Robot sessions

A robot session is a Windows user account that the bot uses to run unattended execution. It stores a (reusable) Windows username and password, and is what gives the robot a desktop to work on when no one is logged into the machine.

It is a resource in the environment (like agents or credentials) and is not tied to a specific agent: the same robot session works for any agent in the environment.

Why is it needed? Attended vs. unattended

Mode	How the bot runs	Do you need a robot session?
Attended	In the Windows session of a person who already has their desktop open (she launches the bot on her computer)	No — use the desktop that is already open
Unattended	On a server or VM with no one present, with Agent running as a Windows service	Yes

The key point: interface automation (moving the mouse, opening windows, automate the desktop or a windowed browser) requires an active Windows desktop. In unattended, that desktop doesn’t exist on its own — no one is logged in. The robot session solves this: the agent uses that Windows account to open (or reuse) a desktop session of the bot, and runs the automation within it.

If your bot doesn’t touch the interface

Processes that only use HTTP, databases, files, Excel, SMTP/IMAP mail, or a headless browser do not depend on a visible desktop. Even so, the portal asks you to choose a robot session when launching the execution: it is the Windows account under which the process will run.

Create a robot session

1. Enter the environment and open the Robot Sessions tab.
2. Click New session.
3. Fill out the form:
   • Name — an identifier for the session (e.g. bot-cuenta-01).
   • Windows user — the Windows account, with domain if applicable: DOMINIO\bot01 or bot01 (local account).
   • Windows Password — the password for that account.
4. Click Create Session.

To change your password later, edit the session and enter the new password (leave it empty to keep the current one).

The password is saved encrypted

The Windows password is stored encrypted and is only used on the agent machine to log in to the bot. It is not shown back in the portal nor does it appear in the logs.

Windows account requirements

For a robot session to work unattended, the Windows account must meet, on the agent machine:

• Remote Desktop Login (RDP) permission The agent opens a desktop session for the bot using a local Remote Desktop connection; The account requires the “Allow login via Remote Desktop Services” right and Remote Desktop is enabled on the machine.
• Batch login. The agent automatically grants the batch login (SeBatchLogonRight) right to the account.
• Valid and non-expiring password. If the password expires or changes, runs will fail at login until you update the password in the robot session. That is why it is advisable to use a service account with a password that does not expire.

Use a dedicated account for the bot

The recommended thing is a Windows account exclusive to the robot (not that of a person), with the minimum permissions that the process needs and a managed password. So the bot has its own desktop, its own configuration and separate traceability.

Use a robot session when running

The robot session is chosen when launching the process:

• In Run Manually, the new run dialog asks for process, agent, and robot session (all three are required).
• In scheduled triggers, you configure the robot session with which each automatic execution will run.

Each selector option displays the name, Windows user, and state of the session.

States

Status (on the portal)	Significado
Disponible	The session is ready to use
No disponible	The account does not have a usable desktop at this time (no active session, or a connection/credentials issue)

The agent reports the status of the sessions to Zoan Cloud; If one becomes Unavailable just when it should run, check that the machine is turned on, that the account can log in via RDP, and that the password is still valid.

Robot vs. session credential

Don’t confuse them — they are different and complementary things:

	Robot session	Credencial
What does it keep	The Windows account under which the bot runs	Secrets of systems that the bot uses (ERP, email, API, DB)
for what	Give the bot an unattended desktop	Let the playbook access a system without exposing the secret
How to use	It is chosen when executing the process	It is referenced in the playbook with = credential("nombre")

Which one do I need?

Almost always both, for different things. Think about it like this:

• Where does the bot run? → a robot session (the Windows account that gives you unattended desktop). One per machine/account, chosen at launch.
• What systems does the bot enter? → a credential for each system (the ERP, the email, the database). As many as systems use the playbook.

Example: a bot that runs at night to download invoices from a portal needs a robot session (to have a desktop) and a credential with the portal username/password.

Next steps

• What is an agent — the machine where the bot runs.
• Run manually — choose the robot session when launching.
• Credential Management — secrets of the systems the bot uses.