VNC Connect security whitepaper VNC Connect Instant support FAQs September 2017
Contents General FAQs... 3 Technician and end user FAQs... 5 Administration and audit FAQs... 7
General FAQs Note: For more information on subscriptions, accounts and teams, please see our current VNC Connect FAQ at https://www.realvnc.com/en/connect/docs/faq/. What is instant support? Instant support is a new capability for VNC Connect Professional and Enterprise subscriptions. It represents a new way of connecting to remote computers that do not, or cannot, have remote access software installed. It complements device access, our current VNC Connect capability for computers that can. You can enable instant support as part of your existing VNC Connect subscription. You can then provide technical support to customers, employees or suppliers on demand, without provisioning remote computers in advance, requiring installation privileges, giving out your subscription details, or requiring end users to perform complex set up operations. And once sessions are complete, there s no software footprint left on those computers. Note: Instant support and device access are for different environments, requirements and use cases, though note that, once connected, the intuitive, responsive screen sharing experience is the same. They are not separate products or modules; you have a single product (VNC Connect), and a single subscription (Professional or Enterprise), just with multiple built-in capabilities that you can use in the way that best suits you. There are a few caveats for instant support: You can only establish cloud connections, not direct connections, so technicians and end users must both be connected to the Internet, even if on the same company LAN. The end user must be present at the remote computer. Unattended access is not possible. Only one technician can control an end user s computer at a time. It s not possible for a supervisor to connect in and monitor a live session. If you need regular, direct or unattended access to particular computers, you should install VNC Connect on those computers, and continue to provide device access. Which platforms are available? We re working to bring platform support for instant support in line with device access. In the meantime: You can support end users with desktop computers running Windows 7 or later and macos 10.10 or later. Linux platforms to follow soon. Technicians can connect from VNC Viewer running on modern Windows, macos and Linux desktop computers. Mobile platforms to follow soon. How do I license (enable) instant support? Simply choose the number of technicians you need to meet expected demand for ad hoc technical support at the time you purchase a VNC Connect subscription. If you already have a VNC Connect subscription, there s no need to buy another one. You can add technicians to it at any time. 3
How do technicians and end users get connected? We take care of connecting technicians and end users wherever they are in the world, using our secure, reliable cloud service. There s no need to open any ports or perform complex firewall or router reconfiguration. Note: Once connections are brokered, where possible, we establish peer-to-peer connections between endpoints in order to improve performance and so session data isn t routed via our servers. If this is not possible, however, we relay the entire session to ensure you get and stay connected (don t worry, session data is encrypted end-to-end). Note that: Both technicians and end users must be connected to the Internet. Both endpoints must be able to communicate with the RealVNC cloud service. You can check the status of our cloud service at https://realvnc.statuspage.io/. Do I need to install and license any software? No. There s no setup required on a remote computer in advance, and no complex or privileged operations for an end user to perform. All an end user has to do is download and run a small, disposable app on demand. Once the session is over, the end user can safely delete the download file, leaving no footprint. For your technicians, all you need do is provision their desktop computers with VNC Viewer, which does not require a license. How do I set up my team and get started? Once you ve enabled instant support for your VNC Connect subscription: 1. Navigate to the People page of your RealVNC account. 2. Invite people in to your team. 3. Assign those team members to be technicians. Each technician must then download VNC Viewer to their desktop computer and can initiate sessions when ready. By design, there s nothing to provision or set up on the end user s computer in advance. 4
Technician and end user FAQs How does a technician start a session? A technician must: 1. Sign in to VNC Viewer using their own RealVNC account credentials (created when accepting your team invitation). 2. Click the Instant support session button in the VNC Viewer menu bar All subsequent instructions are displayed in-app. In summary, the technician: Instructs the end user to navigate to a web site, download a disposable app, and run it. Gives the end user a 9 digit code unique to the session. Waits for the end user to enter the code, upon which the session starts automatically. Note that an out-of-band communication channel is assumed; there s no mechanism built-in to VNC Viewer to transmit instructions, codes or URLs from technicians to end users. A Technician s Guide will be available soon. What does an end user have to do? Very little! By design, there s no software to install or complex operations to perform. Your technician must instruct an end user to: 1. Navigate to the download site (so the end user requires a browser and a working Internet connection). 2. Download the appropriate disposable app for their platform (Mac or Windows in this release) 3. Double-click the download file to run the app. 4. Enter the 9 digit session code when prompted. 5. Acknowledge the privacy warning. Once connected, technician and end user share control of the keyboard and mouse. The end user can stop the session at any time using the always-visible End Session button. The technician cannot reconnect. Can a technician perform administrative operations? Yes, once elevated. This is especially relevant when controlling Windows computers. By default, the technician connects as a standard user, which means that as soon as the Windows UAC prompt is shown, or a privileged application runs, the technician loses the ability to control the screen. The end user must acknowledge UAC prompts on the technician s behalf in order that s/he may continue. A technician can elevate a session by clicking the Elevate button on the VNC Viewer in-session toolbar, and then: Requesting that the user enters their own administrative credentials (if they have them). Entering their own system administrative credentials, in a scenario where the technician has a user account on the remote computer. 5
Subsequently, the technician is granted administrative permissions, can interact with privileged applications, and the end user is not required to acknowledge UAC prompts by proxy. Note if the technician intends to lock or log out the current user, or reboot the remote computer, it s particularly important to elevate first. Can an end user stop a session? Yes. The end user retains the ability to control the keyboard and mouse while a session is in progress, and can click the always-available End Session button at any time. The technician cannot reconnect in this circumstance. How should a technician reboot a remote computer? It s best to instruct the technician to click the Reboot button on the VNC Viewer in-session toolbar. This will elevate the technician if not already, which means the session can seamlessly resume on reboot. If the technician uses the standard desktop facility on the remote computer to reboot, then the session is unlikely to resume. How should a technician log out or lock a remote computer? It s best to instruct the technician to click the Elevate button on the VNC Viewer in-session toolbar. This will elevate the technician if not already, which means the session can seamlessly resume on unlock or log back in. If the technician uses the standard desktop facility on the remote computer to perform either operation, then the session may not resume correctly, especially on Windows computers. Can a technician transfer files? Yes, in either direction. The end user cannot see file transfer operations being performed, but is notified they are happening. Instruct the technician to click the Transfer files button on the VNC Viewer in-session toolbar. The Remote file browser dialog opens. The technician can upload files and folders to the remote computer, or download files and folders from it. Can the technician and end user chat, or leave a message? Yes. Either actor can send a (text only) message at any time. Note that the technician sees two chat interfaces; their own, and the end user s on the remote desktop, so they need to enter their message in the right box! The end user s chat dialog stays visible after the session ends, so the technician can leave a message for the end user if s/he is not present at that time. The end user can also review the activity log after the session completes. 6
What happens if the session is interrupted? If either technician or end user end a session deliberately (by closing their application window, or clicking the End Session button), then the session cannot resume. The technician must start over with a new code. If the technician reboots the computer in the recommended way, the session should seamlessly resume. We make a best effort to recover from transient network errors. By default, VNC Viewer will attempt to reconnect for approximately 20 minutes before terminating. Administration and audit FAQs Can I monitor a session in progress? No. Only the technician who starts a session can control the end user s computer. No other technician or supervisor can connect in at the same time. Every session is logged and a session history stored online. If you have an Enterprise subscription, you can drill down into a completed session to review a detailed activity log. How do I see a history of completed sessions? Sign in to your RealVNC account and navigate to the Sessions page. By default, all sessions completed in the last 7 days are listed, most recent first. Use the filters to see previous sessions. If you have an Enterprise subscription, you can drill down you into a particular session to review a detailed activity log. Can a technician see a history of their own sessions? Yes. Instruct a technician to sign in to their personal RealVNC account and navigate to the Sessions page. By default, a technician cannot see sessions conducted by other technicians. If you need to make this possible, promote that technician to be an Admin or a Manager on the People page of your account. What session events are logged for audit purposes? Every session is logged and a session history stored online. If you have an Enterprise subscription, you can drill down on the Sessions page of your RealVNC account and review a detailed activity log for a particular session. The following activity is recorded: Session start and end times (and duration) File transfer operations Elevation requests Reboot requests Chat messages 7
Can I customize the branding for the end user? Yes, once you have purchased an Enterprise subscription. Note: Branding is not available during an Enterprise trial. Please contact Sales if you would like to discuss this. You can specify a company name, brand logo, and app icon on the Branding page of your RealVNC account. These appear: On the web site visited by the end user to download the disposable app In the disposable app itself You can also choose a slug for the download web site so that your identity appears in the URL, for example realvnc.help/acme. Please note customized download sites and apps take approximately 24 hours to go live. If you have any further questions, please contact us at enquiries@realvnc.com. 8
RealVNC s remote access and management software is used by hundreds of millions of people worldwide in every sector of industry, government and education. Our software helps organizations cut costs and improve the quality of supporting remote computers and applications. RealVNC is the original developer of VNC remote access software and supports an unrivalled mix of desktop and mobile platforms. Using our software SDKs, third-party technology companies also embed remote access technology direct into their products through OEM agreements. Copyright RealVNC Limited 2016. RealVNC and VNC are trademarks of RealVNC Limited and are protected by trademark registrations and/or pending trademark applications in the European Union, United States of America and other jurisdictions. Other trademarks are the property of their respective owners. Protected by UK patents 2481870, 2491657; US patents 8760366, 9137657; EU patent 2652951. www.realvnc.com