Chapter 6. Managing remote access to workstations
Windows 8.1 has several remote connectivity features. With Remote Assistance, users can send invitations to support technicians, enabling the technicians to service a computer remotely. With Remote Desktop, users can connect remotely to a computer and access its resources. In this chapter, you’ll learn how to configure Remote Assistance and Remote Desktop. Typically, neither the Remote Assistance feature nor the Remote Desktop feature is enabled, so you must enable these features manually.
Remote Assistance and Remote Desktop can function through Network Address Translation (NAT) firewalls. Remote Assistance has built-in diagnostic tools. When troubleshooting requires restarting the computer, Remote Assistance sessions are reestablished automatically after the computer being diagnosed reboots.
Using the Steps Recorder prior to Remote Assistance
Prior to using Remote Assistance, you might want users to use the Steps Recorder to create a step-by-step record of the problem they are experiencing. The Steps Recorder is very easy to use. To start and use the Steps Recorder, complete the following steps:
Have the user start the Steps Recorder, as shown in Figure 6-1. One way to do this is by having the user press the Windows key, type psr, and then press Enter. Before the Steps Recorder is started, the user can prepare the environment by closing programs and dialog boxes that aren’t related to the problem being diagnosed.
To turn on recording, the user taps or clicks Start Record. When recording has started, the user can perform the action that isn’t working and tap or click Add Comment to add comments as she works.
When the user experiences the problem and the related errors have been displayed, she can stop recording by tapping or clicking Stop Record.
When the user stops recording, the Steps Recorder shows all the steps the user took while the problem was being recorded (see Figure 6-2). The user can then tap or click Save to display the Save As dialog box. The user selects a save location and name for the .zip file that contains the record of the problem in an embedded .mhtml file.
The user can send the .zip file to you in an email message or copy it to a file share. To review the recorded problem steps, you double-tap or double-click the .zip file to display its contents in File Explorer, and then double-tap or double-click the enclosed .mhtml file to open it in Internet Explorer.
You’ll then find screen captures for all the steps the user took while the problem was being recorded. After the screen captures, you’ll find automatically generated details for each step. You can use this information along with any user comments to help you troubleshoot the problem.
Using Remote Assistance to resolve problems
Remote Assistance enables support personnel to view a user’s desktop and take control temporarily to resolve problems or walk the user through the execution of complex tasks. After Remote Assistance is configured locally or through Group Policy, as discussed in this section, you can work with this feature.
Understanding Remote Assistance
Only users running Windows desktop operating systems can initiate and respond to Remote Assistance invitations. In the enterprise, the easy way to work with Remote Assistance is as follows:
Be sure that Windows Firewall exceptions are created for the executable files Msra.exe and Raserver.exe, and open TCP port 135 for DCOM. Normally, these settings are configured by default through Group Policy.
Be sure that the user’s computer is configured to allow Remote Assistance as discussed in Configuring Remote Assistance later in this chapter and that you can connect to the computer by its computer name or IP address.
Windows 8.1 can detect when configuration settings are blocking Remote Assistance connections. If this is the case, when a person needing help tries to invite help, she will get an alert in Windows Remote Assistance stating that this computer is not set up to send invitations (see Figure 6-3).
The user will be able to tap or click Repair to have Windows Network Diagnostics look more closely at the problem. If the problem can be diagnosed, the user will then have the option to try implementing recommended repairs as an administrator (see Figure 6-4). If the user has Administrator permission on the computer, she can use this option to resolve the issue and can then close the troubleshooter.
With an enterprise configuration, you can provide remote assistance by following these steps:
Open Windows Remote Assistance. One way to do this is by pressing the Windows key, typing msra.exe, and then pressing Enter.
In the Windows Remote Assistance Wizard, tap or click Help Someone Who Has Invited You.
Tap or click Advanced Connection Option For Help Desk.
Enter the name or IP address of the computer you want to assist, and then tap or click Next to connect to the computer.
Users can initiate sessions by creating an invitation request. Support personnel initiate sessions by offering help to users. After a session is initiated, assistants can chat with users, observe their working screens, and, if permitted, control their computers.
Remote Assistance invitations can be created by using the following techniques:
Email invitation. Email invitations are sent as email messages to a named email address. An attachment provided in the message is used to initiate the Remote Assistance session. You might want to configure a standard email address, such as [email protected], to allow users to send invitation requests easily to the support team. If this address is configured in Microsoft Exchange Server as a distribution list that delivers the invitations to support team members or as an additional mailbox for specific team members, support staff will be able to handle requests more efficiently and users will have a standard way of requesting help.
File invitation. File invitations are saved as Microsoft Remote Control Incident (MsRcIncident) files. Double-tapping or double-clicking the file name initiates the Remote Assistance session. You can use file invitations if you are using web-based email and need to attach the invitation separately. You might also want to configure a shared folder that is automatically mapped as a network drive for users and ensure that it’s accessible by support personnel. Name the share something that easily identifies it as being used for assistance requests, such as HelpDeskRequests or AssistanceInvitations.
Easy Connect invitation. These use the Peer Name Resolution Protocol (PNRP) to send a Remote Assistance invitation over the Internet. Easy Connect requires access to a peer-to-peer network and an instant messaging program that supports Remote Assistance. Easy Connect generates an access password automatically, which allows the helper to connect directly to the computer. The helper’s contact information is saved for quick reference in the future. (This technique works only when both the helper and the person being assisted are using Windows 7 or later.)
With Windows 8.1, invitations must be created with a control password. The control password provides an additional layer of security in the Remote Assistance configuration, ensuring that users are authorized to provide remote assistance and that they know the invitation password.
To work properly, Remote Assistance relies on the presence of a network connection between the user’s computer and the assistant’s computer. Remote Assistance uses UPnP, SSDP, PNRP, and Teredo for communications. Because most firewalls do not allow these communications by default, a firewall between the two computers might prevent the assistance session, and to ensure success, an exception must be created for outbound communications from the assistant’s computer to the user’s computer. To configure the required Windows Firewall exception for Remote Assistance, follow these steps:
In Control Panel, tap or click System And Security. Under the Windows Firewall heading, tap or click Allow An App Through Windows Firewall.
In the Allowed Apps window, scroll down until you find Remote Assistance. Ensure that the Remote Assistance check box is selected. Keep in mind that before you can make any changes, you must select the Change Settings button.
You’ll find related check boxes for Domain, Private, and Public networks. Select or clear the check boxes to specify the network types for which Remote Assistance should be allowed. Tap or click OK.
Remote Assistance can work through NAT firewalls. When providing support through Remote Assistance, you’ll find built-in diagnostic tools that you can run with a single tap or click. Finally, thanks to the automatic reconnect-after-restart feature, if you need to restart a computer that you are assisting remotely, you won’t need to reconnect to the computer manually. The Remote Assistance session is reestablished automatically after the computer restarts.
Configuring Remote Assistance
Remote Assistance is a useful feature for help desks, whether in house or outsourced. A user can allow support personnel to view and take control of his desktop. This feature can be used to walk users through a complex process or to manage system settings while the user watches the progress of the changes. The key to Remote Assistance is in the access levels you grant.
When enabled, Remote Assistance is configured by default to let support personnel view and control computers. Because users can send assistance invitations to internal and external resources, this could present a security concern for organizations. To reduce potential security problems, you might want to allow support staff to view but not control computers. Computers running Windows Vista or later can be configured to allow connections only from computers running Windows Vista or later. This option is helpful to limit any possible compatibility issues and to ensure that any security enhancements in Windows Vista or later are available within Remote Assistance sessions.
Another key aspect of Remote Assistance you can control is the time limit for invitations. The default maximum time limit is 6 hours; the absolute maximum time limit you can assign is 30 days. Although the intent of a multiple-day invitation is to give support personnel a time window in which to respond to requests, it also means that they could use an invitation to access a computer over a period of 30 days. For instance, suppose you send an invitation with a 30-day time limit to a support person who resolves the problem the first day. That person would still have access to the computer for another 29 days, which wouldn’t be desirable for security reasons. To reduce the risk to your systems, you’ll usually want to reduce the default maximum time limit considerably—say, to 1 hour. If the problem is not solved in the allotted time period, you can issue another invitation.
To configure Remote Assistance, follow these steps:
In Control Panel, tap or click System And Security. Under the System heading, tap or click Allow Remote Access. This opens the System Properties dialog box with the Remote tab displayed, as shown in Figure 6-5.
To disable Remote Assistance, clear the Allow Remote Assistance Connections To This Computer check box, and then tap or click OK. Skip the remaining steps.
To enable Remote Assistance, select Allow Remote Assistance Connections To This Computer.
Tap or click the Advanced button. This displays the Remote Assistance Settings dialog box, as shown in Figure 6-6.
The Allow This Computer To Be Controlled Remotely option sets limits for Remote Assistance. When selected, this setting allows assistants to view and control the computer. To provide view-only access to the computer, clear this check box.
The Invitations options control the maximum time window for invitations. You can set a value in minutes, hours, or days, up to a maximum of 30 days. (Though the dialog box allows you to select a value of up to 99 days, any value in excess of 30 is reset to 30 when you tap or click OK.) If you set a maximum limit value of 10 days, for example, a user can create an invitation with a time limit up to but not more than 10 days. The default maximum expiration limit is 6 hours.
Tap or click OK twice when you have finished configuring Remote Assistance options.
In Group Policy, you can manage Remote Assistance by using the following policy settings, which are found in the Administrative Templates policies for Computer Configuration under the SystemRemote Assistance path.
Allow Only Windows Vista Or Later Connections
Configure Offer Remote Assistance
Configure Solicited Remote Assistance
Customize Warning Messages
Turn On Bandwidth Optimization
Turn On Session Logging
Creating Remote Assistance invitations
To create a Remote Assistance invitation for email, follow these steps:
In Control Panel, under the System And Security heading, tap or click Find And Fix Problems. In the left pane of the Troubleshooting window, tap or click Get Help From A Friend.
On the Remote Assistance page, tap or click Invite Someone To Help You, and then tap or click Use E-Mail To Send An Invitation.
Windows 8.1 starts your default email program and creates an email message with the invitation. In the To box, enter the email address of the person you are inviting, and then tap or click Send.
In the Windows Remote Assistance dialog box, you’ll find the connection password. This is the password the helper needs to use to connect to your computer.
To create a Remote Assistance invitation and save it to a file, follow these steps:
In Control Panel, under the System And Security heading, tap or click Find And Fix Problems. In the left pane of the Troubleshooting window, tap or click Get Help From A Friend.
On the Remote Assistance page, tap or click Invite Someone To Help You, and then tap or click Save This Invitation As A File.
Use the Save As dialog box to specify the path and file name for the invitation. If you specify the path to a network folder, the invitation can be accessed easily by an administrator with access to this network folder.
Give your helper the invitation file and the automatically generated password. This password is used by the person you are inviting and is valid only for the Remote Assistance session.
To create a Remote Assistance invitation for Easy Connect, follow these steps:
In Control Panel, under the System And Security heading, tap or click Find And Fix Problems. In the left pane of the Troubleshooting window, tap or click Get Help From A Friend.
On the Remote Assistance page, tap or click Invite Someone To Help You, and then tap or click Use Easy Connect.
Tell your helper the Easy Connect password. This password is generated automatically for this Remote Assistance session only.
By default, Remote Assistance invitations are valid for a maximum of 6 hours and enable support staff to remotely control a computer. You can change these settings by using the System Properties dialog box, as discussed in Configuring Remote Assistance earlier in this chapter. After you’ve sent the invitation by email or created the invitation file, the Windows Remote Assistance dialog box is displayed.
When you, as the helper, request shared control, the person you are helping gets a confirmation prompt asking if she would like to allow the helper to share control of the desktop (see Figure 6-7). The person being helped must tap or click Yes to permit shared control, but before that, you might want to have her allow you to respond to User Account Control (UAC) prompts. This permission is necessary to perform administrator tasks on the remote computer.
As shown in the upper-left corner of Figure 6-8, the Remote Assistance menu bar provides the following options to the helper:
Request Control/Stop Sharing. Requests or stops sharing control of the computer.
Fit To Screen/Actual Size. Resizes the other person’s screen to fit your window or displays the screen at actual size.
Chat. Opens a chat window for sending messages between the helper and the current user of the computer.
Settings. Allows you to configure the session settings. By default, a log of the Remote Assistance session is saved in the %UserProfile%DocumentsRemote Assistance Logs folder on the helper’s computer.
You can use the Chat option to talk to the person you are assisting and pass instructions. For example, if you and the user are connected to a fast corporate network, you might want to instruct the user to use the Settings option and then increase the bandwidth allocated to the connection. Before you can perform management tasks on the user’s computer, you must request control by tapping or clicking Request Control. When you request shared control, the person you are helping gets the confirmation prompt shown in Figure 6-9.
If you will need to perform any tasks on the user’s computer that require administrator permissions, you should use Chat to instruct the user to select the Allow... option prior to selecting Yes. By selecting this option, the user allows you to elevate commands and perform administration tasks as might be needed. You, the helper, can end the session by closing the Remote Assistance window.
For the person being helped, a Remote Assistance dialog box appears on the desktop. As shown in Figure 6-10, this dialog box provides the following options:
Pause/Continue. Effectively pauses the Remote Assistance request by temporarily not allowing the helper to view the remote desktop. The person being helped must then tap or click Continue to resume the Remote Assistance session.
Stop Sharing. Stops sharing control of the computer and ends the Remote Assistance session.
Settings. Allows the person being assisted to configure the session settings.
Chat. Opens a chat window for sending messages between the helper and the current user of the computer.
When you choose Settings, the Windows Remote Assistance Settings dialog box, shown in Figure 6-11, is displayed. The available settings depend on whether you are the helper or the person being helped and include the following:
Use ESC Key To Stop Sharing Control. When the person being helped presses the Esc key, shared control of the computer can be stopped if this option is selected. Otherwise, only the Stop Sharing option can be used.
Save A Log Of This Session. A log of the Remote Assistance session is saved automatically on the computer of the person being helped and the computer of the helper. The person being helped, the helper, or both can clear this option if a log of the session will not be needed.
Bandwidth Usage. By default, the bandwidth usage is configured so that the connection uses low resolution 16-bit color. Additionally, font smoothing, full-window drag, and desktop backgrounds are not enabled.
Tip
For faster connections, you might want to modify the bandwidth usage settings by using the Bandwidth Usage slider. With a medium setting, 32-bit color is allowed though desktop backgrounds and full-window drag are disabled. With a medium-high setting, only full-window drag is disabled. With a high setting, the connection has no bandwidth optimization.
When the person being helped presses the Esc key, shared control of the computer can be stopped if the related option is selected. Otherwise, the user can only use the Stop Sharing option. The person being helped also can use Pause and Resume to control the connection. When the connection is paused, the helper cannot view the desktop of the remote computer.
Offering remote assistance or answering a Remote Assistance invitation
If you know that a user is having problems with her computer, you can follow these steps to offer remote assistance rather than waiting for her to send you an invitation or Easy Connect password:
Start the Windows Remote Assistance Wizard. One way to do this is to type msra in the Everywhere Search box, and then press Enter.
In the Windows Remote Assistance Wizard, tap or click Help Someone Who Has Invited You.
Tap or click the Advanced Connection Option For Help Desk link.
Enter the name or IP address of the computer you want to assist, and then tap or click Next to connect to the computer.
If a problem occurs when attempting to make the connection, you’ll find a warning prompt similar to the one shown in Figure 6-12. Select Troubleshoot to have Windows Network Diagnostics look more closely at the problem. If the problem can be diagnosed, you will then have the option to try implementing recommended repairs. Keep in mind, however, that the connection issue might be caused by a firewall running on the user’s computer or another configuration issue on the user’s computer.
If someone has already created an invitation, you can answer the invitation by double-tapping or double-clicking the related email attachment or file. You can also answer an invitation saved to a file by following these steps:
Start the Windows Remote Assistance Wizard. One way to do this is to type msra in the Everywhere Search box and then press Enter.
In the Windows Remote Assistance Wizard, tap or click Help Someone Who Has Invited You.
Tap or click Use An Invitation File, and then use the Open dialog box to locate the invitation. Tap or click Open.
When prompted, provide the necessary password for the invitation.
Tap or click Finish. You are connected to the computer of the user needing assistance, provided that the user hasn’t canceled the invitation, the invitation hasn’t expired, and Remote Assistance is allowed. If a problem occurs when attempting to make the connection, you’ll get a warning prompt similar to the one shown previously in Figure 6-12. Select Troubleshoot to try to identify and resolve the problem.
If someone is using Easy Connect and has sent you the password, you can answer the invitation by following these steps:
Start the Windows Remote Assistance Wizard. One way to do this is to type msra in the Everywhere Search box, and then press Enter.
In the Windows Remote Assistance Wizard, tap or click Help Someone Who Has Invited You.
Tap or click Use Easy Connect. When prompted, provide the password for the invitation.
Tap or click OK. You are connected to the computer of the user needing assistance. If a problem occurs when attempting to make the connection, you’ll get a warning prompt similar to the one shown previously in Figure 6-12. Select Troubleshoot to try to identify and resolve the problem.
Using Remote Desktop
Unlike Remote Assistance, which provides only a controller view of the current user’s desktop, Remote Desktop provides several levels of access:
If a user is logged on to the desktop locally and then tries to log on remotely, the local desktop locks, and the user can access all of the running applications just as though he were sitting at the keyboard. This feature is useful for users who want to work from home or other locations outside the office, enabling them to continue to work with applications and documents that they were using prior to leaving the office.
If a user is listed on the workstation’s Remote Access list and is not otherwise logged on, she can initiate a new Windows session. The Windows session behaves as though the user were sitting at the keyboard. It can even be used when other users are also logged on to the computer. In this way, multiple users can share a single workstation and use its resources.
Configuring Remote Desktop access
Remote Desktop is not enabled by default. You must specifically enable it to allow remote access to a workstation. When it is enabled, any member of the Administrators group can connect to the workstation. Other users must be placed on a Remote Access list to gain access to the workstation. To configure remote access, follow these steps:
In Control Panel, tap or click System And Security, and then tap or click System.
On the System page, tap or click Remote Settings in the left pane. This opens the System Properties dialog box to the Remote tab, as shown in Figure 6-13.
To disable Remote Desktop, select Don’t Allow Remote Connections To This Computer, and then tap or click OK. Skip the remaining steps.
To enable Remote Desktop, you can:
Select Allow Remote Connections To This Computer to allow connections from any version of Windows.
Also select Allow Connections Only From Computers Running Remote Desktop With Network Level Authentication to restrict the permitted connections to those from computers running Windows Vista or later (and computers with secure network authentication).
Tap or click Select Users. This displays the Remote Desktop Users dialog box, as shown in Figure 6-14.
To grant Remote Desktop access to a user, tap or click Add. This opens the Select Users Or Groups dialog box. In the Select Users Or Groups dialog box, tap or click Locations to select the computer or domain in which the users you want to work with are located. Enter the name of a user you want to work with in the Enter The Object Names To Select text box, and then tap or click Check Names. If matches are found, select the account you want to use and then tap or click OK. If no matches are found, update the name you entered and try searching again. Repeat this step as necessary, and then tap or click OK.
To revoke remote access permissions for a user account, select the account and then tap or click Remove.
Tap or click OK twice when you have finished.
Windows Firewall must be configured to allow inbound Remote Desktop exceptions. You can configure this on a per-computer basis in Windows Firewall for the domain profile and the standard profile. In Group Policy, you can configure this exception and manage Remote Desktop by using the policy settings shown in Table 6-1. These settings are found in the Administrative Templates policies for Computer Configuration under the paths shown.
Setting | Computer Configuration Path |
PATHS UNDER WINDOWS COMPONENTS REMOTE DESKTOP SERVICES | |
Allow .Rdp Files From Unknown Publishers | Remote Desktop Connection Client |
Allow .Rdp Files From Valid Publishers And User’s Default .Rdp Settings | Remote Desktop Connection Client |
Always Prompt For Password Upon Connection | Remote Desktop Session HostSecurity |
Remote Desktop Session HostConnections | |
Configure Server Authentication For Client | Remote Desktop Connection Client |
Deny Logoff Of An Administrator Logged In To The Console Session | Remote Desktop Session HostConnections |
Do Not Allow Local Administrators To Customize Permissions | Remote Desktop Session HostSecurity |
Do Not Allow Passwords To Be Saved | Remote Desktop Connection Client |
Limit Maximum Color Depth | Remote Desktop Session HostRemote Session Environment |
Limit Maximum Display Resolution | Remote Desktop Session HostRemote Session Environment |
Limit Number Of Monitors | Remote Desktop Session HostRemote Session Environment |
Limit The Size Of The Entire Roaming User Profile Cache | Remote Desktop Session HostProfiles |
Require Use Of Specific Security Layer For Remote (RDP) Connections | Remote Desktop Session HostSecurity |
Set Client Connection Encryption Level | Remote Desktop Session HostSecurity |
Select RDP Transport Protocols | Remote Desktop Session HostConnections |
Select Network Detection On The Server | Remote Desktop Session HostConnections |
Specify SHA1 Thumbprints Of Certificates Representing Trusted .Rdp Publishers | Remote Desktop Connection Client |
Turn Off Fair Share CPU Scheduling | Remote Desktop Session HostConnections |
Turn Off UDP On Client | Remote Desktop Connection Client |
OTHER PATHS | |
Disable Remote Desktop Sharing | Windows ComponentsNetMeeting |
Windows Firewall: Allow Inbound Remote Desktop Exceptions | NetworkNetwork ConnectionsWindows FirewallDomain Profile |
Windows Firewall: Allow Inbound Remote Desktop Exceptions | NetworkNetwork ConnectionsWindows FirewallStandard Profile |
Making Remote Desktop connections
As an administrator, you can make Remote Desktop connections to servers and workstations running Windows. Remote Desktop is installed automatically, but it is normally not enabled until you do so as discussed in the preceding section of this chapter. When remote access is enabled on a computer, all administrators have remote access to that computer. Other users can be granted remote access as well.
To make a Remote Desktop connection to a server or workstation, follow these steps:
At a command prompt, type mstsc, or press the Windows key, type mstsc, and then press Enter.
Tap or click Show Options. This displays the Remote Desktop Connection dialog box, shown in Figure 6-15.
In the Computer text box, enter the name of the computer to which you want to connect. If you don’t know the name of the computer, use the drop-down list to choose an available computer, or select Browse For More in the drop-down list to display a list of domains and computers in those domains.
Specify additional options as necessary. If you’ve configured stored credentials for the computer, your saved credentials will be used automatically. You can edit or delete the credentials as necessary.
Tap or click Connect. If you haven’t previously stored credentials for the computer, enter your credentials when prompted, and then tap or click OK. For domain logons, you can specify your user name in domainusername format if necessary, such as cpandlwilliams for the WilliamS account in the Cpandl domain.
If the connection is successful, you’ll see the Remote Desktop window on the selected computer, and you’ll be able to work with resources on the computer. In the case of a failed connection, check the information you provided and then try to connect again. If you still can’t connect, the connection issue might be due to a firewall or another configuration issue.
Note
Tapping or clicking Show Options in the Remote Desktop Connection dialog box displays a series of tabs that provide additional options for creating and saving connections. These options enable you to change the display size for the Remote Desktop, manage connections to local resources (such as printers, serial ports, and disk drives), run programs automatically on connection, and enable or disable local caching and data compression.