In this guide, I will show you how to enable and configure Remote Assistance in SCCM (ConfigMgr). Remote assistance allows you to remotely administer a client computer from the Configuration Manager console.
Remote Assistance in SCCM is a convenient way for someone you trust, such as a friend or technical support person, to connect to your computer and walk you through a solution. It is a useful feature for ConfigMgr administrators in resolving issues on remote computers.
With Remote Assistance, you can invite someone to connect to your computer. Once the user is connected, that person can view your computer screen and chat with you about what you both see. Furthermore, with your permission, your helper can even use his or her mouse and keyboard to control your computer and show you how to resolve a problem. You can also help someone else the same way.
I would like to point out that Remote Assistance will not work in cases when the outbound traffic from port 3389 is blocked. You cannot establish a Remote Assistance session from the Configuration Manager console to a client computer that is in a workgroup. Learn how to enable remote assistance using group policy on Windows computers.
While Configuration Manager offers remote assistance, Intune offers remote help as a solution. Remote Help is a paid add-on that works with Intune, and lets your information and front-line workers get help over a remote connection when they need it.
What is Remote Assistance feature in SCCM?
Remote assistance in SCCM allows you to remotely administer a client computer from the Configuration Manager console. You can start remote assistance in the Configuration Manager console from Assets and Compliance > Devices.
Difference between Remote Control and Remote Assistance in SCCM?
Remote Control is a feature of Configuration Manager using which a machine can be remotely controlled without the need of a user being logged on at that time. Remote Control is an SCCM console feature allowing you to take control of a managed computer.
The Remote Assistance leverages the Windows feature, requests a session with the currently logged-on user, and allows for in-session chat. During SCCM Remote assistance, the user has to accept the request of the administrator and a machine cannot be remote controlled when no one is logged on.
Enable Remote Assistance on SCCM Server
To use the Remote Assistance functionality, you must first install the Remote Assistance feature on the machine running the ConfigMgr console. For instance, if you are running SCCM on a Windows Server, by default the Remote Assistance feature is not enabled.
When the remote assistance feature is not installed on the SCCM server, and you attempt to offer remote assistance, you will encounter the following error. “The Windows Remote Assistance feature is not installed on this computer. Please install Remote Assistance first.”
You can enable the remote assistance feature on the SCCM server using the following steps:
- Launch the Server Manager on your Windows Server.
- Click Manage and select Add Roles and Features.
- Select Role-based or feature-based installation.
- On the Features page, scroll down and select the Remote Assistance feature and click Next.
- Complete the remaining steps and close the Add Roles and Features wizard.
Configure Remote Assistance in SCCM
The remote assistance settings are available under the SCCM client settings, and you can configure it with following steps.
- In the Configuration Manager console, choose Administration > Client Settings > Default Client Settings.
- On the Home tab, in the Properties group, select Properties.
- In the Default dialog box, select Remote Tools.
- Configure the remote control, Remote Assistance and Remote Desktop client settings.
You can create a Custom Client Device Settings and configure Remote Assistance settings and then deploy it to a device collection. On the left pane, select Remote Tools and configure the following settings.
- Manage unsolicited Remote Assistance settings: Configure this setting to Yes to let Configuration Manager manage unsolicited Remote Assistance sessions.
- Manage solicited Remote Assistance settings: Configure this setting to Yes to allow Configuration Manager to manage unsolicited Remote Assistance sessions.
- Level of access for Remote Assistance: Set this to Full Control.
Once you’ve configured the above settings, click OK to save the changes. The policy settings are now replicated from the Management Point server to the client computers. You can review the client policy polling interval time in SCCM, which specifies how frequently client computers checks and download new client policy(s). To speed up the downloading of policies to the client computers, you can manually run the Configuration Manager client actions.
Offer Remote Assistance from SCCM Console
After you have enabled and configured the remote assistance feature in SCCM, lets see how ConfigMgr admins can offer remote assistance from the console.
Use the following steps to offer remote assistance to devices from the SCCM console.
- Go to the Assets and Compliance workspace and select the Devices node.
- From the list of devices, right-click on the device and select Start > Remote Assistance.
For a remote computer, when you initiate the remote assistance in SCCM console, the request is sent to the user logged in to the computer.
On the remote computer, the Windows Remote Assistance dialog box appears, asking the consent to allow the ConfigMgr admin to connect to the computer? Click Yes to proceed with the remote assistance.
Once the user accepts the request, the Configuration Manager admin can view the desktop of the user. To take control over the user’s computer, the admins can click on Request Control. On the client computer, it notifies the user about the admin wanting to take control of the desktop. Once the user clicks Yes, the remote ConfigMgr admin gets permissions of full control over the user’s computer.
Windows Remote Assistance Chat
Once the remote session is established, the user can communicate to the helper using the Chat option. This is a nice tool that allows exchanging messages between helper and user during the remote assistance.
During the remote assistance chat, the user can report issues with the computer and get the help from the Configuration Manager admin (helper in this case). The chat window gets terminated when the remote assistance session is ended.
Windows Remote Assistance Settings
Once the remote assistance session is established between the user and helper, the helper can change or modify settings for the session. On the Windows Remote Assistance bar, the Settings option includes the following settings.
- Use ESC key to stop sharing control
- Save a log of this session
- Exchange contact information when using Easy Connect
The admin can also configure the bandwidth usage for the remote assistance session. By default, the bandwidth usage is set to low, which uses 16-bit color, no font smoothing and background is turned black. The bandwidth usage can be changed to medium, medium-high, high. When you set the bandwidth usage to high, there is no bandwidth optimization applied during the remote assistance session.
SCCM Remote Assistance Logs
During the remote assistance session, the option “Save a log of this session is enabled” by default. The remote assistance log files of the session are found in the following locations:
- SCCM Site server: C:\Users\username\Documents\Remote Application Logs
- Remote Client: C:\Users\username\Documents\Remote Application Logs
Fix SCCM Remote Assistance Errors
When you attempt to provide remote assistance to a Windows computer, you may encounter several errors. Let’s look at some reasons why the remote assistance fails in ConfigMgr.
- Do you have the correct permissions on the remote computer? Whenever the remote assistance fails, the first thing that you need to check is the permissions. If the helper doesn’t have permissions to initiate remote assistance, that needs to be fixed first.
- Is the remote computer turned on and is it connected to the network? The most common reason why the remote assistance fails is due to the remote computer being turned off. To initiate the remote connection, the computer must be turned on.
- Is there a network problem? Network issues are common, and even DNS issues in the setup can create difficulties in initiating the remote assistance session. Most of the errors are resolved by allowing the port 3389 thorough the firewalls.
Hi, I have seen that the local security policy is set by the remote assistance feature of MECM.
Is there any way to set the Configure Offer Remote Assistance policy back to (Not configured)?
Hi Prajwal. As always, its a great article, simple and easily understandable. Thanks a lot for your efforts. We have the SCCM remote control feature enabled in our environment and the SCCM emote connect works perfectly fine for all our on premises devices both Physical and virtual. But the SCCM remote connect does not work on our Azure devices. We simply get an error saying that the device may be offline, but is not. I’ve double checked and can confirm that the concerned Azure device has the SCCM remote tool client setting deployed like the other on-prem devices. Wondering if there is any additional costing is involved to utilize SCCM control on Azure device. Thanks.
thanks, good article Prajval simple and direct ……
you don’t need connectivity to the SCCM host for the remote feature because ultimately it’s a connection made between your workstation and the remote one. We have the SCCM console installed on the IT machines so the remote control is from our machine to the user’s not from the SCCM host.
Remote control in ConfigMgr is a simple, point-to-point connection on TCP port 2701 from the system running the remote viewer tool to the system being controlled. Thus, just like any network traffic, there must be a routable path between the two and the traffic must be allowed via any firewalls and ACLs. If you use a DNS name, then, of course, the name must be resolvable to a valid IP as well.
Hi thanks for all your effort for making SCCM so Easy for learning and implementing.
Hi Prajwal. Great article once again!
Is there a way for the client to request the remote assistance instead of being the Admin to start the process?
I’m asking this because we have a problem with some devices where we cannot resolve the name; what happens is that, since some employees connect their Laptops to the wired network as well as wireless network, the DNS dynamic updates take some time to reflect the current IP address of the machine and therefore SCCM cannot reach the machine. We have a workaround that consists on using the command “nbstat -a hostname” to use netbios instead but this doesn’t always work…
Instead of having to ask the user for the machine’s IP address, it would be much simple if he could request the remote assistance.
Thanks in advance!
Cheers,
pedro
Thank you Prajwal, since I started with installing and configuring SCCM your instructions have been a great help. I have also tried Remote Assistance Now, it is also working perfectly.. I am Greatful!!!
Thank you. Glad to hear that.
If we want to disable the Remote tool in future , Is it possible ?
Hi Prajwal, first I would like to thank you for your efforts to make understanding and working with sccm easy for us.I have a question, is remote assistence or remote control is going to work with computers joined to the domain but sitting outside the corporate network? I have some cases that some employees take their computers home and they need assistence.Thanks
If they are connected to company network via VPN then yes it will work else it won’t.
Thank you so much, keep on the GOOD WORK
Thanks Simon.
Not even if you have a IBCM server setup?
Good Article Prajwal…
Nice job Prajval.
How to disable outbound traffic from port 3389?
Hi Naveen, you must create an outbound rule and open the port 3389 on the firewall.
@ Naveen – Log in to your DC, open Group policy management editor, create a new policy. Edit the policy and check the attachments and follow the below steps.
Step 1 – Right click Outbound Rules and create a new rule
Step 2 – Select port and click next.
Step 3 – Select protocol as TCP and enter port number 3389.
Step 4 – Allow the connection. After you complete repeat the same for UDP and port 3389.
Got it… thanks once again
@Naveen – You want to disable the port 3389 on outbound ?
Ya prajval… actually I know we can create rules and enable or disable ports in firewall but I don’t know how to do this..
If you can recommend me some good blogs to study, that will be appreciated.
I have attached the screenshots, check it..
We used to use TighVNC and it is better in terms of resolution in case of multiple screens.,
is it possible to have vnc listner in stopped status and enabled only while using it like that we avoid any vulnerabilities, you know free tools are not safe