at the prevailing rate.
In most cases, the Client will need to contact XSTRA to have additional XDEVICE subscriptions added.
Hosted Environment Re-establishment, Rebuilds & Lifecycle Projects
XDESK recurring service charges cover the ongoing operation and support of the contracted XDESK platform and agreed XSTRA-managed components. From time to time, the underlying Client environment may require a material rebuild, re-establishment, migration, redesign or lifecycle upgrade.
Typical examples
- Operating-system lifecycle upgrades or replacement of ageing or unsupported server platforms
- Rebuilding or replacing Domain Controllers, Remote Desktop Services infrastructure, Remote Desktop Session Hosts or other Client-specific servers
- Application, database or data migration
- Major architecture changes, re-platforming or redesign
- Re-establishing application, EFTPOS, web-store, API, database or other third-party integrations
- Recovery work that extends beyond normal restoration of the existing environment
Where the technical effort is materially equivalent to a new setup, migration or rebuild, the work is treated as a separately scoped technical project rather than routine recurring XDESK support. Unless expressly included in an accepted proposal or service schedule, technical effort is time-tracked and billed in accordance with Schedule 1 Rates & Charges, or delivered under an accepted quotation or project scope.
No surprises: Before planned material chargeable work proceeds, XSTRA will discuss the required work with the Client, identify known third-party dependencies, provide an estimate, agreed time allowance or cost limit where reasonably practical, and obtain approval from an authorised Client representative.
This does not alter any restoration, support or remediation obligation expressly included within the Client’s contracted XDESK or XCLOUD service. Normal operation of the core XDESK platform remains governed by the applicable product terms.
XDESK Support Policy
XDESK includes support for the core XDESK service, including access and connectivity to the platform, the core Microsoft operating system components used within XDESK, and the Citrix and related core components used to deliver the service. This recurring support does not create an unlimited engineering entitlement for material rebuilds, migrations, lifecycle upgrades, redesign or third-party application and integration work.
Broader support scope
For broader support boundaries, including third-party software, vendor liaison, billable assistance, elevated privilege scenarios, major rebuilds, migrations, lifecycle projects and related limitations, refer to the XCARE Support Scope Policy. XCLOUD service conditions govern the underlying hosted platform where applicable.
| XCARE Support Scope | XCLOUD Terms | Rates & Charges |
Agreement & Document Alignment
These XDESK conditions must be read together with the Client’s accepted proposal or order, applicable XCLOUD terms where the service is hosted on XCLOUD, the XCARE Support Scope Policy, Schedule 1 Rates & Charges and XSTRA’s Global General Terms and Conditions of Trade. Where documents conflict, the applicable overarching agreement governs unless an express written variation states otherwise.
Need more help with this?
© 2021–2026 XSTRA Group Pty Ltd (Australia). All rights reserved.