Read this first. BukDesk has not yet run on a real domain network or under a real Group Policy. The installer, the firewall rules and the policy switches have run on a clean Windows Server, as an administrator, on a machine in no domain. Start with a few computers.

Licensing

One license per person, on up to 3 of that person's computers. $39 once. Buy several in one order, with one invoice, and hand them out yourself. A license needs no account and no server: it is a signed text that the app checks on the computer.

Installing

  • A silent install: BukDesk_<version>_x64-setup.exe /S.
  • It installs for the whole computer and needs an administrator. The app itself runs as the signed-in user, with no driver.
  • Every program in it is signed by Bukchair Ltd. Allow it by publisher.
  • Nothing connects by itself at install. Each person sees the terms of use the first time they open the app.

Turning parts off

A machine policy in the registry turns off all of BukDesk, or one part: sharing, the clipboard alone, files, messages between AI sessions, new pairings, the screen viewer, the relay, the relay on public networks, or control over the internet. A person cannot turn back on what a policy turned off, and the app says on screen that the organization did it.

Updates have a policy of their own: automatic, ask first, or off.

What crosses the network

  • On the local network: announcements with the computer's serial, and encrypted connections between paired computers. Two inbound firewall rules, TCP 15180 and UDP 15181, on private and domain profiles only.
  • Over the internet: nothing, until a person opens it on both computers. Then TCP 443 out to the relay. No inbound port.
  • Updates and licenses: an update check about every 12 hours, with no identifier in it, and a request when a person presses to fetch a license.
  • No telemetry.

What to know before you allow it

  • Every computer running BukDesk announces its serial on the network it uses. On a domain network, that is everyone in the office.
  • Pairing is a real grant. A paired computer that a person has placed next to theirs can type on it.
  • The relay does not work through a proxy that inspects TLS. That is on purpose.
  • An independent security review is planned before launch. It has not happened yet.

More

The help center has more for whoever runs the computers, Group Policy among it. The security page has the reasoning.