Remote Assistance in the Corporation

Configuring Remote Assistance
You can configure Remote Assistance through the System Properties dialog box's Remote tab. To let a user request help from someone, select the Allow Remote Assistance invitations to be sent from this computer check box on the user's workstation. Clicking Advanced presents the Remote Assistance Settings dialog box, which Figure 1 shows. If you clear the Allow this computer to be controlled remotely check box, you can restrict Remote Assistance sessions to view-only mode. To shorten the window of opportunity for unscrupulous invitation interceptors, you can limit the amount of time an invitation is active.

Group Policy also lets you specify users in your organization who can offer Remote Assistance without receiving an invitation. Group Policy's Computer Configuration\Administrative Templates\System\Remote Assistance\Solicited Remote Assistance setting lets you set the same options that you can set on the Remote tab of the System Properties dialog box. The wording and method of selecting view-only or remote control mode differ slightly from that on the Remote tab, but the results are identical.

The Computer Configuration\Administrative Templates\System\Remote Assistance\Offer Remote Assistance setting presents functionality that's available only through Group Policy. The Offer Remote Assistance setting lets you authorize users to initiate a session without having received an invitation. When setting the Offer Remote Assistance properties, which Figure 2 shows, you should specify Allow helpers to remotely control the computer unless you want to allow view-only mode. You also need to specify who within your organization can initiate Remote Assistance offers. To specify those users, first click Show, then use the Domain\User or Domain\Group syntax to add entries to the list of helpers. You won't get a chance to verify that the information you entered is accurate, so double-check each name before you add it to the helpers list.

Offering Remote Assistance
After support professionals are added to the helpers list on designated computers, they can initiate a Remote Assistance session provided that both their system and the end user's system are running XP and that both the support professional and the end user are members of the same domain or of domains that have a trust relationship. The typical method of offering a Remote Assistance session is as follows:

1. Click Start, Help and Support.
2. Click the Tools link, then select the Offer Remote Assistance tool in the left-hand pane.
3. In the right-hand pane, click Connect, select the name of the user you want to assist from the drop-down list, then click Start Remote Assistance.

The session will proceed just as if it were initiated by a user invitation.

If you expect to offer Remote Assistance frequently, you might want to use a more streamlined method of creating the offer. Create a shortcut that has as its target the URL hcp://CN=Microsoft%20Corporation,L=Redmond,S=Washington,C=US/Remote%20Assistance/Escalation/unsolicited/unsolicitedrcui.htm. Clicking this shortcut launches the Help and Support Center and displays the pane that lets you specify the machine to connect to. You can distribute this shortcut to support professionals in your organization.

Firewalls and Remote Assistance
Because Terminal Services technology uses RDP for communication between systems, port 3389 must be open on your firewall. You can provide an extra measure of security by blocking outbound traffic on port 3389 so that users won't be able to use Remote Assistance to communicate with systems outside the firewall.

Using Network Address Translation (NAT) with Remote Assistance is a complex topic that's outside the scope of this article. For information about the behavior of Remote Assistance in various firewall and NAT environments, see the Microsoft article "Supported Connection Scenarios for Remote Assistance" (http://support.microsoft.com/?kbid=301529).

Working Around Limitations
If you're using Remote Assistance in a corporate scenario, you'd ideally like to limit or disable users' ability to solicit Remote Assistance help from unauthorized people. Unfortunately, disabling Solicited Remote Assistance also disables the ability to accept offered Remote Assistance. Until Microsoft addresses this inconsistency, the only way to work around this problem is through user training. After you create an infrastructure through which your support professionals can initiate Remote Assistance, train end users to use that infrastructure rather than sending invitations for Assistance. If you must rely on the invitation model, require your users to use strong passwords with reasonable expiration times on invitations and establish a consistent method for everyone in your organization to use for invitation delivery.