25: How-to gain access of a remote computer using built-in Windows Remote Assistance application?

Enable remote computers to accept the incoming remote connection with PolicyPak's pre-configured PAK for Microsoft Remote Settings. 

Setting up a GPO to allow remote assistance using PolicyPak Application Manager.

In these steps, we will show steps for IT Administrators so they can Enable Remote Assistance for end-users computers.

1. Launch Group Policy Management Console.

2. Right-click on a required OU and Create a new GPO.

   

3. Give the GPO a descriptive Name then click the OK button.

   

4. Right-click on the new GPO you just created, and select Edit option.

   

5. Expand the PolicyPak node under Computer Configuration and select the pre-configured PAK named “PolicyPak for Microsoft Windows 7 and Later for System Properties”

   

6. Right-click on the PAK entry and select the Properties option.

   

7. Select the Remote tab, and select the checkbox “Allow Remote Assistance connections to this computer” and then click the OK button.
   Note: Make sure that the selection is underlined as shown in the screenshot.

   

8. Lastly, run GPUPDATE on end-users computers to apply the policy immediately, or wait for the policy to apply during the normal group policy refresh interval.

Additional Recommendations: Use PolicyPak Scripts Manager and create two additional computer side policy items.

1. Set Firewall to Allow Remote Assistance:

Using PolicyPak Scripts Manager you can execute the following script to open a Firewall for incoming remote assistance connections.

•     netsh advfirewall firewall set rule group="remote assistance" new enable=Yes

2. Proactively address possible issue with MSRA.EXE and PPAppLockdr64.dll:

Using PolicyPak Scripts Manager you can execute the following script to configure custom Exploit Protection settings for Microsoft Remote Assistance (MSRA.EXE).

•     Set-ProcessMitigation -Name msra.exe -Enable DisableExtensionPoints.
  
  You can create two separate policy items:

  

  Or you can combine both policies in one if you prefer:

For more information on PolicyPak Scripts Manager please consult the below reference articles.

Reference Article: 

• https://kb.policypak.com/kb/article/797-why-does-windows-remote-assistance-msra-report-%E2%80%9Cppapplockdr64-dll-is-not-designed-to-run-on-windows-or-it-contains-an-error%E2%80%9D-0xc000428/
• https://kb.policypak.com/kb/article/652-deploy-any-script-via-the-cloud-to-domain-joined-and-non-domain-joined-machines/