Administering Remote Assistance

Remote Assistance enables a trusted person (a friend, support person, or IT administrator) to remotely and actively assist someone with a computer problem. The assistant (also called an expert) can view the screen of the user requesting assistance and offer advice. With the permission of the user, the assistant can even take control of the user's computer and perform tasks remotely.

Remote Assistance normally begins with a user requesting help, either through e-mail, Windows Messenger, or by using an invitation saved as a file. However, an assistant can also offer help without first receiving a request from a user.

Remote Assistance requires that both computers are running XOX or a product in the Windows Server 2003 family.

Types of Remote Assistance connections

Remote Assistance can be used in the following situations:

  • Within a local area network (LAN).
  • Over the Internet.
  • Between an individual on the Internet and an individual behind a firewall. Connections through a firewall require that TCP port 3389 be open.

Security concerns

If a user permits it, and it is allowed by Group Policy or through settings in System in Control Panel, an assistant can control the user's computer and perform any task that the user can perform, including accessing the network. To address security concerns within your organization, the following settings are available:

  • At the firewall. You can determine whether a person within your organization can request help outside of the organization by prohibiting or permitting inbound and outbound traffic through port 3389 at the firewall.
  • Group Policy. You can set Group Policy to permit or prohibit users from requesting help using Remote Assistance. You can also determine whether users can allow someone to remotely control their computer, or just view it.

    In addition, you can set Group Policy to permit or prohibit a remote assistant from offering Remote Assistance to the local computer.

  • Individual computer. The administrator of an individual computer can turn off Remote Assistance requests on that computer; this prevents anyone using the computer from sending a Remote Assistance invitation.

Additional information

For more information about using Remote Assistance, see the following articles in the Microsoft Knowledge Base.(http://www.microsoft.com/)

  • Q301527 "HOW TO: Configure a Windows XP-Based Computer to Receive Remote Assistance Offers"
  • Q306298 "Description of the Windows Messenger Reverse Connection Process Used by Remote Assistance"
  • Q301529 "Supported Connection Scenarios for Remote Assistance "

Related Topics


Use Remote Assistance through a firewall

Microsoft Windows graphic

To use Remote Assistance through a firewall

Remote Assistance uses the Remote Desktop Protocol (RDP) to establish a connection between a user requesting help and an assistant providing it. The RDP uses TCP port 3389 for this connection. To allow users within an organization to request help outside your organization using Remote Assistance, port 3389 must be open at the firewall. To prohibit users from requesting help outside the organization, this port should be closed at the firewall.

Refer to the instructions for administering the firewall for information about opening or closing port 3389.

Notes

  • If you close port 3389, you will block all Remote Desktop and Terminal Services through it as well. If you want to allow these services but want to limit Remote Assistance requests, use Group Policy. If the port is opened only for outbound traffic, a user can request Remote Assistance using Windows Messenger.
  • The Internet Connection Firewall (ICF) from Microsoft allows inbound and outbound Remote Assistance traffic, as long as the initial request for assistance was made from the computer on which the firewall is enabled. ICF is designed to be used only with stand-alone computers or computers in a workgroup.


Set Group Policy for Remote Assistance

To set Group Policy for Remote Assistance

  1. Click Start, and then click Run.
  2. Type gpedit.msc and then click OK.
  3. Under Computer Configuration, double-click Administrative Templates, double-click System, and then double-click Remote Assistance.
  4. In the right pane, click Solicited Remote Assistance to display the description of this policy. Double-click it to configure the settings for this policy.

    Use Solicited Remote Assistance to determine whether users can request help using Remote Assistance. You can also determine whether users can allow an assistant to control their computer, or just view it.

    The same policy allows the user to control the maximum duration time for Remote Assistance tickets and the type of e-mail application used to send invitations.

    To configure the maximum duration time for tickets, in Maximum ticket at time (value), select a number, and then under Maximum ticket time (units), select minutes, hours or days.

    To configure the type of e-mail application, under Select the method for sending e-mail invitations, select one of the options. Your e-mail application should support the standard chosen.

  5. Click Offer Remote Assistance to display its description. Double-click it to configure the settings for this policy.

    Use Offer Remote Assistance to determine whether an assistant can offer Remote Assistance without an explicit user request. As with Solicited Remote Assistance, you can determine whether the expert can control a novice's computer, or just view it. The expert must be added as an assistant on the user's computer, or be a member of the Administrator's group on that computer.

Notes

  • Offer Remote Assistance will not work unless Solicited Remote Assistance is enabled.
  • The setting to select the e-mail method is only available with products in the Windows Server 2003 family. Computers running XOX can only use Simple Messaging Application Programming Interface (SMAPI) e-mail applications.


Block Remote Assistance requests on an individual computer

To block Remote Assistance requests on an individual computer

  1. Open System in Control Panel.
  2. On the Remote tab, under Remote Assistance, clear the Allow Remote Assistance invitations to be sent from this computer check box.

Notes

  • XOX
  • This feature prevents anyone using this computer from requesting or receiving help through Remote Assistance.
  • You can also use this feature to allow Remote Assistance requests, but prevent anyone from controlling the computer. Click Advanced and then clear the Allow this computer to be controlled remotely check box.
  • Group Policy settings will always override any settings you may have made in System Properties in Control Panel.


Prevent someone from using Remote Assistance to take control of this computer

To prevent someone from using Remote Assistance to take control of this computer

  1. Open System in Control Panel.
  2. On the Remote tab, under Remote Assistance, click Advanced.
  3. Clear the Allow this computer to be controlled remotely check box.

Note

  • XOX


Requesting help using Remote Assistance

Sometimes the best way to fix a problem is to have someone show you how. Remote Assistance is a convenient way for another person (called an assistant or expert) to connect to your computer and walk you through a solution.

By following the steps in Remote Assistance, you can use Windows Messenger or an e-mail message to invite an assistant to connect to your computer. You can also save the invitation to a file. After he or she is connected, that person will be able to view your computer screen and chat with you about what you both see. With your permission, your assistant can use his or her mouse and keyboard to control your computer.

To start Remote Assistance

  1. Click Start, and then click Help and Support.
  2. In the right pane, under Support, click Remote Assistance.
  3. Click Invite someone to help you.
  4. Follow the remaining instructions to create and send an invitation.

Notes

  • Remote Assistance requires that both computers are running XOX or a product in the Windows Server 2003 family.
  • If you request assistance using Windows Messenger, your assistant must also be signed in to Windows Messenger.
  • You and your assistant need to be connected to the Internet or to the same local area network (LAN) while using Remote Assistance.
  • If there are multiple users on a computer, the administrator can only see his or her own tickets. The administrator cannot see Remote Assistant tickets created by the other users on the computer.
  • Firewalls might stop you from using Remote Assistance to request help from another person outside the firewall. In this case, check with your network administrator. For more information about using Internet Connection Firewall, see Related Topics.
  • If you are logged onto the computer as a guest, you cannot create and submit a Remote Assistance invitation.
  • If you have copied the online Help from another computer using the Shared Help feature in Help and Support Center (HSC), Remote Assistance will not start using the version of HSC installed from the remote computer. You must start Remote Assistance from the version of HSC that was originally installed on the computer you are currently using.


Using password security in Remote Assistance

If you send a Remote Assistance invitation in an e-mail message or a file, you should specify a strong password for your assistant to use, in order to protect your computer from someone pretending to be your assistant.

Strong passwords are important because password-cracking tools continue to improve, and the computers used to crack passwords are more powerful. Passwords that once took weeks to break can now be broken in hours.

For information about creating strong passwords, see Related Topics.

Note

  • It is recommended that you give the password to your assistant using the telephone or another secure method. It is not recommended that you send the password using e-mail.


Stop remote control of your computer by Remote Assistance

To stop remote control of your computer by Remote Assistance

  • In the Remote Assistance window, click Stop Control (ESC).

    -or-

    Press the ESC key, which is usually found in the upper-left corner of your keyboard.

Note

  • To close the connection between you and the other person, but leave the Remote Assistance window open, click Disconnect. To close the connection and close the Remote Assistance window, click the Close button in the upper-right corner of the window.


Set the maximum amount of time all Remote Assistance invitations can remain open

To set the maximum amount of time a Remote Assistance invitation can remain open

  1. Open System in Control Panel.
  2. On the Remote tab, click Advanced.
  3. Under Invitations, select the time from the list.

Notes

  • XOX
  • A Remote Assistance invitation is valid for a maximum of 24 hours.


Talk by means of Remote Assistance

To talk by means of Remote Assistance

  • In the Remote Assistance window, click Start Talking.

Note

  • To use this feature, both the assistant and the person being helped will need:
    • A full-duplex sound card.
    • A speaker and microphone, or a headset that can plug into either the sound card or the USB port.
    • The two computers need to have an Internet connection or be on the same local area network.


Adjust the sound quality of a voice connection

To adjust the sound quality of a voice connection

  1. In the Remote Assistance dialog box, click Settings.
  2. In the Remote Assistance Settings - Web Page Dialog dialog box, click either Standard quality or High quality (requires a high-speed Internet connection).

Note

  • If you have a connection speed of 64 Kilobits per second (Kbps) or faster, you can select a high-quality connection speed. However, this might decrease the performance of all your network applications.


Send a file by Remote Assistance

To send a file by Remote Assistance

  1. In the Remote Assistance window, click Send a File.
  2. Locate and click the file you want to send, and then click Open.
  3. Click Send File.

Note

  • The request to transfer the file is immediately sent; you are notified when it is accepted by the recipient. When it is accepted, the file is then sent. Until the recipient accepts the file, you can click Cancel to stop the file transfer.


Providing help using Remote Assistance

Sometimes the best way to help someone fix a problem is to demonstrate a solution. If you are invited, Remote Assistance is a convenient way for you to connect to a user's computer and walk that person through a solution.

After you are connected, you will be able to view the user's computer screen and chat together about what you both see. With that person's permission, you can even use your mouse and keyboard to control his or her computer.

Notes

  • Remote Assistance requires that both computers are running XOX or a product in the Windows Server 2003 family.
  • You and the person you are helping need to be connected to the Internet or on the same local area network (LAN) while using Remote Assistance. If you are sending an e-mail invitation, your assistant might require Internet access.
  • Firewalls or network address translation (NAT) devices can prevent a Remote Assistance connection. Try using Windows Messenger instead of e-mail to start the connection. If that doesn't work, ask the network administrator to add port 3389 for you. Click Related Topics for more information.
  • If Offer Remote Assistance is enabled in the Group Policy editor on a user's computer, an assistant can offer Remote Assistance to that user without an explicit invitation. The assistant must have been added as an assistant on that person's computer in the Group Policy editor, or be a member of the Administrator's group on that computer. Solicited Remote Assistance must be enabled for Offer Remote Assistance to work.
  • You can improve performance during a Remote Assistance session by reducing the color quality on the user's computer. Use the Color Quality setting on the Settings tab in Display (in Control Panel) to reduce the number of colors his or her screen displays.
  • If there are multiple users on a computer, the administrator can only see his or her own tickets. The administrator cannot see Remote Assistant tickets created by the other users on the computer.
  • If the person you are helping is logged onto the computer as a guest, a Remote Assistance invitation cannot be created.
  • If you have copied the online Help from another computer using the Shared Help feature in Help and Support Center (HSC), Remote Assistance will not start using the version of HSC installed from the remote computer. You must start Remote Assistance from the version of HSC that was originally installed on the computer you are currently using.


Offer Remote Assistance without an invitation

To offer Remote Assistance without an invitation

  1. Click Start, and then click Help and Support.
  2. Under Support Tasks, click Tools.
  3. Under Tools in the left pane, click Help and Support Center Tools.
  4. Under Help and Support Center Tools, click Offer Remote Assistance.
  5. Type the name or the IP address of the computer you want to connect to, and then click Connect.
  6. Follow the directions that appear on the screen.

Notes

  • To offer Remote Assistance to a user who has not sent an explicit invitation, the Offer Remote Assistance setting in Group Policy must be enabled and configured on the user's computer. In addition, you must be listed as an assistant under the Offer Remote Assistance policy, or be a member of the Administrators group on that computer. For more information about enabling Offer Remote Assistance, click Related Topics.
  • Offer Remote Assistance will not work unless the Solicited Remote Assistance policy is enabled.
  • Although an assistant can offer Remote Assistance without being asked, the user must give permission before the assistant can see the user's computer. In addition, the user must give explicit permission before the assistant can control the user's computer (if that feature is enabled).


Enable Offer Remote Assistance

To enable Offer Remote Assistance

  1. Click Start, and then click Run.
  2. In Open, type gpedit.msc, and then click OK.
  3. In the left pane of the Group Policy editor, under Computer Configuration, double-click Administrative Templates, double-click System, and then double-click Remote Assistance.
  4. In the right pane, double-click Offer Remote Assistance, and then click Enabled.

    Once enabled, you can determine whether the assistant can view the computer or control it. Next, you need to add the assistant to the Helper list.

  5. Click Helpers: <Show>, click Add, and then then enter the assistant's user name.

    If the computers are on a domain, you need to type in a domain name and user name, domain\user name, or a domain name and group name domain\group name. Your assistant's computer and your computer can be in different domains, but the domains must trust each other for Remote Assistance to work.

  6. After making these changes, restart your computer.

Note

  • To offer Remote Assistance to a user who has not sent an explicit invitation, the Offer Remote Assistance setting in Group Policy must be enabled and configured on the user's computer. In addition, you must be listed as an assistant under the Offer Remote Assistance policy, or be a member of the Administrators group on that computer.


Compile Date

Compile Date: 2003-01-02