Remote Support Center 2. Administrator's Guide

Transcription

1 Remote Support Center 2 Administrator's Guide

2 Copyright ScriptLogic Corporation and its licensors. All Rights Reserved. Protected by U.S. Patents 6,871,221; 7,293,087; 7,353,262 and 7,469,278 with other patents pending. Portions include technology used under license from Shavlik Technologies and are copyrighted. Certain portions used under license and Copyright Sunbelt Software, Inc., all rights reserved. This software is based in part on the work of the Independent JPEG Group. Portions copyright 2009 John Resig, Portions copyright 2009 Telerik Corp. This publication is protected by copyright and all rights are reserved by ScriptLogic Corporation. It may not, in whole or part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior consent, in writing, from ScriptLogic Corporation. This publication supports Remote Support Center (RSC), InstantAssist and ExpertAssist. It is possible that it may contain technical or typographical errors. ScriptLogic Corporation provides this publication as is, without warranty of any kind, either expressed or implied. ScriptLogic Corporation 6000 Broken Sound Parkway NW Boca Raton, Florida Trademark Acknowledgements: Remote Support Center, InstantAssist, ExpertAssist, ScriptLogic and the ScriptLogic logo are either registered trademarks or trademarks of ScriptLogic Corporation in the United States and/or other countries. The names of other companies and products mentioned herein may be the trademarks of their respective owners.

3 DOCUMENTATION CONVENTIONS Typeface Conventions Bold Indicates a button, menu selection, tab, dialog box title, text to type, selections from drop-down lists, or prompts on a dialog box. CONTACTING SCRIPTLOGIC ScriptLogic may be contacted about any questions, problems or concerns you might have at: ScriptLogic Corporation 6000 Broken Sound Parkway NW Boca Raton, Florida Sales and General Inquiries Technical Support Fax SCRIPTLOGIC ON THE WEB ScriptLogic can be found on the web at Our web site offers customers a variety of information: Download product updates, patches and/or evaluation products. Locate product information and technical details. Find out about Product Pricing. Search the Knowledge Base for Technical Notes containing an extensive collection of technical articles, troubleshooting tips and white papers. Search Frequently Asked Questions, for the answers to the most common non-technical issues. Participate in Discussion Forums to discuss problems or ideas with other users.

4 Table Of Contents OVERVIEW... VI WHO SHOULD READ THIS GUIDE...VII DOCUMENT SUMMARY... VIII CHAPTER 1 CONCEPTS... 1 WHAT IS REMOTE SUPPORT CENTER?... 1 HOW DOES REMOTE SUPPORT CENTER WORK?... 2 Where is the Magic?... 2 Security Measures... 6 RSC Components Port Usage... 8 CHAPTER 2 RSC ADMIN ROLE...10 OVERVIEW...10 IP Filter...11 Adding a New IP Filter...12 Removing an IP Filter...13 Editing an IP Filter...14 Reordering the IP Filter List...15 Designating RSC Administrators...16 Removing a User or Group from Administrators...18 BLOCKING REMOTE COMPUTER...18 ADMINISTRATOR CLIENT CERTIFICATES...21 User Certificates...21 Issuing a Client Certificate to Administrator...22 Installing the Certificate using IE...23 Downloading an Administrator Client Certificate...23 Revoking Certificate from Administrator...23 APPLICATION STATUS AND CONFIGURATION...25 Services Statuses...25 Invitation Settings...27 RSC LICENSING...30 ExpertAssist Licensing...31 InstantAssist Technician Licenses...31 RSC Client Licensing...32 RSC Component Licensing...32 Using RSC License Manager...33 CHAPTER 3 HELPDESK SPECIALIST ROLE...35 GETTING STARTED...35 Before You Begin...35 Logging into the RSC Console...36 Using Hierarchical Grid...40 Navigating the Grid...41 SEARCH AND FILTER COMPUTERS AND GROUPS...42 REMOTE COMPUTER GROUPS...44 Managing Groups and Sub-groups...44 Create a Custom Remote Computer Group...45 Managing Remote Computers within a Group...45 Manage Remote Computer...47 Remote Computer Group Access Permissions...47

5 Remote External Computer Group Permissions...49 INSTALLING REMOTE SUPPORT CENTER CLIENTS TO REMOTE COMPUTERS...50 Pushing the ExpertAssist to a Computer/Set of Computers...50 REMOTE COMPUTER PROPERTIES...54 Installing the ExpertAssist...54 Remote Computer User Access Permissions...55 Remote Computer Configuration...57 Manage Certificate...57 Installing the Certificate using IE...58 PUSHING THE EXPERTASSIST TO A COMPUTER OU...59 PUSHING THE EXPERTASSIST TO A SET OF COMPUTER OUS OR CONTAINERS...61 PREPARING EXPERTASSIST DEPLOYMENT PACKAGE...63 INVITING REMOTE COMPUTER...64 Inviting Remote Computer for Management with ExpertAssist...64 INVITATION DETAILS...67 INVITING REMOTE COMPUTER FOR MANAGEMENT WITH INSTANTASSIST...70 Conclusion...72 FREQUENTLY ASKED QUESTIONS...73 CHAPTER 4 REMOTE USER ROLE...77 RESPONDING TO INVITATION...77 RSC ExpertAssist Installation...77 Manually installing the DA Remote Management Package...78 INSTALL REMOTE COMPUTER CERTIFICATE...81 Changing the Remote Computer certificate...81 InstantAssist Installation...81 TROUBLESHOOTING...84 Cannot log in to RSC Core...84 Remote Computer Groups...84 v

6 Overview Welcome to the Remote Support Center Administrator s Guide. This guide will walk you through the product configuration steps and show you how to use it best based on your role. It provides all the necessary information to administer and configure a strong and secure RSC environment. This guide also outlines every feature that you may use when working with RSC environment, maintaining your remote management business workflow and simply remotely managing computers. Remote Support Center (RSC) is a comprehensive system designed to enable network administrators to remotely manage and control computers regardless of their location. ScriptLogic engineered RSC to allow you to remotely connect to any Microsoft Windows-based computer be it in the LAN, WAN, or any external network supporting TCP/IP suite such as internet. The administrator does not have to worry about direct access to a remote computer from their current location. Once configured, the management product automatically takes the responsibility of routing your requests to a remote computer creating an experience of working on the remote computer interactively. Once logged into RSC, the administrator can remotely connect to a desired computer. RSC allows you to gain access to many of the helpful Remote Support Center Client tools such as desktop remote control, file transfer protocol (FTP) for downloading and uploading files, configuration of the remote computer, remote-to-local printing, advanced scripting, and dozens of other features. All communications are encrypted and all hosts are authenticated using x.509 digital certificates to ensure a secure environment for all remote management operations. Using this technology, an administrator is able to assist users wherever they may be.

7 Who Should Read This Guide This guide is intended for Windows network administrators of small to enterprise businesses who are responsible for: Configuring Remote Support Center in the enterprise Defining RSC Helpdesk Administrators and other users that should be granted access to RSC Setting the security area surface throughout RSC Because of the broad use of the remote management functionality implemented within the product, this guide is also aimed at help helpdesk administrators. These users are responsible for: Managing remote computers Organizing management facilities Taking care of end-users, guiding them through and preparing for management Note ScriptLogic provides a companion Remote Support Center Installation Guide containing information about deploying the product. Please refer to this guide to find out more about installation aspects, available management models, and reconfiguring deployment for your current needs. In addition, this guide can be useful for professionals who are evaluating the product or analyzing the business use of introducing a scalable remote management workflow into their organization. vii

8 Document Summary This document comprises several chapters, each discussing the steps necessary to estimate, plan, understand, and implement Remote Support Center (RSC). Chapter 1, Concepts. This chapter quickly outlines main concepts of the Remote Support Center allowing you evaluate its feature understand how you may best use it for you needs. It explains how it works and why you can do with Remote Support Center what could be hard to believe before. We show you why the Remote Support Center allows you to manage your computers right when and where you need it and how it does it. We also explain how the solution protects your data and communications by organizing secure channel between you and the remote computer you are managing. Chapter 2, RSC Admin Role. This chapter discusses the role of a typical RSC administrator who will be organizing and configuring the Remote Support Center for use. Chapter 3, Helpdesk Specialist Role. Users who will be mostly using the Remote Support Center to support their users will find this chapter useful. This chapter dives into details of powerful management feature implemented in RSC allowing you reach a desired remote computer right from within the browser. Chapter 4, Remote User Role. This chapter discusses working with the product on the remote end, explaining how a remote user can allow the administrator or helpdesk specialist reach his computer and help resolve his problems in the real time. viii

9 Chapter 1 Concepts WHAT IS REMOTE SUPPORT CENTER? Remote Support Center (RSC) is a comprehensive system designed to enable designated network administrators and helpdesk specialists to manage and control remote computers regardless of their location. ScriptLogic engineered RSC to allow you to remotely connect to any Microsoft Windows-based computer wherever you are and whenever need be. The solution is designed to allow you gain maximum remote management potential on a minimalistic basis. Have you ever had a need to reach a remote computer to get a document? How about getting a call from a user asking for your help as soon as possible? RSC is designed to let you forget about all virtual barriers in the way of connecting to a remote computer. This product helps you concentrate on the task, and not on the implementation aspects. When you manage a remote computer there is always at least two endpoints that are needed to participate in the process; the remote computer and your local computer. The local computer is where you begin the remote management process. Even if you are 100% sure that you are able to access the remote computer directly, there is a very an important question you must ask yourself? Is it secure? How do I work with a remote computer without compromising security on either end? ScriptLogic designed RSC so that under no circumstances a RSC user should be worried about network type, its configuration, security or local or remote computer location. The administrator does not have to worry about direct access to a remote computer from his or her current location. The helpdesk specialist does not have to worry about security. RSC automatically takes on the responsibility of routing requests to the remote computer in order to create a secure route to the remote computer. Logged into RSC, the administrator or helpdesk specialist can safely connect to a remote computer. All that is necessary to connect to and manage a remote computer is a web browser and the Java Runtime Environment (JRE). RSC provides several tools in the Remote Support Center Client. These tools are used to provide the RSC user secure desktop remote control and monitoring, support for file transfers, remote file management, remote PowerShell scripting without the need to use WinRM, user account management and configuration of the remote computer, remote process monitoring remote-to-local printing, advanced scripting, and dozens of other features. All communications are encrypted and all hosts are authenticated using x.509 digital certificates to assure a secure environment for all remote management operations.

10 Chapter 1. Concepts HOW DOES REMOTE SUPPORT CENTER WORK? The Remote Support Center (RSC) provides a set of secure gateways enabling remote administration of computers across network address translation devices (NATs) and firewalls. Even if the local computer is located in an unsecured place such as an internet café, and does not have any special security software installed, except for browser and Java RE, RSC is implemented so all the communications between the calling computer and the computer you want to reach are made secure. Any internal computer on the corporate Windows domain, any external remote computer on the public internet or a private network can be securely managed from any web browser! Where is the Magic? Various components work together to comprise the RSC system. Server components work independently on separate servers and automatically stay connected to the system core which manages inter-system communications. This allows for balanced user load across multiple servers. There are 3 core components: RSC Core Service RSC LAN/Internet Gateway RSC Client and one supplementary component RSC Deployment Service The RSC Core Service (Core Service) implements the main part of the system. This component resides in the corporate LAN on the dedicated LAN Server. It communicates with other system components and provides the management console web interface for performing all the configuration and management operations. The Core Service runs on the IIS Server that hosts management console. It also organizes logic, user authentication and data management within RSC. All the configuration and security data created by RSC users during their work with the system is stored to a dedicated SQL Server. The Core Service manages all the operations with the database server and implements the RSC integration process with the Windows domain. When a RSC user logs into RSC, the Core Service authenticates them in the Active Directory domain, automatically validating the provided credentials. This tight integration with Active Directory helps to protect RSC from unauthorized logons. It also allows the RSC user to always have the latest information about domain computers thus allowing them to instantly reach any of the computers in the domain, even ones that are newly joined to the domain. To implement a working process that is independent from the network type, all the data channeled within the system is routed by dedicated LAN and Internet Gateways. Each Gateway runs according to its dedicated location. The RSC LAN Gateway runs on the LAN Server and routes traffic from: 2

11 Administrator s Guide RSC Clients installed on remote LAN/WAN workstations and servers to Core Service The Internet Gateway that gathers the information from RSC Clients and client browsers in WAN to Core Service The RSC Core Service to Active Directory when RSC queries for information from directory services The IIS ISAPI filter to RSC Client to handle management information when a RSC user initiates remote management session Note The RSC LAN Gateway routes traffic from RSC Clients in the WAN only if there is a direct connection from WAN to LAN. This is usually the case if the direct model is used and there is no firewall between LAN and WAN. In other words, the LAN Gateway is responsible for routing traffic within LAN boundaries. When there are many management sessions initiated from either LAN or WAN, LAN Gateway will handle most of the load. The Internet Gateway runs on DMZ Server and routes traffic from: Remote client browsers in the WAN connecting RSC to the LAN Gateway RSC Clients installed on remote WAN workstations and servers to the LAN Gateway The LAN Gateway that is querying the Internet Gateway for information from RSC Clients and browsers in the WAN Summarizing, this Gateway allows both the remote computers that are available for management and those querying for management to be visible to RSC without having a direct inbound access to the LAN. This saves an Active Directory administrator from exposing his or her LAN to external network. Note The Internet Gateway is only active if the Enhanced Management model is enabled in RSC. Tip See the companion RSC Installation Guide for more information on how you can enable the Enhanced Management model on RSC. Unsolicited, inbound network traffic is generally blocked by corporate and private firewalls. Likewise, NAT devices shield the non-routable private IP addresses of computers in corporate and private networks from the external public networks. ScriptLogic RSC enables remote administration in these environments by deploying a LAN Gateway component and setting up a companion Internet Gateway component in the DMZ. This component allows external and internal computers to become visible within RSC through the corporate firewall. RSC 3

12 Chapter 1. Concepts provides this level of one-way transparency without forcing the enterprise administrator to open holes in the firewall. This eliminates risks of opening sensitive corporate resources that should be protected from unwanted access and external networks. RSC Client is the client software that is automatically installed on remote computers by a RSC administrator request. Installed on a remote computer, this software enables this computer for anywhere management via RSC. This client software automatically makes RSC aware of the computer availability as soon as it reaches one of the RSC Gateways. Running on a remote computer, the RSC Client consistently sends small notification messages to a first found RSC Gateway. This works on a first wins basis where the first found Gateway becomes responsible for routing the message package received from RSC Client to RSC Core Service. This approach mitigates roaming problems allowing the remote computer to easily notify RSC about its presence regardless of its current location. Thus, the RSC Client automatically keeps track of the connection with RSC Gateways thereby making management tolerant to network changes. Imagine a RSC helpdesk specialist managing a remote computer when a computer owner is at work. The management task is in progress but the remote user has to leave the office and thus leave the corporate network. How can the helpdesk specialist finish his or her work and allow the remote user to go about their business? Not an easy task for basic remote control solutions. Easy as pie for Remote Support Center! The RSC Client running on a remote user s computer will automatically restore the connection to RSC once the user is able to join the WAN that has access to a particular RSC Gateway. Once connected to a RSC Gateway, the RSC Client will immediately become visible to the RSC Core Service. The DA Core Service in turn will automatically display the remote computer status in the management console. As soon as the helpdesk specialist becomes aware of remote computer s availability for management he may continue working on his or her task as if the remote computer was not even gone! The RSC Deployment Service provides functionality for rapid RSC Client installations on computers within an Active Directory domain. These quick installations also called push allow a RSC administrator to provision a desired computer a set of selected computers a computer OU whole domain or Active Directory forest with RSC Client software in a single click! The RSC user does not even have to worry about preparing domain computers for deployment. Once configured by the RSC administrator, the RSC Client can be automatically pushed by helpdesk specialist directly from his web browser. This adds a level of abstraction for a helpdesk specialist saving them from necessity to drill into the peculiarities of particular domain configurations. With RSC, any action is only a click away. 4

13 Administrator s Guide Note RSC features a sophisticated permission management handling system that guarantees nobody is able to push the RSC Client unless permitted within the RSC console. Tip Permissions can be configured by a designated RSC administrator. See permissions management and client deployment sections for more details. Here is how the product workflow conceptual schema looks like. Figure 1. RSC workflow general conceptual schema Once installed on LAN Server, the RSC Core Service will automatically discover internal remote computers on the Windows domain. This is done by on-the-fly querying of Active Directory when the RSC user logs into the Management Console. This discovery process makes these computers available to be configured and managed through RSC right from the web browser. The RSC user can prepare the remote internal computer for management by pushing the RSC Client software on the selected Active Directory object. This can be done from an 5

14 Chapter 1. Concepts internal remote computer with browser via the Management Console. External remote computers can be invited to be available within the Management Console via specially generated invitations. This makes them available for management through RSC as if they were joined to the Windows domain. Thus, both the internal and external remote computers become a part of RSC virtualized network. This network virtually wires both types of computers and routes management requests between them via HTTPS channel making communications transparent and secure. As soon as a particular internal or external remote computer or group of them is deployed with the RSC Client, the client software automatically sends notification packets to the Core Service. The packet from RSC Client is routed and delivered to DA Core Service via LAN Gateway if: the RSC Client is located in the LAN if the Direct Management model is used Otherwise, it is delivered via the Internet Gateway on the DMZ Server if the RSC Client is installed on external computer. This is the case when RSC is deployed with the Enhanced Management model and LAN Gateway is not directly accessible to the RSC Client. An Internal LAN computer deployed with RSC Client becomes an internal manageable computer. An External computer located in a network external to LAN, such as WAN or the internet, becomes an external manageable computer. Every RSC user granted access to RSC and permitted to manage a particular remote computer can remotely access the chosen computer using a web browser. This can be performed from either an internal or external remote computer as both types are treated equally by the RSC Core. Security Measures ScriptLogic implemented a set of security measures for the powerful unified management schema provided within RSC. Each of them was developed to provide for strong protection and security control across all of the RSC components and all of the computers involved in the management process. A multi-tier security model is used. In general, it can be split into two levels of security based on the entity it is applied to: 1. Computer 2. RSC user These levels are enhanced further, each on their own particular side. The computer security level applies security policies and filters for a computer object. This enables RSC to verify a particular computer that is trying to connect to RSC against the security settings specified by RSC administrator. The RSC user security level checks to verify a user that is attempting to to authenticate within RSC against the security policies for a user defined in RSC. 6

15 Administrator s Guide By default, only the LAN Server administrator having interactive access to the LAN Server is granted login capability to RSC. Even though a user is able to read the LAN server via a network connection, they will not be able to log into the Management Console unless specific permission is granted within RSC. Note The Interactive RSC user is the user that is able to access the RSC Core service by specifying its local address: Warning When using Enhanced Management Model, a RSC administrator has to explicitly grant an RSC user and the DMZ computer access to RSC to enable access to Management Console from DMZ Server. Note By default, LAN Server is granted access by its loopback IP address only. Every RSC administrative computer should be explicitly granted access by IP address within RSC. This enables RSC automatically block unwanted access to all computers not granted access within the console. This computer may optionally be required to provide a client x.509 certificate in order to access RSC. This further strengthens security barrier without any affect on performance. This policy enables the RSC to deny access to the user on the remote computer with a browser if the user has not provided a client security certificate when accessing RSC. If this is the case, the user will be denied access to RSC even if the IP address of his or her computer is granted access in RSC. Tip An administrative computer is a computer that is used to access RSC. Administrative computers do not require any software to be installed. They may access RSC and perform remote administration of RSC Clients from any Javaenabled web browser. As a further user access security measure, all RSC users are verified upon their login against the Active Directory that the LAN Server is a member of. But not only that, each user logging into RSC is verified against RSC user access settings specified solely within RSC. These settings are created by RSC administrator. All of the components comprising RSC are deployed with x.509 client certificates that make them unique and secure. All the components are authenticated within the RSC built-in OpenSSL Certification Authority for a valid x.509 certificate before they can join a virtual RSC network. This provides an integrated selfdefense protection with on-the-fly verification of component integration. Components not signed with a valid RSC certificate are prohibited and will not be able to join the RSC network and compromise system security. All communications are automatically signed and performed via an HTTPS channel as soon as you deploy RSC in your environment. Every data flow within the RSC is available within RSC only and only to authorized users or computers. 7

16 Chapter 1. Concepts RSC Components Port Usage Below you can find the table summarizing network configurations used by RSC components. This outlines which ports are used by a particular RSC component and what the component uses them for. Component Listen Port Waits for Connection from/to Local Remote Inbound Outbound Core Service Defined in IIS Manager Any Client Browser N/A Used to accept browser connections and allow the RSC user to access the Management Console from a computer in the LAN. If the Direct management model is used, and IIS is open for incoming connections from WAN, this port can be used by browsers in the WAN. Defined in IIS Manager Any LAN Gateway N/A Used to retrieve information about available remote RSC Clients and other information specific to RSC configuration and management. LAN Gateway 1529 Any RSC Client in LAN N/A Used to accept connections from remote RSC Clients. Usually these are clients running on computers in the LAN. If the inbound connection can be installed from the WAN to the LAN Server, this port can be used by RSC Clients in the WAN Any Core Service N/A Used to accept connections from the Core Service when the latter processes requests to Active Directory. This connection is established locally on the LAN Server only Any ISAPI Rewriter N/A Used to accept management specific data from the IIS web extension. This connection is established locally on the LAN Server only. Any 1528 N/A Internet Gateway Used to establish an outbound connection to the Internet Gateway in the perimeter network when RSC is configured with 8

17 Administrator s Guide Component Listen Port Waits for Connection from/to the Enhanced Management model. Internet Gateway 443 Any RSC Client in WAN N/A Used to accept connections from remote RSC Clients running on computers in the WAN. 443 Any Client Browser N/A Table 1. RSC Components Port Usage Used to accept browser connections and allow the RSC user to access the Management Console from a computer in the WAN Any LAN Gateway N/A Used to accept inbound connections from the LAN Gateway and make the Core Service aware of the browser and RSC Client connections from computers in the WAN. 9

18 Chapter 2 RSC Admin Role OVERVIEW The RSC Administrator is a user of the Remote Support Center who is typically responsible for configuring and managing the RSC Management Console (RSC Console) and configuring the users who have access to it. This Administrator has the ability to designate other Administrators access to configure the RSC Console. They also designate who the Helpdesk Specialists are by allowing them to access the RSC Management Console but not the ability to configure it. The RSC Administrator must initially locally login to the RSC Console from the machine it was installed to. Note The Administrator has to use the localhost address to access the RSC Console by the URL Warning The RSC virtual directory name is the default name that is created during installation. If a custom virtual directory name was specified, please replace the /RSC in the URL above with the custom name. Start the RSC Console by selecting ScriptLogic Corporation Remote Support Center Home Page from the Start menu on the LAN Server which it was installed to. Type in the Active Directory administrative credentials used to login LAN Server and click Login.

19 Administrator s Guide Create an RSC Administrator and/or Helpdesk Specialist Account There are three steps required to designate a domain user as an RSC Administrator or Helpdesk Specialist. 1. Provide the user s computer IP address or address range. (IP Filter) 2. Designate the AD User or Group that will have administrative privileges in the RSC Console. (Designating RSC Administrators) 3. Issue and install a User Certificate on the Helpdesk Computer. (User Certificates) Security Settings Select Settings Security Settings from the RSC Console menu to access the Security Settings dialog. This is where users and computers are given permission to access and/or configure the Console. Figure 2. Adding new record to the IP Filter IP Filter A computer is given permission to access the RSC Management Console by defining the computer IP address within an IP Filter list on the RSC Security Settings page. An IP filter may consist of a single IP address or a range of IP addresses. To specify a range of IP addresses, simply set the necessary IP address octet representing the host part of the computer IP address to 0. You will create a subnet start address. To define the IP address range, you have to specify the corresponding subnet mask. An IP filter can also be used to deny permission to a specific IP address. Example: IP Subnet Allow this specific computer to access RSC 11

20 Chapter 2. RSC Admin Role IP Subnet Allow all the computers in the range to access RSC console It may be necessary to deny a specific IP address from accessing the RSC Management Console. If there are some IP addresses within the defined range that should not be allowed access to RSC, simply add the specific addresses as a separate filter and leave the usage checkboxes unchecked. Example: IP Subnet Req Cert Access RSC Config RSC IP address will be denied access to RSC console since the Allow Access to RSC and Allow Configuration of RSC checkboxes are unchecked. Warning The IP addresses being denied access must be specified above the IP filter which includes this computer within a range of computers allowed to access the RSC console. Adding a New IP Filter Click Add New Filter to add IP address(es) to the filter list. IP Enter the IP address of a single computer or a group. Specify a group of computers by entering the first three octets and 0 for the last octet. Subnet Enter the subnet mask that will be used to identify the computer. Specify a group of computers by entering the first three octets in the mask and 0 for the last octet if you want to lease 24 bits for network IP address part leaving another 8 bits for the host part. Thus you will specify a range of 254 computers. Don t Require Certificate Check this box to allow the computer with the defined IP address or group of computers with the defined IP address range to access the RSC console without requiring a client security certificate to be installed on the client remote computer. This certificate is typically installed from the web browser used to access the RSC console. Leave this box unchecked (blank) to require a certificate. The certificate is created by selecting the Administrator Certificates command from the Settings menu on the menu toolbar in the RSC Home Page. 12

21 Administrator s Guide Allow Access to RSC Set this box to allow the computer or group of computers to access the RSC console. This means that the user at the computer with the specified IP address will be allowed to access the RSC console and use it to connect to and manage remote computers only. This includes the permission to send an invitation to a remote user. Allow Configuration of RSC Check this box to allow the user at the computer or group of computers not only to access the RSC console but to also configure the RSC system settings. Note Figure 3. Adding new IP filter Click Add Filter to add the specified IP filter to the IP Filter list. Click Cancel to discard the IP Filter changes. The loopback address is allowed administrative access to the RSC Console by default. Removing an IP Filter To remove one or more IP Filters from the list, select each one to be removed by setting the box in the left hand column next to the particular IP or IP range. Once one or more IP filters are selected, click Remove Selected. 13

22 Chapter 2. RSC Admin Role Figure 4. Removing IP filter from the list Editing an IP Filter Click Edit row in the right hand column next to a particular IP or IP range to edit an IP Filter. Figure 5. Editing IP filter in the list The selected IP Filter is ready for edits within the list. Make changes to desired editable boxes and click Submit to save changes to the edited IP Filter. Click Cancel to discard IP Filter changes. 14

23 Administrator s Guide Reordering the IP Filter List The ordering of the IP Filters within the list is important if there are any overlapping IP addresses. The first IP address, starting from the top of the list that the computer matches will determine the permissions for that computer. Example: IP Subnet Req Cert Access RSC Config RSC All computers in the x LAN will have access to the RSC Console except for the computer with IP address of When this computer attempts to login to RSC, IP Filter #1 will exclude this computer from accessing the RSC Console. Click the up and down arrows to move an IP Filter, reordering its position in the list. Note To allow computers access RSC from everywhere, edit the bottom IP Filter with defined in IP and Subnet columns. Check the Allow Access to RSC and/or Allow Configuration of RSC boxes. Warning When working with denial filters, please verify that filter denying access from an IP address is ordered higher position than the allow filter. Tip To deny access from IP address and allow access from all other IPs, place the deny filter for higher in the list than the default route IP ( ) edited to allow access to RSC. Tip To allow access from IP address and deny access from all other IPs, place the allow filter for higher in the list than the default route IP ( ). Warning By default the Filter is set to deny access from everywhere (all checkboxes are unchecked). 15

24 Chapter 2. RSC Admin Role Designating RSC Administrators Users/Groups added to this configuration section will be allowed to access the RSC Console with administrative privileges. Warning In order for Administrator to have administrative privileges in RSC, Administrator s computer need to have Allow Configuration of RSC set in IP corresponding filter AND his domain name or name of the domain group he belongs to appear in RSC Administrators list. Adding a User or Group to Administrators Click Add User/Group to locate a User or Group in the domain. Figure 6. Adding RSC administrators In the opened Find Users and Group window, click Find to list all users from all domains in your Active Directory. Type in either the user logon name (SAMAccountName), the full name (displayname), a group name or the beginning part of their names. Click Find or hit <Enter> to list all the matching users found by the given criteria. You can use the well-known technique and search just like you used it to do in Active Directory Users and Computers (ADUC) snap-in (dsa.msc). For example, type admin and hit <Enter> to list the Administrators group and the Administrator account (if available). To narrow your search to specific domain select it in Domain drop-down box. 16

25 Administrator s Guide Note Figure 7. Selecting a user to add to RSC administrators Use the scroll buttons to rewind the pages if there are more than 10 groups and/or users returned by the given criteria. Use the Next (>) or Prev (<) button to go on one page forward back in the list. Use the First ( <) or Last (> ) button to go to the beginning of the list or jump to the very last page. Select one or more Users or Groups by setting the checkbox next to their names and click Add. The chosen Users/Groups will be added in the RSC Administrators list. Only the selections made on the currently displayed search results page can be added to the RSC Administrators list. Selections made on multiple pages are remembered only for the last active page. 17

26 Chapter 2. RSC Admin Role Removing a User or Group from Administrators To remove one or more Users/Groups from the list, select each one to be removed by selecting the box in the left hand column. Once the Users/Groups are selected, click Remove Selected. Figure 8. Removing a user from RSC administrators BLOCKING REMOTE COMPUTER InstantAssist can be run on any supported operating system without any preparations necessary from a remote user. Provided that there are free InstantAssist Technician licenses, InstantAssist makes it easy for a user to install it on as many PCs as necessary. With the number of remote PCs provisioned with InstantAssist growing, it may be necessary to limit the number of computers available for management though the Console. The Remote Support Center Management Console allows you easily manipulate remote computer access in RSC and prohibit access for the remote PC registered with RSC thus hiding it from management within the console. Should there be the need to manage the prohibited computer again and make it visible in the Hierarchical Grid, an RSC administrator or technician can re-enable the PC it in a single click right from the Console. The InstantAssist Clients page allows you perform block operations right from the Hierarchical Grid view. Specifying remote computer(s) to block 1. Click on the InstantAssist Clients folder in the tree. 2. Select the Computers tab and navigate to the computer(s) using the Hierarchical Grid view. Use filtering when necessary. 3. Select the checkbox next to the found computer. The Block computer(s) button on the Hierarchical Grid toolbar will become active. 4. Click the Block computer(s) button to commit blocking of selected computers. 18

27 Administrator s Guide 5. Confirm blocking by clicking OK in the message box. Once confirmed, the selected computer(s) will immediately be blocked from accessing the RSC Console and moved to the Blocked computers tab. Figure 9. Blocking selected computer to hide from appearing in the computes list Viewing and Unblocking blocked remote computer(s) 1. Click on the InstantAssist Clients folder in the left-hand tree tree. 2. Select the Blocked computers tab to display the grid with all blocked computers. To view the list of blocked computers 3. Click Refresh button to immediately get the up-to-date information about the remote computers that have running InstantAssist clients. 4. Locate the remote computer that you want to unblock. To unblock a single computer 1. Click the Unblock link in the Operation column next to the computer you want to unblock. To unblock several computers 1. Set the checkbox next to the found computer(s). The Unblock computer(s) button on the Hierarchical Grid toolbar will become active. 2. Click the Unblock computer(s) button to commit blocking of selected computers. 3. Confirm unblocking, if necessary, by clicking OK in the message box. 4. Please make sure to inform the remote computer user to restart InstantAssist as to make it available on the Computers tab. 19

28 Chapter 2. RSC Admin Role Figure 10. Unblocking selected computer to show it in the computers list 20

29 Administrator s Guide ADMINISTRATOR CLIENT CERTIFICATES To strengthen RSC access security policies, use Administrator Certificates to create the client digital certificates. Digital Certificates are an optional requirement for allowing users to access the RSC Console. The certificate requirement is based on the requirement setting within the configured IP Filters. If a certificate is required by the IP Filter, it must be issued for Administrator to access the RSC Console. Select Settings Administrator Certificates from the menu bar to open the Manage Administrator s Client Certificates page. Note Make sure the box in the Don t Require Certificate column for the certificate-enabled IP address is unchecked in the IP Filter list. Figure 11. Issuing RSC user certificate User Certificates The User Certificates section lists all users that have been issued a client certificate. By default, no users are issued a client certificate and this list is empty. The list may contain users with current valid, expired or revoked certificates. Each row in the User Certificates list describes a domain user, certificate status, certificate issue and expiration dates and a download link to get the certificate at any time. 21

30 Chapter 2. RSC Admin Role Issuing a Client Certificate to Administrator User Name Enter a user name or group to whom the certificate will be issued to. Click Look Up to browse Active Directory for a user. Lookup Click Look Up to locate a User in an Active Directory domain. A search window will be displayed. Figure 12. Selecting a user to be issued a client certificate Click Find to list all users from all domains in your Active Directory. Type in either the user logon name (SAMAccountName), the full name (displayname) or their part for the user that you want to issue the client certificate and click Find to list only the specified user(s). Select a user by checking the checkbox next to its name and click Add. Certificate Password Enter a password to protect the issued client certificate. This prevents unauthorized access to the issued certificate and will be used during the certificate installation. The user importing this certificate on his or her computer has to provide the certificate password to get it imported. Confirm Password Enter the provided password again to avoid mistyped passwords. Issue & Download Certificate 22

31 Administrator s Guide Note Click Issue & Download Certificate to create the user certificate and automatically download it to your computer. Once the certificate is issued and downloaded, it must be imported into the browser on the computer that will be used to access the RSC Console. The person installing the certificate on the target computer will need the certificate password to complete the install. Installing the Certificate using IE After the certificate file (cert.pfx) is copied to the client computer that will be used by RSC user to access the RSC Console, double click the file to import it. Click Next on the first two dialogs of the import wizard. On the Password page, enter the password given when the certificate was created. Click Next to continue. Accept all other defaults in the Certificate Import Wizard by clicking Next on each wizard page. Click Finish to complete the Import process. Downloading an Administrator Client Certificate You can download any of the created client certificates for a desired user at any time right from the User certificates list. Figure 13. Downloading client certificate The column entitled Download allows the certificate file to be downloaded at any time for any valid certificate. Click on Download to retrieve the certificate. The certificate is also downloaded at the time it is generated. Revoking Certificate from Administrator To revoke the certificate for one or more RSC users in the list, select each one to be revoked by selecting the box in the left hand column. Once the users are selected, click Revoke Selected. 23

32 Chapter 2. RSC Admin Role Figure 14. Revoking a certificate from Administrator 24

33 Administrator s Guide APPLICATION STATUS AND CONFIGURATION RSC monitors the statuses of all its server components. When necessary, an RSC Administrator can review the status for a desired component. On top of that, RSC also provides you tools to configure access from Internet to RSC. A special license which allows user to download and configure Internet Gateway is required for this purpose. From the Settings menu on the RSC console home page, select Application Status and Configuration to see the status of the RSC services. Alternatively, click View status from the Home page. Services Statuses This table lists statuses of RSC components. Here you can see if the RSC LAN and Internet Gateway are working properly. Additionally, you can (re)generate and download the Internet Gateway package to be deployed on DMZ Server. If link to download Internet gateway is not shown, your license has restriction to use RSC only in the LAN. To get Internet Gateway license please contact ScriptLogic sales team. Figure 15. Viewing components status Service This column displays the RSC component name. IP Address This column displays the IP address of the server on which the particular component is installed. For the RSC Deployment Service and RSC LAN Gateway this IP address is always equal to since these components are running locally to RSC Core Service. 25

34 Chapter 2. RSC Admin Role If your RSC installation is licensed with an optional Internet Gateway license and you deployed the Internet Gateway component to the DMZ Server, this column displays different IP depending on the access type. The internal-facing interface IP address of the DMZ Server is displayed for the LAN -> DMZ type of connections. These connections are initiated by the LAN Gateway. The external-facing interface IP address of the DMZ Server is displayed for the Internet -> DMZ type of connections. This address is typically a public interface present on the DMZ server. However, this address may represent an IP address of the NAT device/firewall if address translation is enabled in your perimeter network. These connections are initiated by the remote ExpertAssist and InstantAssist clients residing on the internet. These IP address and DMZ server port are also specified by RSC users connecting to RSC Console from computers on the internet. Warning If the component has not been installed or is not available because it has not been licensed, a hyphen will be shown in the IP address column. Warning If you are using a limited license that does not allow using the Internet Gateway, you will see a hyphen (-) within the columns that apply to DMZ Server IP addresses. Note The Internal-facing interface is the network interface installed on the DMZ Server and connected to the LAN. Note External-facing interface is the network interface installed on the DMZ Server that is connected to the internet or WAN. This interface allows external users connect to DMZ Server from WAN external networks like internet. Status This column contains the status information for the particular component indicating if the component is running (online) or is offline. Offline status may indicate the service or computer is not running or not available. Note If your RSC installation is not licensed with optional Internet Gateway license, the Internet Gateway status is displayed as Not installed. Licensing the application with an Internet Gateway license enables you to manage computers on the internet and allows to access RSC from the internet. 26

35 Administrator s Guide Warning If you see Not Licensed displayed in the Action column, this indicates that the currently applied license does not include the DMZ Server package. Please consider obtaining the Internet Server license to be able to download and deploy the Internet Gateway on your DMZ Server. Please contact ScriptLogic Sales team for purchasing optional Internet Gateway license. Action This column allows you to perform an action for the service. Click Download to generate and download the package. Invitation Settings In this section you can specify network settings that will be used for creating and sending RSC Client invitations. Figure 16. Configuring addresses to be used for creating and sending invitations LAN Access This edit box shows the DNS name, NetBIOS name or IP address of the LAN Server that will be used for creating RSC Client download links. The generated invitation message will contain the URL for the RSC client download links created based on the information provided here. This URL will be typically used by the remote RSC user to download the RSC Client from your corporate internal LAN network. By default, the RSC Console uses DNS names. If resolving LAN Server IP address to its DNS fails, IP address or NetBIOS name will be used. If you want the RSC user to download the RSC client using the LAN Server via the different address, click the Modify button. The Invitation Settings dialog box will be opened. In the LAN Access drop-down list box specify the new address for the remote user to access the LAN Server and click Save. This may be helpful if the LAN Server is located behind the NAT address translation and it is necessary to specify the LAN Server public IP address. 27

36 Chapter 2. RSC Admin Role Figure 17. Selecting IP address or name to be used for downloading an RSC Client from LAN External Access This edit box shows the DNS name, NetBIOS name or IP address of the DMZ Server that will be used for creating RSC Client download links. The generated invitation message will contain the URL for the RSC client download links created based on the information provided here. This URL will be typically used by the remote RSC user to download the RSC Client from external WAN networks like internet By default, RSC Console uses IP addresses for external access names to avoid resolving the DMZ Server address to an internal DMZ Server name retrieved from internal DNS server. If your RSC license allows using LAN Server only, using a DMZ Server will not be available and the edit box will contain Not installed inside. If you want an external RSC user to download the RSC client from the internet using the DMZ Server via the different address, click the Modify button. The Invitation Settings dialog box will be opened. In the External Access drop-down list box specify the new address for the remote user to access the DMZ Server and click Save. This may be helpful if the DMZ Server is located behind the NAT address translation and it is necessary to specify the DMZ Server public IP address. SMTP Server This edit box shows the IP Address or DNS name of the SMTP server that will be used to send invitations to remote users. By default it contains the SMTP server address specified during the RSC installation. Note Please specify SMTP servers which do not require explicit authentication. These are typically servers such as your corporate Exchange server. 28

37 Administrator s Guide Click Modify to edit configured SMTP server address or provide a new one. In the Invitation Settings dialog box edit the SMTP Server edit box and click Save. From Sometimes, it may be necessary to specify the sender address to authenticate on the specified SMTP server when sending the invitation. This address will also be shown in the FROM field of the invitation message when received by the remote RSC user. By default, invitation messages are sent from the RSC@scriptlogic.com address. Click Modify to edit configured SMTP server address or provide a new one. In the Invitation Settings dialog box edit the From edit box and click Save. 29

38 Chapter 2. RSC Admin Role RSC LICENSING All RSC users need to have an Enterprise License to use the product. In addition, users can purchase optional InstantAssist licenses and Internet Gateway licenses. An Enterprise license allows you to use RSC with ExpertAssist clients. The license regulates the maximum number of remote computers you can manage using ExpertAssist. An InstantAssist optional license allows you to use the InstantAssist client to assist external users who do not have or cannot have ExpertAssist installed. InstantAssist is a name based license and is limited by number of helpdesk technicians using it. Note Internet Gateway (DMZ Gateway) is a gateway component used by RSC to manage remote computers located outside your network. This component is necessary to allow an administrator to access RSC from internet. To see current license status, select the Help About from the menu bar in the RSC Management Console. To look for a complete list of the licensing parameters, click the link in the License information section on the Home page. Figure 18. Viewing licensing information 30

39 Administrator s Guide License status This field shows whether the product is being used on evaluation basis or has been purchased with dedicated ExpertAssist Client or InstantAssist Technician licenses. It also displays support maintenance expiration date. License expiration date Shows the date up to when the currently applied license is valid. When the license has expired or evaluation period has ended, a new license must be provided to continue working with RSC. ExpertAssist Licensing Shows license information when ExpertAssist licenses have been applied. An ExpertAssist license is purchased based on the number of computers that can be managed through RSC. A computer is recognized as managed through RSC if it has an installed ExpertAssist and it has been used at least once for remote management. You can deploy ExpertAssist via push or invitations to as many remote computers as you wish. Once you have selected a particular computer in RSC Management Console, clicked Manage, and started the management session, this computer takes 1 purchased license. Total licenses This field shows the total purchased licenses with the ExpertAssist license type. Uses licenses The number of ExpertAssist licenses currently in use. This typically specifies the number of unique remote computers that have been managed though the ExpertAssist at least once. InstantAssist Technician Licenses Shows license information if an InstantAssist Technician license has been applied. An InstantAssist license is purchased based on the number of domain users that can manage a remote computer invited with InstantAssist. Once you enable a particular Active Directory user for managing remote computers using InstantAssist, this user takes 1 purchased license. Total licenses This field shows the total purchased licenses with the InstantAssist Technician license type. Uses licenses This field shows the number of InstantAssist Technician Licenses currently in use. This is typically the number of unique users that have been authorized to manage remote computers via InstantAssist. 31

40 Chapter 2. RSC Admin Role The bottom list specifies all the Active Directory users that have been enabled for lightweight remote management through InstantAssist. Figure 19. Adding a user to authorize him for management via InstantAssist Add user Click this button to add Active Directory users that will be authorized for remote management through InstantAssist. These users will be able to use InstantAssist to manage a desired remote computer deployed with InstantAssist RSC Client. Once the user is granted for managing, this computer must have an InstantAssist invitation and InstantAssist client running on it for the management to be possible. License Types Remote Support Center has a broad set of functionalities that allow you to tailor remote management power to your needs. To make customization yet more flexible ScriptLogic has made Remote Support Center licensing policies easy to adapt to your requirements. You can apply licenses based on their application that allows you to license the Remote Support Center on the following options: RSC Client Licensing ExpertAssist Licensing InstantAssist Technician Licenses This licensing allows you choose which of the two remote management clients will be available for remote computer management. The ExpertAssist client is licensed on a perpetual basis per number of management computers that have ever been deployed with and managed via the ExpertAssist client. The InstantAssist client allows you license it per technician that has been authorized for managing a remote computer via the InstantAssist client running on the remote computer. One ExpertAssist license is taken for each unique remote computer deployed with ExpertAssist once you start the first management session with this remote computer. Once the license is taken on the first management session, all the management sessions following this first one will not take the license. The InstantAssist client takes a license for each of the technicians granted for remote computer management using InstantAssist. RSC Component Licensing LAN Gateway license (standard management) 32

41 Administrator s Guide Internet Gateway license (anywhere management) With this licensing you can tailor Remote Support Center by applying its management functionalities to your infrastructure. If you have purchased a LAN Gateway license, you will be able to use Remote Support Center by connecting to its LAN Gateway component residing on a dedicated server within your LAN network. Purchasing the Internet Gateway license allows you to enable its Internet Gateway component thus making it possible to manage remote computers both via the internal corporate network and your perimeter network. The Internet Gateway residing on the DMZ Server allows you to (but does not limit) route your management even if you have no direct access to your LAN network. WARNING Previous licenses cannot be applied and require you update your licenses to version 2.0 NOTE If you had an Enterprise license with optional Internet Gateway, and then applied a license without Internet Gateway, RSC would automatically disable it. External computers on the internet and WAN based computers will not be available for management anymore. Using RSC License Manager To manage your RSC license or extend current licensing by adding more licenses, the RSC License Manager must be run. This tool allows you extend or switch your licensing by applying standard (LAN only) or enhanced DMZ license. On the LAN Server, click Start > All Programs > ScriptLogic Corporation > Remote Support Center > License Manager to start the RSC License Manager. Figure 20. Working with RSC License Manager 33

42 Chapter 2. RSC Admin Role Click Browse to locate the purchased license file. Browse for the file location, select the file and click Open. The license file path will be added to the edit box. Once added, click Apply and RSC will read and apply the file. The license parameters will be updated. If you are applying the restricted license that disables some of the functionality enabled by the currently applied license, the License Manager will warn you by displaying the corresponding message box. Click Yes to confirm applying the new license and overwrite the existing one. Click No to leave the current license and cancel applying the newly provided license. Click Close to exit the Remote Support Center License Manager. Click Launch Management Console to start the browser locally on the LAN Server and open the Remote Support Center Management Console. Once started, you can log into the Console and view additional licensing information, authorize InstantAssist technicians or start managing the application. 34

43 Chapter 3 Helpdesk Specialist Role GETTING STARTED The Helpdesk Specialist is a user of the Remote Support Center who is typically responsible for managing and connecting to remote computers. This process is performed from within the Remote Support Center Management Console (RSC Console). Before You Begin Your RSC Administrator need to perform a security configuration in the console, to allow you to access RSC. Following settings need to be configured: 1. Your local computer IP address should be added to the list of IPs allowed to access RSC. 2. RSC Console access credentials your domain account should be added to computers or groups you will need to manage. You will use your personal Active Directory user name and password to login to RSC Console. 3. [optional] Client Certificate - Your personal client certificate issued to you by your RSC Administrator.

44 Administrator s Guide Logging into the RSC Console Your work with RSC console can be accomplished right from within the browser. Depending on your location, whether you are currently connected to your corporate LAN or you are sitting in somewhere in WAN and your computer is outside local corporate network steps you have to perform to start working with RSC may be different. To log into the RSC Console from your computer: 1. [optional] This step is necessary when your RSC administrator has given you personal client certificate (*.pfx file) and provided security password to import the certificate. Double click the provided file and import the certificate to your computer. 2. Start the browser and type the RSC Console URL address into the address bar. Depending on the configurations created by RSC Administrator and the provided URL, you may use one of the following notations: Warning These addresses are fictitious and provided for reference only. Please make sure to specify here your custom DNS or IP address of the RSC Console provided by RSC Administrator. 1. Accept the browser security warning, which is only shown if self-signed SSL certificate or SSL certificate generated by RSC during installation is installed in IIS. Click Continue to the website. Figure 21. Accessing the RSC Console from your LAN computer IE 7/8 36

45 Chapter 3. Helpdesk Specialist Role 2. Accept or decline choosing a digital certificate. a. [optional] This step is necessary when your RSC administrator has given you personal client certificate (*.pfx file) and provided security password to import the certificate. Choose the provided certificate in the Identification list within Choose certificate dialog box and click OK. Figure 22. Choosing provided certificate b. Perform this step if your RSC Administrator has not required you to provide your personal client certificate. When working in Internet Explorer 7/8, click Cancel in the Choose certificate dialog box Figure 23. Skipping digital certificate prompt when certificate is not necessary 37

46 Administrator s Guide Note Internet Explorer 8 will automatically send the information that you do not have installed client certificates to the RSC Console when opening the RSC Console from a computer within LAN. You do not have to confirm choosing a certificate if the RSC Console site URL address is present in the Local Intranet zone settings. 3. When using Internet Explorer with the Internet Enhanced Security Configuration mode (IEESC mode) enabled, click Add and then choose to add the automatically provided RSC Console web site URL to the Trusted Sites security zone. To do that, click Add in the Trusted sites dialog box. Click Close to close the window and proceed with opening the RSC Console. Note Figure 24. Adding the RSC Console site to the Trusted Sites zone The Internet Enhanced Security Configuration mode (IEESC mode) is typically enabled if you are accessing the RSC Console from a computer with a server operating system like Windows Server 2003 and Windows Server Note 4. In the Remote Support Center Console login page provide your Active Directory user name, password and your company s domain name. Click the Login button to enter the RSC Console. You may use short (NetBIOS) and long (FQDN) DNS names of the domain. Use sales.emea.yourcompany.com as a long DNS name or sales as a short name (without quotes). 38

47 Chapter 3. Helpdesk Specialist Role Warning When logging into the RSC Console by providing your personal client certificate, please make sure you specify a short domain name in the Domain edit box on the login page. Note Please contact your RSC Administrator for exact domain name if you do not know it. Note Please see the Frequently Asked Questions section to find the possible solution for RSC console access or login problems. 39

48 Administrator s Guide Using Hierarchical Grid The Hierarchical Grid is used to navigate remote computers that are internal to the LAN and thus reside in Active Directory, and remote computers external to the LAN, located somewhere outside the Active Directory infrastructure and LAN network. The Grid combines easy tree structure with powerful grid based filtering and object grouping allowing you to find desired computers on-the-fly. A desired remote computer you have to reach can be accessed within the Grid via an Active Directory tree node or within the tree of user-defined Remote Computer Groups. Expand the tree, click the desired node, refine the filter your way to locate the desired computer. Once you see the computer in grid, you can view its status, provision it with RSC client software, start managing the computer or view/configure access permissions for this computer within RSC. Figure 25. The Hierarchical Grid tree 40

49 Chapter 3. Helpdesk Specialist Role Navigating the Grid Expand each tree node to list the folders representing discovered Active Directory domains, computer OUs, containers and custom remote computer groups. Click a desired folder in the hierarchical view to open it and display its computers or subfolders. Clicking the Active Directory node displays a table with discovered domains. Figure 26. Hierarchical grid expanded Note The RSC Console filters out non-computer related (e.g. containing users) and empty organizational units (OUs) in your Active Directory displaying only those OUs that contain computer objects inside. 41

50 Administrator s Guide SEARCH AND FILTER COMPUTERS AND GROUPS RSC provides easy tools to search and filter available computers and groups. Using the special table view you can locate the desired computer or group by browsing though the table or using powerful filters. Click the desired hierarchical tree node to display the computers or subfolders within it. Computers This tab displays the contents of the selected node. Depending on your environment or configuration, it may contain computers or subfolders which in turn may contain a number of other computers or subfolders. Type This column allows you filter the displayed view by item type. Expand the dropdown box to filter this column by a desired item. Available items are: Computers Filter the list by computer type to show available computers. Containers Filter the list by computer type to show available computer OUs and containers. Name This column displays computer names for available computers. Type in a filter box the desired computer name or part of its name and hit Enter. Alternatively click the magnifying glass to start the search. Use asterisk (*) symbol when necessary to substitute for any class of missing characters in the query. Operation This column lists operations that can be performed with remote computers. Filtering by this column allows you to locate computers which already have RSC client installed, which are being managed, or computers where RSC client can be deployed. Operating system This column allows you filter the remote computer list by its operating system. The operating system is automatically retrieved by RSC from Active Directory. 42

51 Chapter 3. Helpdesk Specialist Role The Type column has smart icons that change depending on the remote computer status. Remote computer is offline Remote computer has RSC Client installed and running Table 2. Computer state icons Click the Refresh button to get the most recent information about available computers and their statuses. This is helpful when you are deploying RSC client to multiple computers and want to keep track of their status change. Select the Display drop-down list at the bottom of the table to set how many items you want to be displayed on a single page. Type the page number into the edit box and hit enter to move to a desired page or click the corresponding scroll buttons to move through pages if the displayed list is too large to fit in a single page. 43

52 Administrator s Guide REMOTE COMPUTER GROUPS A Remote Computer Group is a user-defined container of remote computers. It contains WAN based computers from external networks or LAN computers which are not members of Active Directory domain. Remote Computer Groups are used to organize remote computers for easy access and management within the RSC Console. Managing Groups and Sub-groups Click on the RSC Default Remote Computer Groups node or a specific custom group within the Hierarchical Grid. You can select the group from either the tree or grid. To open a custom group from the tree, expand the Remote Computer Groups node in the tree and drill down the tree structure. Figure 27. Expanding the tree and opening grid To open the custom group faster using the grid, click the default Remote Computer Group and then locate the custom group in the right hand grid. Use filtering when necessary. Figure 28. Opening remote computer group from the grid The Remote Computer Group page is entitled with the name of the selected remote computer group. The page allows for the creation of new groups (nested 44

53 Chapter 3. Helpdesk Specialist Role Remote Computer groups) within the selected group. Existing groups can be moved into and out of a parent group. Create a Custom Remote Computer Group To create a new custom Remote Computer Group, click the Remote Computer Group node in the tree to open the group s grid. Click the New Sub-Group button on the toolbar. In the New Sub Group dialog box type in the group name and click OK. Click Cancel to close the dialog box. Since Remote Computer Groups can be nested, look at the title of the Remote Computer Groups page to see which Remote Computer Group your new one will be created under. Managing Remote Computers within a Group The RSC Console allows you to easily manage your work with computer groups by sorting them as necessary, moving between the different groups, nesting, etc. You can move the groups to help you arrange your workload the way you need it. Moving a Remote Computer Group Groups may be nested within each other. To move a remote computer group into or out of another group or to the root, open the Remote Computer Group in the Hierarchical Grid tree. Click the Move To button on the toolbar. Figure 29. Moving remote computer group In the opened Computer Groups dialog box, navigate the tree to select the destination group where the chosen group should be moved to. Click OK to finish the operation. Click Cancel to stop moving the group. 45

54 Administrator s Guide Figure 30. Selecting the destination group to move to Remove a Remote Computer Group When necessary, you can remove the remote computer group and all of invited computers within it. Select the group by setting the box next to it in the Navigation Grid and click Remove to delete the group. 46

55 Chapter 3. Helpdesk Specialist Role Manage Remote Computer Using the Hierarchical Grid you can start managing a remote computer right from the remote computer group. Figure 31. Starting remote computer management Computers The Computers tab lists the computer name as defined on the Remote Computer Invitation, Remote Computer Name. Invite Click Invite to create an invitation to for remote computer to install ExpertAssist. Once the invitation is accepted and ExpertAssist downloaded and installed, the remote computer will show in the grid, in currently selected Remote Group as available for management. Refresh Click Refresh to refresh the grid with Remote Computers. Following operations apply to computers selected (using checkboxes) in the grid: Remove Selected Click Remove to delete selected Remote Computers from the grid. Remove button is disabled until one or more Remote Computers are selected in the grid. Move To Click Move To and move selected Remote Computers from the current group to the newly selected group. Select the new group from the tree in the Computer Groups dialog box. Remote Computer Group Access Permissions The Users and Permissions tab defines the users and/or groups that have access to manage the remote computers within the Remote Computer Group. 47

56 Administrator s Guide Warning Access permissions can be only changed/added if you have Delegate permission for computer or a computer group where it is residing. Note Checkboxes that specify access permissions are grayed out if the specific permission is inherited. For example, if you have the Delegate permission for the computer or group and the checkbox for this permission is grayed out, it means that this permission is specified at the higher level such as parent computer group. Open the Users and Permissions tab in this parent folder to change the inherited permission. Figure 32. Viewing access permissions for the remote computer group Add Select a User or Group and click Add. The selected User/Group will be added to the access control list (ACL) on the Users and Permissions tab. Click the cross sign on the dialog box to discard changes. Remove To remove one or more Users/Groups from the ACL, select each one to be removed by selecting the box in the left hand column. Once the Users/Groups are selected, click Remove. Save Permissions Click Save Permissions to save all permission changes and apply current ACL. 48

57 Chapter 3. Helpdesk Specialist Role Remote External Computer Group Permissions List Permission User will be able to see the remote computer in the Hierarchical Grid. The user will be able to expand the group node in the Hierarchical Grid. Full Control Permission A user who has full control permissions will be given List permissions plus: The user will be able to create child groups. The user will be able to create invitations to add child remote computers to this group. The user will be able to move a remote computer from the group to another remote computers group. The user will be able to move a nested group from the group to another remote computers group. The user will be able to delete the remote computers group. Delegate Permission The user will have all List and Full Control permissions plus: The user will also have permission to List/Add/Remove/Modify ACL. 49

58 Administrator s Guide INSTALLING REMOTE SUPPORT CENTER CLIENTS TO REMOTE COMPUTERS RSC provides two clients that can be installed on a remote computer to enable it for management through RSC: ExpertAssist This client features the most powerful management functionality and can be installed on a remote computer via bulk deployment, pushed to a selected Active Directory computer, OU or domain, or via generated invitation. This client requires an RSC Enterprise license. InstantAssist This lightweight client enables a quick and easy on-demand management session of a remote computer. InstantAssist does not require installation and can be run on a remote side by simply double-clicking the downloaded file. This streamlined client enables a remote computer for management even if the remote user does not have administrative privileges on his computer. To use the Instant Assist client you need to have an InstantAssist license. Pushing the ExpertAssist to a Computer/Set of Computers ExpertAssist can be remotely pushed to a computer in Active Directory. There are two ways to remotely deploy ExpertAssist to a target computer or right to a number of them in a one pass. Using a Push Operation 1. Navigate to the computer or group with a number of computers using the Hierarchical Grid view. Use search or filtering when necessary. When pushing to a single computer: 2. In the Operation column click Push next to a computer name. 50

59 Chapter 3. Helpdesk Specialist Role Figure 33. Pushing ExpertAssist to a single computer from the Hierarchical Grid When pushing to a set of computers/groups: 3. Set the box next to each of the computers or/and Groups where ExpertAssist need to be installed. Click the Push selected computers link on top of the table displaying selected computers. 51

60 Administrator s Guide Figure 34. Pushing ExpertAssist to a set of computers 4. The rolling azure ring icon displayed next to each of the computers being pushed indicates push is in progress. During deployment, the Status column shows Installation in progress message for the each of the computers. Push from Remote Computer Properties Page 1. Navigate to the computer using the Hierarchical Grid view. Use search or filtering when necessary. 2. Click on the machine name in the Name column to open Remote Computer Properties page. 3. Click Push Remote Management Client Software. 4. The rolling azure ring icon indicates push in progress. During deployment, tooltip for the Push Remote Management Client Software link changes to Remote Management software push is in progress. Once the client is installed and registered with RSC, the remote computer status/tooltip will change to Available for management/remote Management software push is successful. At the same time Push in the Operation column will change to Manage or the Manage Remote Computer link will become active indicating that the remote computer is ready to be managed. 52

61 Chapter 3. Helpdesk Specialist Role If for some reason the push operation did not succeed, an error will be displayed in the Status column/push Remote Management Client Software link tooltip. RSC will also include description of the problems which prevented from push to complete. Figure 35. Pushing ExpertAssist from remote computer properties Note Please see additional information about the Remote Computer Properties page below. 53

62 Administrator s Guide REMOTE COMPUTER PROPERTIES The Remote Computer properties page displays various details about the remote computer. To open this page, locate the remote computer in the Hierarchical Grid and click its name in the Name column. Installing the ExpertAssist ExpertAssist can be installed by pushing the software down to the target computer or by sending the user an invitation. Push Push is used to automatically deploy the client software to the network machines that are members of Active Directory and located in the LAN. There is no user intervention needed on the target computer to complete the deployment. Note RPC service and Remote Registry need to be running on remote computer, in order for Push to go through. 54

63 Chapter 3. Helpdesk Specialist Role Warning Please make sure to have TPC port 139 and UDP port 137 opened on the remote computer to ensure successful push. Invite Remote Computer Click Invite Remote Computer to create an ExpertAssist installation package. You will be provided with a link to that package which will need to be provided to the interactive user at the remote computer. Once user gets the link, he will be need to follow simple steps outlined on Installation page to download and install ExpertAssist. Manage Remote Computer Click Manage Remote Computer to connect to the selected remote computer. This option is only available if the ExpertAssist is installed on the remote computer. RSC will confirm that the user has permission to access the remote computer and once validated, a new browser window will open. Note You must install Java Runtime Environment on the Helpdesk Computer to start managing a remote computer within the browser. More information on Java support can be found on Sun Microsystems ( web site. Remote Computer User Access Permissions The Remote Computer User Access Permissions tab defines the users or User groups that have permissions to manage remote computer. List will contain also users which permissions were inherited from parent Group/Domain. Only users listed in User Access Permission list or RSC administrators will be able to manage the computer. Add Select the User or Group and click Add. The selected User/Group will be added to the access control list (ACL) on the Users and Permissions tab. Click the cross sign on the dialog box to discard changes. Remove To remove one or more Users/Groups from the ACL, select each one to be removed by selecting the box in the left hand column. Once the Users/Groups are selected, click Remove. Save Permissions Click Save Permissions to save all permission changes and apply current ACL. Allow inheritable permissions from the parent to propagate to this object and all child objects 55

64 Administrator s Guide Set this box to allow this computer to inherit permissions from its parents. An internal remote computer will inherit its permissions from the parent Active Directory domain object such as OU or computer container. An external computer within a group will inherit its permissions from the remote computer group. This box is checked if the remote computer s ACL is inherited from its group. A user or group can be assigned with the three permissions: List, Full Control and Delegate. The following table summarizes what each of the permissions granted to the user or group will allow within the RSC Console. External Remote Computer Permissions Permissions The user that has this permission is List Full Control Delegate Able to see the remote computer in the Hierarchical Grid Able to create an invitation for a remote client. Able to modify the Manage Certificate tab settings. Able to manage the remote computer Able to Browse/Add/Remove/Mo dify remote computer s ACL Internal Remote Computer Permissions Able to see the remote computer in the Hierarchical Grid Able to push ExpertAssist to other remote computers Able to create an invitation for a remote client 56

65 Chapter 3. Helpdesk Specialist Role Able to modify the settings of the remote client Able to modify the Manage Certificate tab settings Able to modify the Remote Computer Configuration tab settings. Able to manage the remote internal computer Able to Browse/Add/Remove/Mo dify remote computer s ACL Figure 36. Available permissions in RSC Console Remote Computer Configuration This tab displays the Port used by ExpertAssist installed on a remote internal computer to listen for browser connections. Note This tab is available for internal remote computers only Manage Certificate RSC encrypts all the traffic to/from remote computer. Each installation of ExpertAssist contains client certificate. RSC uses that certificate to validate and authorize remote computers. If remote computer s certificate has been revoked or isn t recognized by RSC, helpdesk technician will not be able to manage it, until certificate will be updated. Figure 37. Managing client certificates issued to ExpertAssist 57

66 Administrator s Guide Revoke Remote Computer certificate To disallow a computer from accessing RSC the certificate must be revoked Generate & Download new certificate If the certificate on the Remote Computer expires or needs to be reinstalled, click Generate & Download new certificate. This option will create a new certificate file (cert.pfx). Download and send copy certificate to remote computer, install it using the Windows built-in Certificate Import Wizard. Installing the Certificate using IE After the certificate file (cert.pfx) is copied to the client computer that will be used to access the RSC Console, double click the file to import it. Click Next on the first two dialogs of the import wizard. On the Password page, enter the password given when the certificate was created. Click Next to continue. Accept all other defaults in the Certificate Import Wizard by clicking Next on each wizard page. Click Finish to complete the Import process. Download old certificate Select this option to recreate a copy of the certificate that is currently deployed on the remote computer. 58

67 Chapter 3. Helpdesk Specialist Role PUSHING THE EXPERTASSIST TO A COMPUTER OU ExpertAssist can be remotely pushed to a selected organizational unit (OU) containing a set of computers in Active Directory. To remotely deploy ExpertAssist to a chosen OU with target computers: 1. Navigate to the computer OU using the Hierarchical Grid view. Use search or filtering when necessary. 2. In the Operation column click Push next to the computer OU name. 3. To look for the push progress click OU name in the name column. This will open OU page listing all the computers that are members of the selected OU. 4. The rolling azure ring icon indicates push is in progress. During deployment, the Status column shows Installation in progress message for the computer. Wait until the push is finished. Figure 38. ExpertAssist push is in progress Once the client for a corresponding computer is installed and registered with RSC, the remote computer status will change to Available for management. At the same time Push in the Operation column will change to Manage, indicating that the remote host is ready for management. If for some reason the push operation did not succeed, an error will be displayed in the Status column. RSC will also include description of the problems which prevented from push to complete. 59

68 Administrator s Guide Figure 39. Pushing ExpertAssist to a computer OU 60

69 Chapter 3. Helpdesk Specialist Role PUSHING THE EXPERTASSIST TO A SET OF COMPUTER OUS OR CONTAINERS ExpertAssist can be remotely pushed to a selected set of computer organizational units (OUs) or containers in Active Directory. To remotely deploy ExpertAssist to a selected number of target OUs/containers: 1. Navigate to the computer OUs/containers using the hierarchical view tree. Use search or filtering when necessary. 2. Set the checkbox next to each of the computer OUs/containers that need to be pushed with ExpertAssist. 3. Click the Push to Selected computers link on top of the table displaying selected computer OUs/containers. 4. To look for the push progress for a particular OU/container, click that OU/container name in the name column. This will open OU/container page listing all the computers that are members of the selected OU/container. 5. The rolling azure ring icon displayed next to each of the computers in the selected OU/container indicates push is in progress. During deployment, the Status column shows Installation in progress message for the deployed computers. Wait until the push is finished. Figure 40. ExpertAssist push in progress for one of the OUs Once the client for a corresponding computer is installed and registered with RSC, the remote computer status will change to Available for management. At the same time Push in the Operation column will change to Manage, indicating that the remote host is ready for management. If for some reason the push operation did not succeed, an error will be displayed in the Status column. RSC will also include description of the problems which prevented from push to complete. 61

70 Administrator s Guide Figure 41. Pushing ExpertAssist to a number of computer OUs 62

71 Chapter 3. Helpdesk Specialist Role PREPARING EXPERTASSIST DEPLOYMENT PACKAGE ExpertAssist Deployment package is the most flexible mechanism to mass deploy the client. Use Desktop Authority or Group Policy Software Installation extension to define subset of computers where ExpertAssist will be installed. Once packages are deployed, the client will register with the RSC server, and will become available for management. Note ScriptLogic recommends that you try Desktop Authority for implementing granular ExpertAssist deployments. To create an ExpertAssist Deployment Package for mass deployment: 1. From the menu bar choose Settings and select ExpertAssist Deployment Package. 2. In the ExpertAssist Deployment Package window click Download to generate and download the distribution package with ExpertAssist. 3. In the File Download window click Save. Browse for the place to store the package and click Save. 4. Once the package is saved, click Close to close the ExpertAssist Installer window. Figure 42. Generating ExpertAssist deployment package You can now use the saved package to apply it to desired computers via Desktop Authority Distribution or Group Policy Software Installation extension. Warning If the File download window did not appear, check browser settings to see if file downloading is permitted. Tip If the browser has automatically refused downloading the file click the information yellow bar and select File Download Blocked Download File 63

72 Administrator s Guide INVITING REMOTE COMPUTER Inviting a remote computer allows an RSC administrator or helpdesk specialist to make this computer available for remote management through the Management Console when push operation cannot be performed. Administrators can send an invitation to users whose computer cannot be deployed with ExpertAssist right from the Management Console or via bulk deployments. Typically these are users using external remote computers located outside LAN network. Or it may be users of some LAN computers which are not part of the Active Directory infrastructure. Inviting Remote Computer for Management with ExpertAssist The Invite New Remote Computer page allows you specify the parameters needed for the RSC system to create an invitation that can be ed to the user of the remote computer. The created invitation will contain instructions on downloading and installing the RSC Client software on the external remote computer. Once this software is installed, the remote computer can be managed by a user authenticated in RSC system. To invite an external remote computer for management with RSC ExpertAssist: 1. Open the Invite New Remote Computer page From the menu bar choose Client Deployment and select ExpertAssist Client Alternatively, navigate the desired Remote Computer Group and click Invite on the table toolbar for the chosen group. Figure 43. Inviting a remote computer for management via ExpertAssist 64

73 Chapter 3. Helpdesk Specialist Role 2. On the Invite New Remote Computer page specify a name to distinguish the remote invitee in the hierarchical view tree. Note This can be any helpful name to help you locate invited computer in the future. This does not need to be exact name of the remote computer you are inviting. 3. In the Invitation Delivery section select either Invitation or Display Invitation Select invitation to and specify the remote user s address to automatically send the invitation by Select Display invitation to let the invitation URL be displayed right here. 4. [optional] Specify, in hours, for how long this invitation will stay valid. 5. [optional] Select a Remote Computer Group in the Hierarchical Grid to place the invited computer to. 6. Click Create Invitation. Figure 44. Specifying invite parameters for management via ExpertAssist 65

74 Administrator s Guide Remote Computer Name Enter a minimal computer description. Only alphabetic, numeric, underscore (_), and hyphen (-) characters are allowed. This description is required and will be used to reference the invited computer in the external remote computer tree. Invitation Delivery invitation to Choose this option if you want the system to send the user on the remote machine instructions on how to download and install the ExpertAssist once the unique invitation URL is created. Provide the address of the user at the external remote machine. Display invitation Choose this option if you do not need to the remote user instructions on downloading and installing the ExpertAssist. This will set RSC to display the created unique invitation URL to the screen. Advanced Settings (optional settings) Invitation is valid for Invitations remain valid for a specified time period (24 hours by RSC default). Enter the number of hours until the invitation will expire. Once an invitation expires, an external remote computer user will not be allowed to download the ExpertAssist. Remote Computer Group Add new Remote Computer to Adding the created invitation to an existing Remote Computer Group allows you store invitations within the RSC Management Console hierarchical tree in logical places. By default, when no custom Remote Computer Groups are created all invited computers are placed in a Default group. Invitation Details page Once Create Invitation is clicked, a confirmation of the invitation will be displayed showing the details for the created invite. 66

75 Chapter 3. Helpdesk Specialist Role INVITATION DETAILS Invitation If the Invitation option is selected during invitation creation, the following dialog will be displayed. Figure 45. Viewing generated invitation body The potential message body is displayed for confirmation. Click Edit to edit the text on the invitation. Click Send invitation to the invitation to the user. Edit Invitation Figure 46. Viewing generated invitation body 67

76 Administrator s Guide If the invitation text must be modified, take care to not remove the special blocks of text within the [ ]. These blocks are placeholders used by RSC to put real values generated for the particular invitation. These placeholders are: Placeholder [ID] Description Used to enter the unique download ID for the generated ExpertAssist invitation package. This unique ID should be used by a remote user when downloading the ExpertAssist package via download link. [LINK] [EXPIRATION_DATE] Used to enter the unique download link for downloading the ExpertAssist. Following this link, remote user can download the ExpertAssist without specifying the [ID]. The unique ID is already attached to the link making this link to automatically direct the user to the prepared ExpertAssist download. Used to put the expiration date for the download link. This date is set on Invite new computer page. Table 3. Using placeholders for customizing an invitation Once the text edits are complete, click Apply to save the changes and then Send invitation to send it. Click Cancel to abort the changes. Click Save & send invitation to save the text edits and immediately send the . Alternatively, just click Save & send invitation to immediately send the invitation message after saving the edited version. As the user receives the invitation, he or she will see the following in their Inbox Figure 47. Remote computer user receives invitation The RSC Console allows you to specify a custom value that will be displayed in the FROM field. Please see the Invitation Settings section on the Remote Support Center Status and Configuration page to configure that. Display Invitation If the Display Invitation option is selected during the invitation creation process, the following dialog will be displayed with the package information. 68

77 Chapter 3. Helpdesk Specialist Role Figure 48. Invitation URLs are being displayed for custom delivery The invitation page provides instructions for downloading the generated ExpertAssist client package. Users whose computers are located in LAN should typically download the ExpertAssist package by one of the links displayed in the first section. Those users, whose computers are on the internet, should download the package following either of the links listed in the corresponding section at the bottom of the page. Warning The bottom section for downloading ExpertAssist from the internet does not contain download links if your RSC installation is not licensed with optional Internet Gateway license. Please contact ScriptLogic Sales for purchasing the Internet Gateway license. Adding this license will enable support for working with internet users. The RSC helpdesk specialist or administrator should inform the remote user to provide him or her with the information on a displayed invitation necessary to invite their computer to RSC. Note At the bottom of the page you see the invitation expiration date. Please be sure to use the generated download URLs before this date. After this date the link will expire and you will have to create a new invitation for the user to be able to download ExpertAssist. 69

78 Administrator s Guide INVITING REMOTE COMPUTER FOR MANAGEMENT WITH INSTANTASSIST You can invite the remote user for a quick on-demand management session through a lightweight InstantAssist client. To implement this, an InstantAssist invitation should be created first. To invite an external remote computer for management with RSC ExpertAssist: 1. From the menu bar choose Client Deployment and select InstantAssist Client. 2. [optional] On the InstantAssist Invitation page opened copy provided URLs for downloading InstantAssist. This is necessary only if you will be sending the message with copied URLs using a standalone client. 3. [optional] In the Download Instructions section edit the message body to be sent to the remote user as desired or leave it as-is. 4. [optional] In the Send to edit box specify the address of the remote user to send the InstantAssist invitation automatically. Click Send to and RSC will mail the created invitation message to the remote user. Click Close to stop creating InstantAssist invitations. Figure 49. Sending invitation for management via InstantAssist As the user receives the invitation, he or she will see the following in their Inbox. 70

79 Chapter 3. Helpdesk Specialist Role Figure 50. Remote computer user receives InstantAssist invitation 71

80 Administrator s Guide Conclusion When you configured the deployment of RSC Clients to desired computers and/or sent your remote users with invitation messages, you can manage their computers any time you want by simply logging back into the RSC Console. Enter the Console, use your Hierarchical Grid refining its view using the built-in filtering, and access the remote computer in a single click by Should the remote user have any difficulties with installing clients by invitations, please guide him using the information provided in the Remote User guide. 72

81 Chapter 3. Helpdesk Specialist Role FREQUENTLY ASKED QUESTIONS In this section you will find answers to some frequently asked questions that are usually asked by helpdesk specialists Why do I see certificate error message when I try to connect to RSC Console? My browser reports that The security certificate presented by this website was issued for a different website s address. When you connect to RSC Console, your IIS server that hosts the RSC application returns its certificate. Your browser then validates certificate parameters. As a part of this validation procedure, it checks to see if the value of the Issued to field in the certificate matches the RSC Console URL address used to access the console. If your IIS sever certificate has been issued by your corporate Certification Authority (CA), the Issued to field has typically set to the DNS address of the IIS server. For example, your IIS server common name (CN) is amalthea and your corporate domain is astra.local, and the IIS server fully qualified domain name (FQDN) is astra.local. If the Issued to field of the IIS server certificate is set to FQDN amalthea.astra.local, you will not see any warnings when accessing the RSC Console by 73

82 Administrator s Guide However, if the Issued to field of the IIS server certificate is set to CN amalthea, you will see browser s error message when accessing the RSC Console by To workaround this warning, please try to access the RSC Console using the CN if possible. If the IIS server in your organization has a SSL certificate installed using RSC built-in CA during product installation, the Issued to field is set to CN of your IIS server. The browser will warn you about mismatched address if you try to access the RSC Console using the FQDN IIS server name in the URL. To workaround this warning, please try to access the RSC Console using the CN if possible. You may also see browser s warning message if the IIS server has a self-signed certificate generated by a third-party tool installed. To workaround this warning, please do the following. 1. Click Continue to this website (not recommended) in the browser. 74

83 Chapter 3. Helpdesk Specialist Role 2. Click Certificate Error button next to the Address bar and select View certificates. 3. In the Certificate dialog box, click Install Certificate. Please see the Installing the Certificate using IE section for more details on importing personal client certificate to your computer. Refer to KB article for more details on browser warnings. Q: I am accessing the RSC Console by the link and I get Access Denied. Your IP address instead of the login page. A: Please ask your RSC Administrator to check whether your IP has been allowed access to RSC Console on the Security Settings page. Additionally, please verify that you are not required to provide a client certificate when accessing the RSC Console. If the client certificate has been provided to you, please import it to your computer. Figure 51. You get access denied instead of the login page Q: I am accessing the RSC Console by the link and I get Access Denied. You do not have a client certificate instead of the login page. A: This security warning indicates that your RSC Administrator has restricted access to RSC from your IP address and required you to provide a personal client certificate before logging into RSC Console. Please make sure to obtain your client certificate from RSC Administrator and import it to your computer. Please see the Installing the Certificate using IE section for additional information. Figure 52. You get access denied instead of the login page 75

84 Administrator s Guide Q: I get the User does not have required permissions to login after I click Login on the login page. A: Please ask your RSC Administrator to check whether you have been granted access to RSC Console on the Users and Permissions tab. Figure 53. The RSC Console does not allow you to log in 76

85 Chapter 4 Remote User Role RESPONDING TO INVITATION When an invitation is created, a MSI package or executable is made available for downloading by a user. The MSI package consists of the ExpertAssist. The InstantAssist is downloaded as tiny executable. The user of the remote computer can be sent an telling them to access and download the package or the invitation can simply be displayed to the administrator creating the invitation. Regardless of how the user of the remote computer is made aware of the remote management client for download, it must be downloaded and installed so that RSC can manage the computer. RSC ExpertAssist Installation Respond to the invitation using the provided secure URL in the address bar of the browser. This URL will connect to the server which allows the download of the DA Remote Management package. Enter the provided Package ID, if necessary, and click Install. This will download and automatically install the ExpertAssist to your computer. Figure 54. Automatically Installing ExpertAssist to your computer

86 Administrator s Guide Warning If you are using Internet Explorer 7/8 you may be asked to install the Desktop Authority Remote Management Binary addon. This ActiveX component is necessary to proceed with automatic ExpertAssist installation. Please, allow this component to install and run on your computer. Figure 55. Internet Explorer information bar asking for permission to install the addon Right-click the information bar and select Install This Add-on for All Users on This Computer. Click Install in the Security Warning message box. Figure 56. Installing addon Once the Package ID is verified, the Remote Management Client will be downloaded and automatically installed to the remote computer. No user interaction is necessary. Warning When installing ExpertAssist make sure you are running the web browser with administrative privileges. Warning On Vista/Windows Server 2008 systems make sure to run the web browser with elevated privileges. Manually installing the DA Remote Management Package If, for some reason, the package cannot be automatically installed, click the Download link to download the installation files to your computer for manual installation. 78

87 Chapter 4. Remote User Role Figure 57. Downloading ExpertAssist MSI for manual installation Figure 58. Saving downloaded ExpertAssist package for manual setup Click Save. The package RSCClient.exe will be saved to the target destination. When download is complete, run the downloaded ExpertAssist setup package. Alternatively, click Run to launch the client installation process immediately. When beginning the installation process, the following dialog will be displayed to the user. Click Run to start the installation program. Figure 59. Starting ExpertAssist setup 79

88 Administrator s Guide The first dialog is Welcome to the ExpertAssist Installation dialog. Click Next to continue and install the ExpertAssist client on your computer. Click Cancel to quit. Warning During the client installation, the screen may become blank for a few seconds. This is normal and is a necessary part of client installation procedure. Once all files are successfully installed, click Close to complete the installation of the ExpertAssist. The ExpertAssist icon will be displayed in the system tray. 80

89 Chapter 4. Remote User Role INSTALL REMOTE COMPUTER CERTIFICATE The ExpertAssist software automatically installs a client certificate so that the Remote Computer can communicate with RSC. There may be times when either this certificate expires or needs to be reinstalled. A new certificate can be generated by an Administrator within the RSC Console. Once the client certificate is generated and moved to the Remote Computer it must be installed. Changing the Remote Computer certificate Once the ExpertAssist setup package is generated from the RSC Console, is it automatically includes the client certificate. If necessary it can be installed by the ExpertAssist client software. 1. Right-click on the ExpertAssist icon ( ) in the taskbar notification area. 2. Select Configure Client from the popup menu. The Client Configuration dialog will appear. 3. Click Browse. Locate and select the certificate file. The file and location will be updated in the Client Certificate edit box. Warning It is highly recommended that you manage certificates for ExpertAssist client software right from the RSC Console. Please re-push/re-install the ExpertAssist from the Console if you want to apply a new certificate to the client. InstantAssist Installation Respond to the invitation using the provided secure URL in the address bar of the browser. This URL will connect to the server which allows the download of the InstantAssist package. Once connected to the RSC server, the web browser will automatically offer you download or run the InstantAssist. Figure 60. Saving InstantAssist to your computer 81

90 Administrator s Guide Click Save. The executable RSCIA.exe will be saved to the target destination. When download is complete, run the downloaded ExpertAssist executable. Alternatively, click Run to launch the client immediately. When beginning the installation process, the following dialog will be displayed to the user. Click Run to start the installation program. Figure 61. Starting InstantAssist client Once the client has extracted necessary system files packed within the executable, it will immediately launch on your desktop. When started the small InstantAssist window will appear in the down right corner of your screen right top of the taskbar notification area. Figure 62. InstantAssist client has started and ready for management Started, the InstantAssist is ready for external connections. It notifies the RSC about its presence online and becomes available for management through the RSC Console. Any RSC administrator/helpdesk specialist can now securely connect to your desktop from the RSC. By default, the InstantAssist starts in protected mode. This mode allows the caller (the one who has started management from the Console) to only monitor your actions. This guarantees no one will be able to use your data, change your settings, move your windows, and interfere with your work until permitted by you. Click the Share control button to allow the caller direct management access to your desktop granting him with privileges to control your desktop and perform actions remotely. Warning When working on Windows Vista/Server 2008, please ensure to run the InstantAssist executable with elevated privileges if you want to the remote administrator be able to remotely control elevated applications (like command prompt) running on your desktop. 82