Windows 8 : Managing User Access and Security - Managing Remote Access to Workstations (part 1) - Configuring Remote Assistance

Windows 8 has several remote connectivity features. With Remote Assistance, users can send invitations to support technicians, enabling the technicians to service a computer remotely. With Remote Desktop, users can connect remotely to a computer and access its resources. In this section, you’ll learn how to configure Remote Assistance and Remote Desktop. Typically, neither the Remote Assistance feature nor the Remote Desktop feature is enabled, and you must enable these features manually.

Remote Assistance and Remote Desktop can function through Network Address Translation (NAT) firewalls. Remote Assistance also has built-in diagnostic tools. To allow for easier troubleshooting and escalation of support issues, two different support staff can connect to a remote computer simultaneously. When troubleshooting requires restarting the computer, Remote Assistance sessions are reestablished automatically after the computer being diagnosed reboots.

Prior to using Remote Assistance, you might want users to use the Problem Steps Recorder to create a step-by-step record of a problem they are experiencing. The Problem Steps Recorder is very easy to use. To start and use the Problem Steps Recorder, complete the following steps:

1. Have the user start the Problem Steps Recorder. One way to do this is by having the user press the Windows key, type psr, and then press Enter. Once the tool is started, the user can prepare the environment and then begin recording the problem.

2. To turn on recording, the user taps or clicks Start Record. Once recording has started, the user can perform the action that isn’t working and tap or click Add Comment to add comments as she works.

3. When the user experiences the problem and the related errors have been displayed, she can stop recording by tapping or clicking Stop Record.

4. When the user stops recording, Problem Steps Recorder shows all the steps the user took while the problem was being recorded. The user can then tap or click Save to display the Save As dialog box. The user selects a save location and name for the .zip file that contains the record of the problem in an embedded .mhtml file.

5. The user can send the .zip file to a support technician in an email message or by copying it to a file share. To review the recorded problem steps, you double-tap or double-click the .zip file to display its contents in File Explorer and then double-tap or double-click the enclosed .mhtml file to open it in Internet Explorer.

6. You’ll then see screen captures for all the steps the user took while the problem was being recorded. After the screen captures, you’ll find additional details for each step that are generated automatically. You can use this information along with any user comments to help you troubleshoot the problem.

1. Configuring Remote Assistance

Remote Assistance is a useful feature for help desks, whether in-house or outsourced. A user can allow support personnel to view and take control of his desktop. This feature can be used to walk users through a complex process or to manage system settings while they watch the progress of the changes. The key to Remote Assistance is in the access levels you grant.

When enabled, Remote Assistance is configured by default to let support personnel view and control computers. Because users can send assistance invitations to internal and external resources, this could present a security concern for organizations. To reduce potential security problems, you might want to allow support staff to view but not control computers. Computers running Windows Vista or later allow connections only from computers running Windows Vista or later. This option is helpful to limit any possible compatibility issues and to ensure that any security enhancements in Windows Vista or later are available within Remote Assistance sessions.

Another key aspect of Remote Assistance you can control is the time limit for invitations. The default maximum time limit is 6 hours; the absolute maximum time limit you can assign is 30 days. Although the intent of a multiple-day invitation is to give support personnel a time window in which to respond to requests, it also means that they could use an invitation to access a computer over a period of 30 days. For instance, suppose you send an invitation with a 30-day time limit to a support person who resolves the problem the first day. That person would still have access to the computer for another 29 days, which wouldn’t be desirable for security reasons. To reduce the risk to your systems, you’ll usually want to reduce the default maximum time limit considerably—say, to 1 hour. If the problem is not solved in the allotted time period, you can issue another invitation.

To configure Remote Assistance, follow these steps:

1. In Control Panel, tap or click System And Security. Under the System heading, tap or click Allow Remote Access. This opens the System Properties dialog box with the Remote tab displayed, as shown in Figure 1.

2. To disable Remote Assistance, clear the Allow Remote Assistance Connections To This Computer check box, and then tap or click OK. Skip the remaining steps.

3. To enable Remote Assistance, select Allow Remote Assistance Connections To This Computer.

   

   Figure 1. Use the Remote tab options to configure remote access to the computer.

4. Tap or click Advanced. This displays the Remote Assistance Settings dialog box, as shown in Figure 2.

   

   Figure 2. The Remote Assistance Settings dialog box is used to set limits for Remote Assistance.

5. The Allow This Computer To Be Controlled Remotely option sets limits for Remote Assistance. When selected, this setting allows assistants to view and control the computer. To provide view-only access to the computer, clear this check box.

6. The Invitations options control the maximum time window for invitations. You can set a value in minutes, hours, or days, up to a maximum of 30 days. (Though the dialog box allows you to select a value of up to 99 days, any value in excess of 30 is reset to 30 when you tap or click OK.) If you set a maximum limit value of 10 days, for example, a user can create an invitation with a time limit up to but not more than 10 days. The default maximum expiration limit is 6 hours.

7. Tap or click OK twice when you have finished configuring Remote Assistance options.

In Group Policy, you can manage Remote Assistance using the policy settings shown in Table 1. These settings are found in the Administrative Templates policies for Computer Configuration under the paths shown.

Table 1. Policy Settings for Managing Remote Assistance

SETTING	PATH
Allow Only Windows Vista Or Later Connections	\System\Remote Assistance
Configure Offer Remote Assistance	\System\Remote Assistance
Configure Solicited Remote Assistance	\System\Remote Assistance
Turn On Session Logging	\System\Remote Assistance