Wake-on-LAN for a team: shared machines, separate sign-ins
Machines that sleep when nobody is on them, stay awake while somebody is working on them, and go back to sleep afterwards is a solved problem for one person and one machine. It gets interesting the moment a second person needs to wake one — because the usual answer is to share a login, and a shared login is a credential nobody can revoke, on an account where everything anyone does looks identical.
This guide covers doing it properly: inviting people with their own sign-ins, giving them different rights, limiting somebody to particular machines, handing a wake button to someone with no account at all, and being able to see afterwards who did what.
Why the shared login always ends badly
It is not that sharing a password is theoretically insecure. It is that it removes the two things you need when something goes wrong. You cannot revoke one person's access, because there is only one credential and everybody has it — so when somebody leaves, the choice is changing the password for everyone or doing nothing, and in practice it is nothing. And you cannot tell who did what, because every action was taken by the same account.
The alternative is not more complicated to run. Each person is invited by email, signs in as themselves, and can be removed in one click. Everything they do lands in the account's history under their own name, which is what turns "who shut the design machine down at 4 p.m." from an argument into a lookup.
The role ladder
Four roles, each including everything below it. The ladder is deliberately short — a permission system nobody can hold in their head gets set to the top rung for everyone, which is the shared login again with extra steps.
- Wake — wake the machines they have been given, and see what happened. The safe default, and the only rung that can be limited to specific machines.
- Wake and power off — wake them, and also sleep, restart or shut them down. A separate rung on purpose: shutting a machine down can strand it in a way switching one on never can, so it is granted rather than assumed.
- Manage machines — everything above, plus editing the account's machine list.
- Admin — everything above, plus the dongles and inviting other people. Not billing, which stays with the account owner.
Sharing one machine, not the whole account
A grant does not have to cover everything. At the Wake rung it can be scoped to particular machines, which is what most real arrangements need: the person who opens the shop gets the till PC and nothing else, the contractor gets the render box for the length of the job, the neighbour feeding the cat gets the media server.
The people themselves are a plan feature and the numbers are the ladder: the Plus plan at £12 a year covers five machines and five people, which is a household or a very small office; the Pro plan at £24 a year covers twenty machines and twenty-five people, and adds the fleet features below. The free plan is one machine and one person — it is the right place to prove the wake works before anybody else is involved.
Somebody with no account at all
Sometimes the person who needs to wake a machine should not have a login on your account at all — a cleaner, a weekend duty manager, a client. On the Pro plan a wake link handles that: a URL that wakes exactly one machine and does nothing else. They tap it, the machine starts, and they never see your dashboard, your other machines or your account.
The URL is the credential, so treat it as one. It is revocable from the machine's page and stops working immediately when the arrangement ends, and every use lands in your history under the label you gave the link. Power actions are deliberately unreachable this way: a URL that could shut a machine down is not a wake button.
Grouping machines by where they live
Once there are more than a handful of machines, the useful axis is usually location rather than name. On the Pro plan machines can carry a site label — Office, Workshop, Front desk — and the dashboard groups them by it, so waking everything at one site is one action rather than eleven. That same grouping is what makes a maintenance window practical; the patching guide covers that side.
Batch actions go through exactly the same per-machine checks as pressing the buttons individually, one at a time, so a person with a scoped grant does not gain anything by using the group control.
Accounts, and locking them down
Sign-in is a magic link by default — there is no password on the account to leak, be reused, or be written on a note by the monitor. Anyone who wants a second factor can add a TOTP code from an ordinary authenticator app, and that is available on every plan including the free one: security is not something to put behind a price. Recovery codes come with it, because a lost phone should not be a lost account.
When somebody leaves, removing them is immediate and does not disturb anybody else. That is the difference the whole arrangement buys, and it is worth setting up before you need it rather than during the week you do.
If sharing is only part of what you need — an overnight patch window, a machine to reach while travelling, a homelab to spin down — who uses Wake-on-LAN maps the six common ones and points at the guide for each.