How to configure a computer to receive Remote Assistance offers in Windows Server 2003 and in Windows XP (301527)

INTRODUCTION

This article describes the steps to use to configure your Microsoft Windows XP or Microsoft Windows Server 2003-based computer to receive Remote Assistance offers.

The Remote Assistance tool can be configured to enable an expert user to initiate a Remote Assistance session by using the Offer Remote Assistance feature. The Remote Assistance session lets the expert user help a novice user. This feature requires the computer of the expert user and the computer of the novice to be members of the same domain or members of trusted domains. Domains are used in corporate networks for security purposes. Domains are typically managed by network administrator. The Offer Remote Assistance feature is not a practical option for most home-based networks. For more information about Remote Assistance, click the following article numbers to view the articles in the Microsoft Knowledge Base: Back to the top

Requirements

To configure the computer of the novice user to accept Remote Assistance offers, you must make sure that the following requirements are met:

• The Group Policy on the computer of the novice user must be configured to enable Remote Assistance offers.
• The computers of the novice and expert users must be members of the same domain or members of trusted domains.
• Both computers must have Windows XP or Windows 2003 installed.

To configure the Group Policies for the Remote Assistance tool, you need a list of expert users from which the computers of the novice users can accept Remote Assistance offers. This list must contain Domain User groups and Domain User accounts.

Note Experts using Offer Remote Assistance will not be able to connect to a novice computer when Solicited Remote Assistance is disabled on the novice computer. (This problem does not occur on computers that are running Microsoft Windows XP with Service Pack 2.)

Back to the top

Configure the Offer Remote Assistance policy setting

1. Start the Microsoft Management Console (MMC) Group Policy snap-in. To do this, click Start, and then click Run. In the Open box, type: gpedit.msc. Then, click OK.
2. In the Local Computer Policy\Computer Configuration\Administrative Templates\System\Remote Assistance folder, locate and double-click Offer Remote Assistance.
3. On the Offer Remote Assistance Properties dialog box, click Enable.
4. Select an option from the list to determine which of the following actions the expert users can take.
   • Allow helpers to only view the computer
   • Allow helpers to remotely control the computer
   Note This setting is for the entire group that is listed. The Offer Remote Assistance policy setting does not provide a mechanism that lets one group of users view the computer of the novice user, and also lets a second group of users view and control the computer of the novice user. There can be only one expert group.
5. Click Show. The Show Contents dialog box opens.
6. Click Add to add the Domain Users and Domain User Groups.
7. Click OK to close the Show Contents dialog box, and then click OK to close the Offer Remote Assistance Properties dialog box.
8. Quit the MMC Group Policy snap-in.

These policies are effective immediately. You do not have to restart the computer.

Important Use caution when you populate the properties of the Offer Remote Assistance Group Policy because you cannot verify the domain accounts that you enter. We recommend that you extensively test this policy setting before you perform a large policy roll out.

NoteThe Offer Remote Assistance policy is not available in Microsoft Windows XP Home Edition.

Note Remote Assistance uses DCOM. In Windows XP and Windows 2003, the DCOM entry is located in the following registry subkey: The String value of the DCOM entry is EnableDCOM = Y. If this value is set to 'N' or if this value is missing, Remote Assistance will not work.

Back to the top

Configure Windows Firewall for offer-based Remote Assistance

To update your Group Policy objects with the new Windows Firewall settings, follow these steps:

1. Log on to your Window XP SP2-based computer as a member of the Domain Administrators security group, of the Enterprise Administrators security group, or of the Group Policy Creator Owners security group.
2. Click Start, click Run, type mmc, and then click OK.
3. On the File menu, click Add/Remove Snap-in, click the Standalone tab, and then click Add.
4. In the Available Standalone Snap-ins list, click Group Policy Object Editor, and then click Add.
5. In the Select Group Policy Object dialog box, click Browse.
6. In Browse for a Group Policy Object, click the Group Policy object that you want to update with the new Windows Firewall settings, and then click OK.
7. Click Finish to complete the Group Policy Wizard.
8. In the Add Standalone Snap-in dialog box, click Close.
9. In the Add/Remove Snap-in dialog box, click OK.
10. In the console tree, expand Computer Configuration, expand Administrative Templates, expand Network, expand Network Connections, and then click Windows Firewall.
11. Use the Group Policy Object Editor snap-in to locate Windows Firewall Group Policy settings. To do this, click Start, click Run, type gpedit.msc in the Open box, and then click OK.
    
    Note The Group Policy settings are located in the following Group Policy Object Editor folders:
    • Computer Configuration/Administrative Templates/Network/Network Connections/Windows Firewall
    • Computer Configuration/Administrative Templates/Network/Network Connections/Windows Firewall/ Domain Profile
    • Computer Configuration/Administrative Templates/Network/Network Connections/Windows Firewall/ Standard Profile
12. For each snap-in path that you located in step 11, add the following entry to the Windows Firewall: Define port exceptions setting:

    135:TCP:*:Enabled:Offer Remote Assistance

13. For each snap-in path, add the following entries to the Windows Firewall: Define program exceptions setting:
    • %WINDIR%\SYSTEM32\Sessmgr.exe:*:Enabled:Remote Assistance
    • %WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe:*:Enabled:Offer Remote Assistance
    • %WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice

Back to the top