Dell iDRAC9: first runs of the screenshot driver
Claim. A read-only driver for a Dell server's management controller (iDRAC9) takes a picture of the server's screen through Redfish, and the same reader and boot-phase classifier used for the KVMs read it. On firmware 7.00.00.185 this needs an account with the Access Virtual Console privilege. A Read Only account was refused. One controller, one day.
Method. The driver was run on 2026-10-16 against the iDRAC9 of one Dell server in the lab, with the operator's go. A dedicated account was made for it by the operator. The controller's certificate was checked over two separate network paths, found identical, and pinned before any password was sent. The driver sends a fixed list of requests: four reads, among them the manager and the system with its power state, and one screenshot action. It sends no keyboard or mouse input. It has a power action that is off unless a program turns it on in code; the command line cannot, and it was not used.
Result.
| Account and request | Result |
|---|---|
| Read Only (Login only): firmware and power state | Read correctly |
Read Only: ServerScreenShot, Preview, LastCrashScreenShot | Refused with 403, four times in all, including once after the password was rotated |
With Access Virtual Console: ServerScreenShot | A 1024x768 picture in 1.48 s, and 1.91 s in a second run |
With Access Virtual Console: Preview | A 400x300 thumbnail in 1.22 s |
With Access Virtual Console: LastCrashScreenShot | Refused with 400 because no crash capture existed. The driver now reports this as "no picture", not as an error |
The picture went through the same OCR and boot-phase classifier as the KVM frames. It was classified as kernel boot, because kernel messages were printed under a login prompt. OCR misread digits that are clear in the picture: tty1 as ttyl, 9090 as 9690 and 20071 as 28071. The digit guard flagged 66 risky tokens. This is why digits read by OCR are never trusted on their own.
What this changes. Dell's Redfish guide for an older firmware (4.20.20.20) says the screenshot action needs only Login. Firmware 7.00.00.185 refused it to a Login-only account and allowed it once the console privilege was added, so the guide does not describe this firmware.
The cost, stated plainly. On this firmware the account that can take the picture can also open the interactive console and send keyboard and mouse input to the server. The driver never asks for that, and its request list is fixed and tested, but the credential itself allows it. Seeing and typing come together here. The operator can put the account back to Read Only, which stops screenshots.
A slip, disclosed. While checking that the password was not in a log, the agent briefly passed it as an argument to a local search command. The exposure was local and short, and the password was rotated afterwards.
Sample size. One controller, one firmware, three successful pictures across two runs.
Not tested. Other iDRAC firmware versions and licence tiers. The licence state was not read from the unit. The iDRAC's own VNC server through the VNC driver. Other vendors' controllers. What the server's screen showed was not diagnosed here, and the picture is kept privately.
Limits. This is not support for iDRAC in general. It is one working read path on one unit, with a privilege cost that a buyer should weigh.