Remote Support Center 2.5. Administrator's Guide

Transcription

1 Remote Support Center 2.5 Administrator's Guide

2 Copyright ScriptLogic Corporation and its licensors. All Rights Reserved. Protected by U.S. Patents 6,871,221; 7,293,087; 7,353,262 and 7,469,278 with other patents pending. Portions Copyright (c) 2011, The Board of Trustees of the University of Illinois. Refer to for third party license and copyright information. This publication is protected by copyright and all rights are reserved by ScriptLogic Corporation. It may not, in whole or part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machinereadable form without prior consent, in writing, from ScriptLogic Corporation. This publication supports Remote Support Center (RSC), InstantAssist and ExpertAssist. It is possible that it may contain technical or typographical errors. ScriptLogic Corporation provides this publication as is, without warranty of any kind, either expressed or implied. ScriptLogic Corporation 6000 Broken Sound Parkway NW Boca Raton, Florida Trademark Acknowledgements: Remote Support Center, InstantAssist, ExpertAssist, ScriptLogic and the ScriptLogic logo are either registered trademarks or trademarks of ScriptLogic Corporation in the United States and/or other countries. The names of other companies and products mentioned herein may be the trademarks of their respective owners.

3 DOCUMENTATION CONVENTIONS Typeface Conventions Bold Indicates a button, menu selection, tab, dialog box title, text to type, selections from drop-down lists, or prompts on a dialog box. CONTACTING SCRIPTLOGIC ScriptLogic may be contacted about any questions, problems or concerns you might have at: ScriptLogic Corporation 6000 Broken Sound Parkway NW Boca Raton, Florida Sales and General Inquiries Technical Support Fax SCRIPTLOGIC ON THE WEB ScriptLogic can be found on the web at Our web site offers customers a variety of information: Download product updates, patches and/or evaluation products. Locate product information and technical details. Find out about Product Pricing. Search the Knowledge Base for Technical Notes containing an extensive collection of technical articles, troubleshooting tips and white papers. Search Frequently Asked Questions, for the answers to the most common nontechnical issues. Participate in Discussion Forums to discuss problems or ideas with other users. iii

4 RSC Administrator s Guide Table of Contents OVERVIEW... VI CHAPTER 1 REMOTE SUPPORT CENTER BASICS... 1 RSC User Roles... 2 RSC Concepts... 2 Remote Support Center Components... 3 Security Measures... 6 RSC Components Default Port Usage... 7 GETTING STARTED CHAPTER 2 USING THE RSC MANAGEMENT CONSOLE DISPLAYING THE REMOTE SUPPORT CENTER ENVIRONMENT Using the Active Directory Node Using the Remote Computer Groups Node Using the InstantAssist Clients Node Using the Error Log Node Using the Grid and its Fields Using the Grid Toolbar Buttons LOCATING THE DESIRED MACHINE/CONTAINER USING THE REMOTE COMPUTER PROPERTIES PAGE Remote Computer Info The Error Log Tab SEARCHING ACROSS YOUR RSC ENVIRONMENT ORGANIZING INTO THE FAVORITES CONTAINER CHAPTER 3 RSC ADMINISTRATOR ROLE Initial RSC Console Startup GRANTING REMOTE ACCESS TO RSC CONSOLE Defining IP Filter Rules and Designating RSC Administrators Defining IP Filter Rules Designating RSC Administrators Granting User Access Permissions to RSC Helpdesk Specialists Viewing user access permissions Permissions description Setting user access permissions to an Active Directory domain or group within Remote Computer Groups Setting user access permissions to a specific organizational unit(s)/remote computer subgroup(s) Setting user access permissions on specific computer(s) Disallowing RSC Helpdesk Specialists to view/push to certain objects within the domain/ou or (sub)group he/she has permissions on Removing/Modifying user access permissions Defining the Active Directory Groups Permissions Connecting to the RSC Console Remotely USING THE APPLICATION STATUS PAGE USING THE APPLICATION CONFIGURATION PAGE Configuring the Invitation Settings Setting the Administrator Account RSC LICENSING Adding InstantAssist Technicians Applying New Licenses Using RSC License Manager USING AN EXPERTASSIST DEPLOYMENT PACKAGE iv

5 RSC Administrator s Guide BLOCKING/UNBLOCKING INSTANTASSIST CLIENT COMPUTERS CHAPTER 4 RSC HELPDESK SPECIALIST ROLE Before You Begin Logging into RSC Console SETTING/MODIFYING USER ACCESS PERMISSIONS BLOCKING/UNBLOCKING INSTANTASSIST CLIENT COMPUTERS INSTALLING REMOTE SUPPORT CENTER CLIENTS TO REMOTE COMPUTERS Pushing ExpertAssist Client to a Remote Computer To push ExpertAssist Client to computer(s) or a domain: Inviting Remote Computer(s) for Management with ExpertAssist Editing the Invitation Confirming the Displayed Invitation Regenerating Invitations Centralized Uninstallation of ExpertAssist Client(s) Deploying Remote Computer with InstantAssist MANAGING REMOTE COMPUTER VIA EXPERTASSIST MANAGING REMOTE COMPUTER VIA INSTANTASSIST Remote Desktop File Upload CHAPTER 5 RSC REMOTE USER ROLE ExpertAssist Installation Manually Installing the ExpertAssist Package InstantAssist Installation APPENDIX FOR HDA USERS Before you Begin TROUBLESHOOTING Login failures EA Client Installation Errors EA Client Uninstallation Errors RSC Console Errors INDEX v

6 Overview Welcome to the Remote Support Center Administrator s Guide. This guide will walk you through the product configuration steps and show you how to use it best based on your role. It provides all the necessary information to administer and configure a strong and secure RSC environment. This guide also outlines every feature that you may use when working with RSC environment, maintaining your remote management business workflow and remotely managing computers. Remote Support Center (RSC) is a comprehensive system designed to enable network administrators to remotely manage and control computers regardless of their location. ScriptLogic engineered RSC to allow you to remotely connect to any Microsoft Windows-based computer be it in the LAN, WAN, or any external network supporting TCP/IP. The administrator does not have to worry about direct access to a remote computer from their current location. Once configured, the management product automatically takes the responsibility of routing your requests to a remote computer creating an experience of working on the remote computer interactively. Once logged into RSC, the administrator can remotely connect to a desired computer. RSC allows you to gain access to many of the helpful Remote Support Center Client tools such as desktop remote-control, file transfer protocol (FTP) for downloading and uploading files, configuration of the remote computer, remote-to-local printing, advanced scripting, and dozens of other features. All communications are encrypted and all hosts are authenticated using x.509 digital certificates to ensure a secure environment for all remote management operations. Using this technology, an administrator is able to assist users wherever they may be. vi

7 Who Should Read This Guide This guide is intended for Windows network administrators of small to enterprise sized businesses who are responsible for: Configuring Remote Support Center in the enterprise Defining RSC Helpdesk Administrators and other users that should be granted access to RSC Setting the security area surface throughout RSC Because of the broad use of remote management functionality implemented within this product, this guide is also aimed at helpdesk administrators. These users are responsible for: Managing remote computers Organizing management facilities Taking care of end-users, guiding them through and preparing for remote management Note ScriptLogic provides a companion Remote Support Center Installation Guide containing information about deploying this product. Please refer to this guide to find out more about installation aspects, available management models, and reconfiguring deployment for your current needs. In addition, this guide can be useful for professionals who are evaluating the product or analyzing the business use of introducing a scalable remote management workflow into their organization. vii

8 Document Summary This document comprises several chapters, each discussing the steps necessary to estimate, plan, understand, and implement Remote Support Center. Chapter 1, The Remote Support Center Basics. This chapter quickly outlines the main concepts of Remote Support Center allowing you evaluate its features and understand how you may best use it for your needs. It explains how the product works and why you can do things with Remote Support Center. We show you why Remote Support Center allows you to correctly manage your computers when and where you need it. We also explain how this solution protects your data and communications by organizing secure channel between you and the remote computer you are managing. Chapter 2, Using RSC Management Console. Use the chapter to familiarize yourself with the RSC environment. Chapter 3, RSC Administrator Role. This chapter discusses the role of a typical RSC administrator who will be organizing and configuring Remote Support Center. Chapter 4, RSC Helpdesk Specialist Role. Users who will be using Remote Support Center to support their users will find this chapter useful. This chapter dives into the details of the powerful management features implemented in RSC allowing you reach a desired remote computer right from within the browser. Chapter 5, RSC Remote User Role. This chapter discusses working with the product on the remote side, explaining how a remote user can allow the administrator or helpdesk specialist reach his computer and help resolve his problems in real time. Appendix comprises of the For HDA Users and Troubleshooting subsections. The quick reference info for the Help Desk Authority users of RSC is contained in For HDA Users. The Troubleshooting will help you solve the issues an RSC novice may happen to face. viii

9 Chapter 1 Remote Support Center Basics This section introduces terms and concepts used within RSC and throughout RSC documentation. The introductory section also describes the components that comprise the RSC system and ensure secure intercommunication inside the system. The chapter includes the following topics: The Remote Support Center User Roles and Concepts Remote Support Center Architecture 1

10 Chapter 1 Remote Support Center Basics REMOTE SUPPORT CENTER USER ROLES AND CONCEPTS The following notions grouped into RSC user roles and RSC concepts - are essential for you to get started with Remote Support Center. RSC User Roles With respect to administering RSC, or managing remote computers via RSC, etc., the following general categories of users are defined within RSC. RSC Administrator is a user of Remote Support Center who is able to configure and manage the RSC Management Console and configure the users (RSC Helpdesk Specialists) who have access to it. The RSC Administrator can also perform remote management tasks. (See Chapter 3 RSC Administrator Role for the whole list of RSC Administrator-specific tasks.) RSC Helpdesk Specialist is a user of Remote Support Center who is typically responsible for managing target computers. (See Chapter 4 RSC Helpdesk Specialist Role for the whole list of RSC Helpdesk Specialist-specific tasks.) RSC User implies both the RSC Administrator and RSC Helpdesk Specialist users. RSC Remote User is the user of the target computer who in some use cases is responsible for downloading/installing and running RSC Clients. (See Chapter 5 RSC Remote User Role for the whole list of RSC Remote User-specific tasks.) RSC Concepts The following are terms and concepts used throughout the RSC graphical user interface and the RSC documentation. RSC Server is the corporate LAN server where the Remote Support Center software is installed to and running. DMZ Server - is a server within the perimeter network that is exposed to both internal and external networks. RSC Management Console (RSC Console) is a web application component that implements both the RSC system s main part and graphical user interface. It runs on IIS, communicates with other system components and provides for performing all the configuration and management operations. RSC User s Browser (Browser) is the Internet Explorer browser enabled with Java Runtime Environment used to connect to RSC Console. EA Client/IA Client (RSC Client) RSC client software application (ExpertAssist EA Client, InstantAssist IA Client) that is required to be installed on the remote computer to administer it remotely. EA Client Computer/IA Client Computer (RSC Client Computer) is the computer deployed with RSC Client and ready to be managed via RSC. 2

11 Chapter 1 Remote Support Center Basics REMOTE SUPPORT CENTER ARCHITECTURE Remote Support Center (RSC) is a comprehensive client-server system designed to enable designated network administrators and helpdesk specialists manage and control any Microsoft Windows-based remote computers installed with RSC client software regardless of the computers location. Designated network administrators and helpdesk specialists implement the remote computer administration by connecting to the RSC Console from Windows Internet Explorer web browser running Java Runtime Environment (JRE). The browser can reside in any network. All RSC system component communications run via HTTPS secure channel and is additionally protected with x.509 self-signed SSL certificates. Remote Support Center Components Various components work together to comprise the RSC system. Server components work independently on separate servers and automatically stay connected to the system core which manages inter-system communications. The RSC system is comprised of the following components: RSC Management Console RSC LAN Gateway RSC Client(s): ExpertAssist (EA) Client and InstantAssist (IA) Client RSC Deployment Service RSC Maintenance Service RSC Internet Gateway (installs optionally) The RSC Management Console (RSC Console) implements both the RSC system s main component and graphical user interface. This component resides in the corporate LAN on a dedicated LAN server (RSC Server) and runs on IIS. It communicates with other system components and provides for performing all the configuration and management operations. All configuration and security data created by RSC Users during their work with the system is stored on a dedicated SQL Server. The RSC Management Console implements the RSC integration process on the Windows domain. When RSC Users log into RSC, the Management Console authenticates them within the Active Directory domain, automatically validating the provided credentials. This tight integration with Active Directory helps to protect RSC from unauthorized logons. It also allows the RSC User to always have the latest information about the domain computers thus allowing them to instantly reach any of the computers in the domain, even ones that are newly joined to the domain. To implement a working process that is independent from the network type, all of the data channeled within the system is routed by dedicated RSC LANs and RSC Internet Gateways. Each Gateway runs according to its dedicated location. The RSC LAN Gateway runs on the RSC Server and routes traffic from: 3

12 Chapter 1 Remote Support Center Basics RSC Clients installed on remote LAN/WAN workstations and servers to the RSC Management Console (provided that RSC Server is not shielded from the Internet in accordance with corporate standards and can freely accept connections from RSC Clients in the WAN); The RSC Internet Gateway that gathers information from the RSC Clients and RSC User s Browsers in the WAN to the RSC Management Console; The RSC Management Console to Active Directory when RSC queries for information from directory services. The RSC Internet Gateway enables access to the RSC Server that prohibits inbound connections from the Internet according to corporate security policies. RSC Internet Gateway is installed on a DMZ Server at any time after the main setup to implement the Global Model. (See the Remote Support Center 2.5 Installation Guide for RSC Internet Gateway installation and Global Model details.) RSC Internet Gateway routes traffic from: RSC User s browsers in the WAN to the RSC LAN Gateway; RSC Clients installed on remote WAN workstations and servers to the RSC LAN Gateway; RSC LAN Gateway to RSC Clients and RSC User s browsers in the WAN. Summarizing, this Gateway allows both the RSC Client Computers available for management and RSC user s browsers querying for management to communicate with RSC without having a direct inbound access to the LAN. This saves a network administrator from exposing his or her LAN to external network. Inbound network traffic is generally blocked by corporate and private firewalls. Likewise, NAT devices shield the non-routable private IP addresses of computers in corporate and private networks from the external public networks. ScriptLogic RSC enables remote administration in these environments by deploying a RSC LAN Gateway component and setting up a companion RSC Internet Gateway component in the DMZ. This component allows external and internal computers to become visible within RSC through the corporate firewall. RSC provides this level of one-way transparency without forcing the enterprise administrator to open holes in the firewall. This eliminates risks of opening sensitive corporate resources that should be protected from unwanted access and external networks. When there are many management sessions initiated from either LAN or WAN, the RSC LAN Gateway will also handle most of the load. The RSC Client is either the ExpertAssist or InstantAssist client software that installs on remote computers to implement remote management. The Clients differ in functionality and the need for the Remote User intervention. Instant Assist Clients also require obtaining a special license. ExpertAssist features the most powerful management functionality and can be installed on a remote computer via bulk deployment, pushed to a selected Active Directory computer(s), organizational unit or domain, or via a generated invitation. InstantAssist is a lightweight client that enables a quick and easy on-demand management session of a remote computer. InstantAssist does not require installation 4

13 Chapter 1 Remote Support Center Basics and can be run on the remote side by simply double-clicking the downloaded file. This streamlined client enables a remote computer for management even if the RSC User does not have administrative privileges on this computer. Installed on a remote computer, these software programs enable the computer for anywhere management via RSC. The client software automatically makes RSC aware of the computer availability as soon as it reaches one of the RSC Gateways (LAN or RSC Internet Gateways). This approach mitigates roaming problems allowing the remote computer to easily notify RSC about its presence regardless of its current location. Thus, the RSC Client automatically keeps track of the connection with RSC Gateways thereby making management tolerant to network changes. The RSC Client running on a remote user s computer will automatically restore the connection to RSC once the user is able to join the WAN that has access to a particular RSC Gateway. Once connected to an RSC Gateway, the RSC Client will immediately become visible to the RSC Management Console and display the remote computer status in the RSC Management Console The RSC Deployment Service provides functionality for push - rapid EA Client installation on computers within the Active Directory domain. These quick installations allow an RSC User to provision a desired computer, a set of selected computers, a computer organizational unit, a whole domain or Active Directory forest with EA Client in a single click. Once configured by the RSC Administrator, the EA Client can be automatically pushed by an RSC User directly from the browser without the need to drill into the peculiarities of particular domain configurations. The RSC Maintenance Service is a vital service for the RSC Administrator Account used to authorize any remote installation ( push ) or management ( manage ) operations (when the latter runs under the account of RSC Administrator or RSC Helpdesk Specialist with the Full Control permission) initiated from within the RSC Console on an Active Directory computer. The service validates the Administrator account credentials and then applies them to the RSC system, if the Administrator account is modified via RSC Management Console. Here is how the product workflow conceptual schema looks like. 5

14 Chapter 1 Remote Support Center Basics RSC workflow general conceptual schema Security Measures A multi-tier security model is used to provide for strong protection and security control across all of the RSC components and all of the computers involved in the management process. In general, it can be split into two levels of security, based on the entity it is applied to: Computer RSC User The computer security level applies security policies and filters to a computer object. This enables RSC to verify a particular computer that is trying to connect to RSC against the security settings specified by RSC administrator. By default, the RSC Management Console is granted access only by the RSC Server loopback IP address. All other IP addresses used to connect to RSC Console should be explicitly granted access by IP address within RSC. Configuration rights are also bound to IP addresses. This enables RSC to automatically block unwanted access and exclude accidental or unauthorized configuration in the RSC Management Console. Meanwhile, IP addresses from which the browsers are started do not require any software to be installed. They may access RSC and perform remote administration of RSC Clients from any Java-enabled web browser. The RSC user security level checks to verify the user that is attempting to authenticate within RSC against the security policies for a user defined in RSC. All RSC users are verified upon their login against Active Directory of the RSC Server. By default, only the domain users having interactive access to the RSC Server are 6

15 Chapter 1 Remote Support Center Basics granted login capability to RSC. Even though a user is able to read the RSC Server via a network connection, they will not be able to log into the RSC Management Console unless specific permission is granted within RSC. RSC features a sophisticated permission management handling system that guarantees nobody is able to push the RSC Client unless permitted within the RSC Management Console. The permissions can be configured by a designated RSC User. (See Granting User Access Permissions to RSC Helpdesk Specialists, Defining the Active Directory Groups Permissions, Setting/Modifying User Access Permissions). Summarizing, every data flow within the RSC is available within RSC, only to authorized users or computers. Security is provisioned with x.509 self-signed SSL server certificates installed on every computer hosting an RSC system component. All of the components comprising RSC are deployed with x.509 certificates that make them unique and secure. All the components are authenticated within the RSC built-in OpenSSL Certification Authority for a valid x.509 certificate before they can join a virtual RSC network. This provides an integrated self-defense protection with on-the-fly verification of component integration. Components not signed with a valid RSC certificate are prohibited and will not be able to join the RSC network and compromise system security. All communications are automatically signed and performed via an SSL channel as soon as you deploy RSC in your environment. Browsers connect to RSC Console via HTTPS protocol. RSC Components Default Port Usage Below you can find a table summarizing the network configurations used by RSC components. This outlines which ports are used by a particular RSC component and what the component uses them for, according to default settings which are customizable during installation of the component. 7

16 Chapter 1 Remote Support Center Basics Component Listen Port Waits for Connection from/to Local Remote Inbound Outbound RSC Management Console Defined in IIS Manager Any Client Browser N/A Used to accept browser connections and allow the RSC User to access the RSC Management Console from a computer in the LAN. If the Direct management model is used, and IIS is open for incoming connections from WAN, this port can be used by browsers in the WAN. Defined in IIS Manager Any RSC LAN Gateway N/A Used to send to RSC information about available RSC Client Computers and other information specific to RSC configuration and management. RSC LAN Gateway 1529 Any RSC Client Computer in LAN N/A Used to accept connections from RSC Client Computers (usually in the LAN). If the inbound connection can be installed from the WAN to the RSC Server, this port can be used by RSC Client Computers in the WAN Any RSC Console N/A Used to accept transfer of the RSC Management Console requests to Active Directory. This connection is established locally on the RSC Server only. Any 1528 N/A RSC Internet Gateway Used to establish an outbound connection to the RSC Internet Gateway in the perimeter network when RSC is configured with the Global Model. RSC Internet Gateway 443 Any RSC Client Computers in WAN N/A Used to accept connections from RSC Client Computers in the WAN. 443 Any RSC User s Browser N/A Used to accept browser connections and allow the RSC User 8

17 Chapter 1 Remote Support Center Basics Component Listen Port Waits for Connection from/to to access the RSC Management Console from a computer in the WAN Any RSC LAN Gateway N/A RSC Components Default Port Usage Note Used to accept inbound connections from the RSC LAN Gateway and make the RSC Management Console aware of the RSC Client Computers connections in the WAN. When deploying either the RSC Management Console or the RSC Internet Gateway to computers with Windows Firewall turned on, the Windows Firewall is automatically configured to allow connections via the specified ports. If the automated process fails, you ll be asked to perform this manually. 9

18 Chapter 1 Remote Support Center Basics GETTING STARTED The RSC Management Console provides the ability for authorized users to manage remote workstations or servers inside the organization or anywhere in the world. Once the RSC installation is complete, you can use RSC only locally: Installing Remote Support Center Clients to Remote Computers Managing Remote Computer via ExpertAssist Managing Remote Computer via InstantAssist In order to allow users to start using RSC from computers other than the RSC Server localhost address, the RSC administrator must perform some initial configurations. To perform the initial configurations to grant remote access to the RSC Console, launch the RSC Management Console via the Start Menu on the RSC Server, and then: Configure the Application Security Settings. This step allows the administrator to specify remote computer IP addresses, which will authorize RSC Administrators or RSC Helpdesk Specialists to connect to the RSC Management Console. This step also allows the default RSC Administrator to select Active Directory users and groups who will have administrative permissions in RSC when accessed remotely. Set granular Access Permissions on computers and groups. By default, RSC Administrators will have access to all computers and groups. The Administrators can set up more granular access and/or give additional users permission to access the RSC Management Console. When the initial configuration is performed, an RSC User can connect remotely to the RSC Console by entering the RSC (or DMZ) Server IP address or domain name (either short (NetBIOS) or long (FQDN) DNS name) into the browser address bar. For example, Note The RSC Administrator may consider installing RSC Internet Gateway if the RSC Server does not allow inbound connections from the Internet. See the Global Model subsection of the Management Models section within the Remote Support Center 2.5 Installation Guide. To start the management of a remote computer, the Remote Support Center Client (RSC Client: ExpertAssist or InstantAssist) must be running on the remote computer. This can be accomplished by: pushing ExpertAssist to selected Active Directory computers or computer containers. 10

19 Chapter 1 Remote Support Center Basics installing the ExpertAssist Deployment Package in bulk, via Group Policy or Desktop Authority. sending ExpertAssist or InstantAssist (requires special InstantAssist Technician License) invitations to computers outside of the Active Directory domain. Once the RSC Clients are installed, see how you can start managing your remote computers: Managing Remote Computer via ExpertAssist Managing Remote Computer via InstantAssist If, as an RSC novice, you encounter any problems working with RSC or its clients, address the Troubleshooting section before contacting the Technical Support Service at 11

20 Chapter 2 Using the RSC Management Console Once you ve logged into the RSC Management Console, either as an RSC Administrator or RSC Helpdesk Specialist, familiarize yourself with the RSC Management Console the tool to perform remote management via RSC. The chapter describes the RSC Management Console workspace, its controls and elements and provides guidance on the following how-tos: Displaying the Remote Support Center Environment Using the Active Directory Node Using the Remote Computer Groups Node Using the InstantAssist Clients Node Using the Error Log Node Using the Grid and its Fields Using the Grid Toolbar Buttons Locating the Desired Machine/Container Using the Remote Computer Properties Page Searching across your RSC Environment Organizing into the Favorites Container 12

21 Chapter 2 Using the RSC Management Console DISPLAYING THE REMOTE SUPPORT CENTER ENVIRONMENT With the Remote Support Center Management Console, you 1) make remote computers available for remote management by deploying them with RSC Clients and 2) define users permitted to perform remote management through RSC. The remote computer can be a computer from an Active Directory forest or any computer either currently not an Active Directory member or residing in the Internet, etc. The full scope of the RSC environment is always available for the RSC Administrator. The amount of data the RSC Helpdesk Specialist can view via the RSC Management Console depends on configurations made by RSC Administrator and can vary from one folder with RSC Client Computers to the whole RSC framework with the Active Directory forest (see figures below). The Tree pane available for the RSC Administrator. The Tree pane is tuned to display only Remote Computers Groups for the RSC Helpdesk Specialist. The Remote Support Center environment is organized: into two panes - the left Tree pane with the main environmental tree nodes and the right Grid pane presenting the selected object contents. The most of the RSC functionality is also available through the Grid pane: its toolbar, tabs, and links. The menu bar basically contains the RSC Administrator-specific tasks. 13

22 Chapter 2 Using the RSC Management Console RSC Management Console The Tree pane will display your RSC environment in: the Active Directory, Remote Computer Groups, and InstantAssist Clients node(s) as well as two functional nodes - Search and Favorites - to quickly locate the desired object among the environment. The Error Log node stores all the errors that occurred during the push or uninstall operations and is available only for RSC Administrators. Depending on your role and access permissions, the availability and contents of nodes vary. Refer to the corresponding node description for details on each. When a container is selected in the Tree pane, the Grid lists the child objects of this container on the Computers tab and displays the objects location path (or just the node s name) at the top of the pane. From within the Grid, you will reach the most of the RSC functionality (see Using the Grid and its Fields for reference). By switching from the Computers tab to the Users and Permissions tab, the designated RSC User can assign or view users with permissions on a domain, organizational unit or remote computer (sub)groups (for details, RSC Administrators can refer to Granting User Access Permissions to RSC Helpdesk Specialists and Defining the Active Directory Groups Permissions and RSC Helpdesk Specialists to Setting/Modifying User Access Permissions). Within the InstantAssist Clients node, one can regulate the scope of computers to display within the node by blocking/unblocking the IA Client Computers. The blocked computer then will show on the Blocked Computer tab of the InstantAssist Clients node. In case you encounter a problem logging into or starting the RSC Console, consult the Troubleshooting section to detail the error messages and solve the issue. 14

23 Chapter 2 Using the RSC Management Console Using the Active Directory Node Viewing the organizational unit content within the Active Directory node The Active Directory node lists the domain(s), organizational unit(s), container(s) and computer(s) of Active Directory that the RSC Server is part of. This is the RSC Administrator who defines the number of domains (or even certain computer objects) available for RSC Helpdesk Specialists. Thus, address your RSC Administrators if you cannot find the desired object within your RSC environment. RSC Helpdesk Specialists with the Delegate permission can also assign permissions to other users on the objects they are responsible for. The RSC Console displays only those containers that store at least one computer inside. Since RSC installs to a LAN server, RSC reads from and tracks all Active Directory changes in order to display the most recent state of the Active Directory framework upon RSC Console automatic refreshes. Note The Active Directory computer deployed via an EA Deployment Package will display in Remote Computer Groups just in case it is no longer the member of Active Directory domain. The No domains are available message that appears on expanding Active Directory indicates your Active Directory user account is granted no permissions on any of the domains within the RSC security settings (see Troubleshooting). What s next: 15

24 Chapter 2 Using the RSC Management Console For the icons displayed next to computer/containers, see Using the Grid and Its Fields. For guidance on how to push to the Active Directory remote computers to make them available for management, see Pushing ExpertAssist Client to a Remote Computer(s). For remote management operations available within the node and their routine, see RSC Helpdesk Specialist Role. For using the Users and Permissions tab, see Granting User Access Permissions to RSC Helpdesk Specialists. For info on the page you are brought to if following the link on the computer name, see Using the Remote Computer Properties Page. Using the Remote Computer Groups Node Viewing the contents of the Default folder within Remote Computer Groups. The Remote Computer Groups node stores container(s) of remote computer(s) (either in the LAN or Internet) deployed with ExpertAssist client software via invitation or non-active Directory computers installed with the ExpertAssist Deployment Package. Note The ExpertAssist Deployment Package feature is only available for RSC Administrators (consult Using an ExpertAssist Deployment Package). These are the RSC Administrators who can regulate the number of remote computer(s) or remote computer group(s) RSC Helpdesk Specialists can view or manage. Thus, address your RSC Administrator(s) in case you cannot find the desired object within your RSC environment. RSC Helpdesk Specialists with the Delegate permission can also assign permissions to other users on the objects they are responsible for. The Grid pane that displays when the Remote Computer Groups node is selected in the left is headed with the name of the selected remote computer group. Once the RSC User has created an invitation for the remote computer: 16

25 Chapter 2 Using the RSC Management Console the computer will display within the Remote Computer Groups node in the Default or the custom folder defined as the computer store during the creation of the invitation; the EA Client Computer will be listed in the Grid with the custom name entered in the Remote Computer Name field of the Inviting New Remote Computer page; the computer is appended with the icon until the RSC Remote User deploys the computer with EA Client and the computer connects to and registers with RSC; the icon will change to indicating the EA Client Computer is available for management. ExpertAssist can be automatically removed when necessary. the computer will display in the Default folder (once the EA Deployment Package installs to the non-active Directory computer,) and normally will be immediately available for management (signaled by the icon). The EA Client Computer will be listed in the Grid by its NetBIOS computer name. if the Active Directory computer deployed via the EA Deployment Package may happen to get unjoined, the computer will display in Remote Computer Groups. To organize your EA Client Computers deployed via invitation (ExpertAssist Deployment Package), use the Grid toolbar buttons: to create new group folder(s) to move either the group folder(s) or EA Client Computer(s) within the Remote Computer Groups node to add it to the Favorites container. If you fail to expand the Remote Computer Groups node, your Active Directory user account has been granted no permissions on any of the node s object (see Troubleshooting). What s next: For guidance on how to invite remote computers for management, see Inviting Remote Computer(s) for Management with ExpertAssist. For info on how to automatically uninstall the ExpertAssist Client from the remote computer, see Centralized Uninstallation of ExpertAssist Client(s). Understanding the icons displayed next to computers/containers, see Using the Grid and its Fields. For tips on how to organize within the Remote Computer Groups node, see Using the Grid Toolbar Buttons. For remote management operations available within the node and the operation routine, see RSC Helpdesk Specialist Role. 17

26 Chapter 2 Using the RSC Management Console For using the Users and Permissions tab, see Granting User Access Permissions to RSC Helpdesk Specialists. For information on the page you are brought to if following the link on the computer name, see Using the Remote Computer Properties Page. Using the InstantAssist Clients Node The InstantAssist Clients node is available only for RSC Administrators and those RSC Helpdesk Specialists who are issued with an InstantAssist Technician License. Management of InstantAssist Clients is available only for RSC Users issued with an InstantAssist Technician License. If you are an RSC Administrator accessing the RSC Console from someplace other than the localhost address and the InstantAssist Clients node does not show in the Tree pane, ensure that you start your browser from the IP address granted configuration rights. The node stores the computers deployed with the InstantAssist client software. Once the target computer you invited for management with InstantAssist connects to and registers with RSC, it displays on the Grid pane and is available for remote administration. The computer will disappear from the Grid as soon as the RSC Remote User exits the InstantAssist client software or computer disconnects from RSC. Viewing the InstantAssist Clients node with IA Client Computer available for management The IA Client Computers that have been blocked from displaying in the node are stored on the Blocked Computer tab. What s next: Deploy a remote computer with InstantAssist (refer to Deploying Remote Computer with InstantAssist). Block the computer(s) to be displayed in RSC Console. Unblock the blocked computers to show them in RSC Console. For the icons displayed next to computers/containers, see Using the Grid Toolbar Buttons. 18

27 Chapter 2 Using the RSC Management Console Using the Error Log Node Viewing the Error Log data Within the Error Log node of the RSC Console, the RSC Administrator can view all the EA Client push - and/or automatic removal errors published by the RSC application. The Error Log page presents the error event data in a grid with the columns described in the table below. Column Name Description Date/Time Displays the date and time the error event took place (according to the regional and local system settings of the RSC User Browser). Computer The DOMAIN\Computer Name format is used to designate the remote computer on which the push/uninstall operation was initiated and successively fired an error. User The DOMAIN\User Name format is used to designate the user who initiated the operation. Error ID Displays the error event number that identifies the event type. Details Shows the error message. The Error Log grid description. Click the column header to sort the column data alphabetically or numerically. For your convenience, all new error logs are displayed in bold. When necessary, you can select one or more entries, and then click Mark Selected as Read to mark the selected entries as read. You may also use the Mark All as Read button. Using the Grid and its Fields By accessing the Grid and its fields, you can view contents of the container selected in the Tree pane as well as be aware of the computers that have been successfully installed with RSC Clients and are currently available for management; or install the RSC Client; or initiate the remote management session, etc. The Grid fields are as 19

28 Chapter 2 Using the RSC Management Console follows: Type, Name, Operation, User Name, Operating System. Their values are detailed below. To filter the listed objects of the selected container with the Grid fields: In the desired Grid field, expand the drop-down list and select from the available items. The displayed list will change accordingly. Use the Name or User Name filter boxes to search/sort out within the listed objects: type the desired object name or part of its name in the filter boxes, and then click. The objects matching your search parameters will show. Type This column allows you filter the displayed objects according to the status of the RSC Client hosted on the remote computer. By default, the value is set to All to display items within the selected container in alphabetic order starting with folders names. The available Type values are represented with icons which indicate the following: The Type field icons Containers (for Active Directory) Groups (for Remote Computer Groups) Client is not installed (for the Active Directory node) Invited (n/a for InstantAssist Clients) Installation is in progress (for the Active Directory node) Available for management In management session Client is inactive (n/a for IA Client Computers) Icon description Active Directory organizational units and containers. Groups within the Remote Computer Groups. The remote computer is not installed with EA Client. (If you were installing EA Client to the target computer,consult Troubleshooting for possible problems.) An invitation for the remote computer was generated but the computer has either not installed the EA Client or connected to RSC. (Refer to Troubleshooting for possible errors.) The target computer is currently being pushed with the EA Client. The target computer has the EA/IA Client installed and running and is currently available for management. The target computer is currently being managed. The remote computer has been deployed with the EA Client but management is impossible. (See the Troubleshooting section for possible causes and 20

29 Chapter 2 Using the RSC Management Console solutions.) Pending for uninstallation (for ExpertAssist Client Computers) Not supported client (n/a for InstantAssist Clients) All with warnings (n/a for InstantAssist Clients) The EA Client Computer is in the client software queue. You can cancel the uninstallation if desired. The remote computer is running an EA Client version that is no longer supported by RSC. To make the computer available for management, upgrade to the latest the client version via Push or Invitation. Appends a computer to indicate the computer failed to be installed/uninstalled with the EA Client. To view the error message, hover the pointer over the icon. Follow the link on the corresponding computer name to navigate to the Error Log section. (The icon disappears once the Error Log tab is opened to view the error message.) To resolve the installation problem, consult the Troubleshooting section. The Type field icons Name This column displays the NetBIOS names of Active Directory objects or remote computers deployed with the ExpertAssist Deployment Package, and the custom names used to invite computers into the Remote Computer Groups. Click the link on the computer name to navigate to the Remote Computer Properties page, and on the container to display the container contents. Operation This column lists the operations that can be performed on the corresponding remote computer or container-like object. The Operation field items Push (available for objects within the Active Directory node) Manage (for computers) Cancel uninstallation (for Item description The object can be deployed with ExpertAssist to start the remote management session on it. If pushing to a container, EA Clients will install recursively. The remote computer is deployed with the RSC Client and is available for management. Click the Manage button to launch the management window and start remote administration. You can cancel removal of the ExpertAssist Client from 21

30 Chapter 2 Using the RSC Management Console Pending for uninstallation computers) Regenerate (for computers within Remote Computer Groups) Unblock (for Blocked Computers) the computer that is in the Pending for uninstallation. Regenerates invitation for the remote computer to be deployed with the EA Client. (Follow the link to learn about the operation details.) Makes the computer available for management by placing it back to the Grid within the InstantAssist Clients node. (Follow the link for details of the Unblock operation.) The Operation field icons User Name (not available for Blocked Computers) Displays the name (in the DOMAIN\Username format) of the user being logged on to the RSC Client Computer interactively, for the Available for management or In management session statuses. Operating System (not available for Blocked Computers) This column displays the operating system running on the RSC Client Computer that is in the Available for management or In management session statuses. Using the Grid Toolbar Buttons The Grid pane contains the toolbar. The range of available toolbar buttons differs for Active Directory, Remote Computer Groups and InstantAssist Clients nodes. The icons are referenced in the table below. To make use of the toolbar buttons: select an object within the Grid, and then click on the activated button to take advantage of its functionality. The Grid toolbar buttons Refresh Add to favorites Remove from Favorites (in the Favorites node) Push (for the Active Button function Displays the most recent information about available computers and their statuses. (To refresh, use this application button instead of the browser one.) Add the selected object to the Favorites container. (For details on adding to favorites, follow the link). Removes the selected object from display in the Favorites node. Select any available Active Directory object or set of objects, and then click 22

31 Chapter 2 Using the RSC Management Console Directory node) on the Push button to deploy it with ExpertAssist in order to start the remote management session. If pushing to a container, the EA Clients will install recursively. Uninstall (for any but IA Client Computers) Invite (for the Remote Computer Groups node) New Subgroup (for the Remote Computer Groups node) Move to (for the Remote Computer Groups node) Remove (for the Remote Computer Groups node) Block Computer(s) (for the InstantAssist Client node) Unblock Computer(s) (for the InstantAssist Client node) Uninstalls the EA Client from the selected EA Client Computer(s) within the Active Directory or Remote Computer Groups nodes. (Activated if any child Remote Computer Groups folder is selected) Creates an invitation for the remote computer to be installed with the ExpertAssist Client. Creates a new custom group folder within Remote Computer Groups. Moves the selected EA Client Computer(s) or group folder(s) within Remote Computer Groups from the current group to the newly selected one. Removes the selected EA Client group folder(s) and all its contents. Blocks the selected IA Client Computers and hides them from the Instant Assist Clients Grid and show on the neighboring Blocked Computer(s) tab. (See Blocking/Unblocking InstantAssist Client Computers.) Makes the selected blocked IA Client Computers appear and be available for management within the Instant Assist Clients Grid. (See Blocking/Unblocking InstantAssist Client Computers.) Grid toolbar buttons 23

32 Chapter 2 Using the RSC Management Console LOCATING THE DESIRED MACHINE/CONTAINER To locate the desired computer or any container within your RSC environment, perform the steps below: (For available nodes) In the Tree pane, expand the Active Directory node to list the discovered Active Directory domain(s); expand the Remote Computer Groups node to view the Default and other group(s) of computers deployed (or just invited to be deployed) with the ExpertAssist client software via invitation or the ExpertAssist Deployment Package; click the InstantAssist Clients node for InstantAssist Client Computers installed with the InstantAssist client software. Click the desired node folder to display its contents - computers or subfolders - in the Grid pane to the right. Use the Grid fields to sort within the listed objects or perform available operations on the desired object. (If necessary) Search within the listed objects by typing the desired computer or user name or part of the name in the Name filter box and click matching your search parameters will be displayed.. The objects Or, you may just use the Search tool to quickly navigate to the Active Directory or Remote Computer Groups object. To vary the amount of items displayed on a single page, use the pagination control at the bottom of the Grid. To get the most recent information about available computers and their statuses, click the Refresh button. By default, the page contents update once per minute. Once you ve located the computer or other object in the Grid, use the available Grid functionality or refer to the RSC Helpdesk Specialist Role chapter for guidance on remote management. 24

33 Chapter 2 Using the RSC Management Console USING THE REMOTE COMPUTER PROPERTIES PAGE The Remote Computer Properties page is available for computers within the Active Directory node and Remote Computer Groups node. The Remote Computer Properties page To view the Remote Computer Properties page: Locate the desired remote computer in the Grid and then click the link on its name in the Name column. The Remote Computer Properties page entitled with the remote computer name will open. The Remote Computer Properties page displays various details about the remote computer. It also allows running commands applicable for this computer by making use of the activated links: Invite Remote Computer; (For computers within the Active Directory node) Push the ExpertAssist client software. (The EA Client status is referenced with an icon. Refer to the Remote Computer Properties Page icons table.); 25

34 Chapter 2 Using the RSC Management Console (n/a for IA Clients) Uninstall ExpertAssist Client Software; Manage Remote Computer (activates only if the remote computer is both deployed with EA Client and connected to the RSC Console). If you are not sure why the operation link is not activated, switch to the Grid view to find out if the remote computer type and reference the status icon in the Using the Grid Toolbar Buttons and Troubleshooting sections (if necessary). RSC Administrators and Helpdesk Specialists with sufficient permissions can also use the Remote Computer User Access Permissions window to modify user access rights on the computer. The Error Log tab stores all error events the remote computer encountered during EA Client deployment/uninstallation. Remote Computer Info The Remote Computer Info section stores the following information about the remote computers deployed with EA Client and registered with RSC (otherwise all fields will show Not available or Unknown, except for the Operating System field). The Remote Computer information includes: Entry Remote Computer Status Session Status User Logged in Locally Remote Computer IP Address Operating System Client Version Description Displays the status of the EA Client Computer and corresponds to the one shown within the Type Column of the Grid. Informs about the management session status: Available the remote computer can be managed, Not Available the EA Client is currently not available for management, In Management Session the remote computer is currently being managed. Displays the name (in the DOMAIN\Username format) of the user being logged on to the RSC Client interactively. The IP address of the EA Client Computer used by the current management session. Shows the remote computer s operating system retrieved from Active Directory. EA Client version number The Remote Computer Info items description The availability of the EA Client on the remote computer is referenced with an icon. See the table below to know the icon definitions. 26

35 Chapter 2 Using the RSC Management Console Entry Description The remote computer is not installed with EA Client. The EA Client is currently being installed on the remote computer. The remote computer has been successfully deployed with the EA Client and is available for management. The remote computer has been deployed with the EA Client but management is not possible. The EA Client could not successfully be installed on the remote computer. The Remote Computer Properties Page icons The Error Log Tab The push/uninstall error event(s) that occurred on the remote computer display(s) on the Error Log tab within the Remote Computer Properties page of the corresponding computer. The error logs are accumulated in a grid that informs you on: the date and time the error occurred (according to the EA Client Computer) (in the Event Date/Time field), the RSC User who initiated the operation (in the User field), the error identification number to reference the error (in the Error ID field), the full error message (in the Details field). Once you open the tab, the warning in the Grid view appending the last initiated and failed operation will be removed. Viewing the Error Log tab contents 27

36 Chapter 2 Using the RSC Management Console SEARCHING ACROSS YOUR RSC ENVIRONMENT RSC features a searching mechanism that allows finding the necessary computer within the Active Directory node items or your Remote Computer Groups, or define the computer the Remote User is currently logged in. Note The search is performed by the NetBIOS computer name. To perform the search: 1. Use the Search container shown on the figure below. 2. To build the search query: a. Enter the full-matching computer name in the Name field. You may also use the * wildcard symbol at the beginning or end of the search string to represent any characters in the beginning or ending of the name being searched. Leave the search string blank to display all available objects in the Search results. AND/OR, Enter the full-matching user name (in the DOMAIN\Username format) into the User Name field to look for the Remote User currently logged into the EA Client Computer. The * wildcard search is also supported (see the paragraph above). b. Select the desired domain or Remote Computer Groups in the Container drop-down menu. Set the All option, if not sure about the location the desired computer resolves in (but it may take time to perform the search through numerous domains). 3. Click Find. The search results will display in the table below the Search options section. Use the Search results table fields to filter out the results. 28

37 Chapter 2 Using the RSC Management Console The Search results window displays all the computers starting with Te and residing in the dawn.local domain. Tip The search string should not start with characters disallowed by the Naming conventions in Active Directory (refer to 29

38 Chapter 2 Using the RSC Management Console ORGANIZING INTO THE FAVORITES CONTAINER For your convenience, you may organize the computer(s) and/or group(s) you administer most often in the Favorites container. You may perform any of the available operations (Push, Manage, Regenerate, Uninstall) from the Favorites node as well as access the Remote Computer Properties page. You can add to favorites any Active Directory computer or group (except domains), or any computer or group from Remote Computer Groups. To add a computer to the Favorites container: 1. In the right window with the list of computers and groups, select the desired one(s) by checking the neighboring box. 2. Click the button on the toolbar above the list. Select the computer and click the Add to favorites button to organize it under the Favorites node. Viewing the Favorites container content. The selected item will be added to the Favorites container. To view the container, click the Favorites folder in the left pane. Note 30

39 Chapter 2 Using the RSC Management Console Adding to the Favorites container is not available for items within the InstantAssist container. 31

40 Chapter 3 RSC Administrator Role The RSC Administrator is typically responsible for configuring and managing the RSC Management Console as well as designating RSC Helpdesk Specialists for Remote Management purposes. The RSC Administrator can also remotely manage remote computers via RSC. The RSC Administrator can always view the whole scope of the RSC workspace (the Active Directory, Remote Computer Groups, InstantAssist Clients, and the Error Log node). Only RSC Administrators can access the Security Settings menu, manage InstantAssist Technician Licenses, or prepare the ExpertAssist Client package for mass deployment (via the Client Deployment menu). The RSC Administrator is a user that is granted RSC administrative rights and rights to launch the RSC Console from the IP address allowed to perform configurations of Remote Support Center. By default, RSC administrative rights are granted to the user logged into the RSC Server. Only the RSC Server localhost, IP address /8, is the default IP address that is allowed to perform configurations of RSC. The default RSC Administrator is responsible for initial security settings and access permission configuration in RSC, assigning other domain users with RSC Administrator and Helpdesk Specialist rights so they can perform RSC and remote computer administration regardless of the location of RSC User, RSC Server, or remote computer. Initial RSC Console Startup To log into the RSC Console for either initial configuration or remote management purposes: 1. Log into the RSC Server, and then, from the Start menu, start the RSC Console by selecting All Programs-> ScriptLogic Corporation-> Remote Support Center-> RSC Management Console. The RSC Login page will open. 2. Type in your Active Directory credentials and click Login. The RSC Management Console will show. Alternatively, on the RSC Server, start the browser, and then type (If necessary, replace RSC with the virtual directory name specified during the installation. See the description of the RSC Server Installation Procedure section in the Remote Support Center 2.5 Installation Guide). Starting the RSC Console by typing its IP address or computer name before creating IP filter rules for this IP address will render an unauthorized access error. (See Troubleshooting.) 32

41 Chapter 3 RSC Administrator Role ONCE the RSC Management Console has launched, perform the RSC Administrator tasks: Configure RSC to allow remote access to the RSC Console by: 1. managing Security Settings (setting IP filter rules and designating RSC Administrators, the latter is optional); 2. granting user access permissions on certain domains or Remote Computer Groups. Provision the user with an InstantAssist Technician License to implement remote management via InstantAssist. (If applicable or necessary.) When necessary, install the RSC Internet Gateway if planning to access Remote Support Center from the Internet and your RSC Server is shielded from unauthorized access with firewall or NAT devices. When necessary, configure invitation settings to invite remote computers to be deployed with the EA Client. When necessary, modify the Administrator Account that authorizes the RSC Client installation on remote computers. 33

42 Chapter 3 RSC Administrator Role GRANTING REMOTE ACCESS TO RSC CONSOLE To provide remote access to the RSC Console from other than the RSC Server localhost address, either for RSC Console monitoring, administrating, or remote control purposes, the RSC Administrator has to configure the Remote Support Center Security Settings page first. By configuring the settings, you define the range of IP addresses trusted to access RSC and (if specially tuned) administer the RSC Console from remote browsers. You can also create a list of users with RSC Administrator privileges to allow them perform RSC management. When remote access to RSC Management Console is configured, the RSC Administrator should provide the RSC Console URL to the potential remote RSC Users (refer to Connecting to the RSC Console Remotely). The common routine to grant remote access to the RSC Console is as follows: 1. Configure the Security Settings page by defining IP Filter rules, designating RSC Administrators and Active Directory group permissions (if the latter is necessary)). 2. Define Users and Permissions. The RSC Security Settings page default view 34

43 Chapter 3 RSC Administrator Role Defining IP Filter Rules and Designating RSC Administrators Defining IP Filter Rules Computer IP address filtering is used to allow/deny access to the RSC Console for remote control or RSC Console configuration purposes. By submitting entries and managing the IP Filter table, you permit/prohibit access to users from certain computer IP addresses to the RSC Console and thus define the RSC Console security settings. Note If implementing the Global Model, consider adding the DMZ server IP address to the RSC IP Filter. According to the default security settings of the IP Filter table, the loopback address, by IP and by subnet mask, is allowed administrative access to the RSC Console; the rest IP addresses in the range of are prohibited access. Since the loopback address holds the first row in the table, connections from any IP addresses are first filtered according to this filter. The first-order filter is restricted for editing. Note When done with setting the IP Filter rules, grant user permissions, RSC Administrator rights or InstantAssist Technician Licenses, otherwise the "User does not have required permissions" login error will show when connecting to the RSC Console from the specified addresses. To refer to the IP address range, the filter applies, move the cursor over the Info icon and read the tooltip in blue. The default IP Filter settings with the first-order loopback IP filter referenced. To set the filter according to your needs, modify the default IP Filter table settings by: 1. adding new IP filter, 2. (if necessary) reordering the IP filter list, 35

44 Chapter 3 RSC Administrator Role 3. (if necessary) removing/editing the existing IP filter. Adding a New IP Filter Rule To allow/prohibit access to the RSC Console from any other than the localhost address of the computer hosting RSC, add the respective IP filter by adding and reordering records in the IP Filter table. Adding a new record to the IP Filter table To add a new IP filter: 1. Click Add New Filter to add the new IP filter entry and fill in the fields. (See IP Filter to see the tips on how to set the IP and Subnet entries.) IP Enter the IP address of a single computer or a group. Specify a group of computers by entering zero(s) for the last octet(s). Subnet Enter the subnet mask that will be used to identify the computer. Specify a group of computers by entering the first three octets in the mask and 0 for the last octet if you want to lease 24 bits for network IP address part leaving another 8 bits for the host part. Thus you will specify a range of 254 computers. Allow Access to RSC Set this checkbox to allow access from the specified IP address(es). Allow Configuration of RSC Check this box to carry out the RSC Administrator role from this IP address. (To ensure configuration of RSC remotely, the user must be also assigned RSC Administrator rights.) 36

45 Reordering IP Filter List Chapter 3 RSC Administrator Role 2. Click Add Filter to add the specified IP filter to the IP Filter list. Click Cancel to discard the IP Filter changes. 3. The newly created IP filter rule will appear in the last row but one, i.e. this filter will apply after all the preceding rules are processed. If necessary, move the newly added filter within the IP Filter list to set its filtering priority. (See Reordering IP Filter List.) Once the IP Filter list is created, you can edit, reorder or remove it. The IP filter rules are processed according to their order in the IP Filter table list (from top to bottom). If the list contains any overlapping addresses, the first IP address, starting from the top of the list, that the computer matches, will determine the requirements for that computer. The IP addresses being denied access must be specified above the IP filter which includes this computer within a range of computers allowed to access the RSC Console. To move the desired IP filter in the list: 1. Click the up and down arrows next to the desired IP filter. The IP filter will go one line up or down accordingly. 2. Repeat the step above until the filter is in the wanted position. Example 1. Using IP Filter ordering. All computers in the x LAN will have access to the RSC Console except for the computer with IP address of When this computer attempts to login to RSC, IP Filter #1 will exclude this computer from accessing the RSC Console. Removing IP Filter Rule To remove one or more IP filter rules from the list: 1. Select the rule by marking in the box in the left hand column next to a particular IP or IP range. 2. Once the IP filters are selected, click Remove Selected. 37

46 Editing IP Filter IP Filter Chapter 3 RSC Administrator Role The filter will delete from the list and will not apply when authorizing access to the RSC Console from the remote computer. To edit the desired IP filter entry: 1. Click next to the desired IP filter and modify the fields as necessary. 2. Click to save changes to the IP filter. Click to discard any IP filter changes. If you need to change the order the IP filter rule will be processed, change its position in the list (see Reordering IP Filter List). An IP filter may consist of a single IP address or a range of IP addresses. To specify a range of IP addresses: 1. Set the necessary IP address octet representing the host part of the computer IP address to 0. You will create a subnet start address. 2. Specify the corresponding subnet mask. Example 2. Allowing access from any computer in any network To allow users from any computer to access RSC, edit the bottom IP filter ( with the mask ), by setting the Allow Access to RSC and/or Allow Configuration of RSC checkboxes. If no other IP filters are defined above this filter, access to the RSC Console will be allowed from any computer in any network. Example 3. Denying access for 26 IP addresses within the defined subnet. This IP filter reads as follows: 38

47 Chapter 3 RSC Administrator Role The IP addresses range of the subnet are allowed access according to the Allow Access to RSC check box next to it. But the deny rule (as read the respective checkboxes) for 26 IP addresses (the three rows above) of the subnet will overlap this filter and prohibit access for , , IP addresses. Designating RSC Administrators If you need to configure RSC from a computer other than the computer that RSC is installed to, you should designate RSC Administrator rights to those users who will perform this RSC Console configuration. You can add any Active Directory user accounts/groups to the RSC Administrators list. Ensure the computer s IP address from which the RSC Administrator is going to configure RSC is a part of an IP Filter list and is set with the Allow Configuration of RSC option (see Adding New IP Filter). Otherwise, any operations available only for RSC Administrators will be blocked for the user (see the error message on the figure below). The RSC Administrator is accessing RSC from computer denied configuration rights. To add a user or group to the RSC Administrators list: 1. On the RSC Console menu bar, go Security->Security Settings, and then click Add User/Group under the RSC Administrators section to locate the desired Active Directory domain user or group in the window that will open. 2. In the opened Find Users and Groups window, type in the user/group name or login name or the beginning part of their names/login names. Click Find or hit ENTER to list all the matching items. To narrow your search to a specific domain, select it in the Domain drop-down box. 3. Select the user(s) or group(s) by setting the checkbox next to their names and click Add. The chosen user(s)/group(s) will be added to the RSC Administrators list. Note 39

48 Chapter 3 RSC Administrator Role Only the selections made on the currently displayed search results page can be added to the RSC Administrators. Selections made on multiple pages are remembered only for the current page. To remove a user(s)/group(s) from RSC Administrators: 1. Go Security->Security Settings. In the RSC Administrators window, select each one to be removed by marking the desired item(s) in the checkbox(es). 2. Once the user(s)/group(s) is/are selected, click Remove Selected. The item(s) will disappear from the list. Removing a user from RSC Administrators Granting User Access Permissions to RSC Helpdesk Specialists This is the RSC Administrator who defines the scope of domain(s), organizational unit(s) within the Active Directory node, or certain groups within the Remote Computer Groups, or even certain computers that the RSC Helpdesk Specialist can manage or just view. The RSC Helpdesk Specialists can also delegate their rights grant the rights assigned to them to other users. The RSC User can assign the RSC access rights to any Active Directory user or group. An Active Directory user/group can be granted with the following permissions: List, View, Full Control, or Delegate (follow the link to detail the permissions). To grant RSC Helpdesk Specialist with access rights on domains/organizational units or remote computer groups, use the Users and Permissions tab. (See Setting user access permissions to an Active Directory domain or group within Remote Computer Groups and Setting user access permissions to a specific organizational unit(s)/remote computer subgroup(s).) For granular security permissions, use Remote Computer User Access Permissions on the Remote Computer Properties page. By setting rights from a remote computer page, you provide the RSC Helpdesk Specialist with the necessary privileges to view and manage the target computer. (See Setting user access permissions on specific computer(s).) (Applicable only for RSC Administrators) Use the Active Directory Groups Permissions section of the Security Settings page to grant the RSC Helpdesk 40

49 Chapter 3 RSC Administrator Role Specialist role with the View or Full Control permission to a certain user group that already exists in Active Directory. By using the Active Directory Groups Permissions you can assign permissions on the whole Active Directory forest. Viewing access permissions on a domain via the Users and Permissions tab. 41

50 Chapter 3 RSC Administrator Role Viewing access permissions on the remote computer via the Remote Computer Properties page. Note Ensure the RSC Helpdesk Specialist connects to RSC from the IP address added to the IP Filter table. Otherwise, the Access denied error will hinder the RSC Helpdesk Specialist s attempts to connect to the RSC Console. User access permissions are addressed in the following sections: Viewing user access permissions Permissions description 42

51 Chapter 3 RSC Administrator Role Setting user access permissions to an Active Directory domain or group within Remote Computer Groups Setting user access permissions to a specific organizational unit(s)/remote computer subgroup(s) Setting user access permissions on specific computer(s) Disallowing RSC Helpdesk Specialists to view/push to certain objects within the domain/ou or (sub)group he/she has permissions on Removing/Modifying user access permissions (Only for RSC Administrators) Defining the Active Directory Groups Permissions Viewing user access permissions The Users and Permissions tab available within the Grid pane lists the user(s)/group(s) that can view, manage or delegate their rights on the Active Directory domain(s)/organizational unit(s) or groups/subgroups within the Remote Computer Groups node selected in the left Tree pane. The Remote Computer User Access Permissions section displays the Active Directory user(s) or user group(s) that has permissions to manage this remote computer. These are usually the users whose permissions were inherited from parent group/domain/organizational unit (listed on the Users and Permissions tab) as well as users granted permissions specifically from this section. The entries that specify access permissions are grayed out if the specific permission is inherited. Only the RSC Helpdesk Specialist user accounts listed on the Users and Permissions tab and the Remote Computer User Access Permission list will be able to access the respective domain/organizational unit/computer group/remote computer. The RSC Administrators are granted the full scope of permissions by default, but are not shown on these pages. Permissions description An Active Directory user or group can be assigned with the following permissions: List, View (only for computers within the Active Directory node), Full Control, and Delegate. The following table summarizes what each of the permissions granted to the user or group will allow. Permissions on an Active Directory Domain/Organizational Unit (OU) The user that has this permission: List View Full Control can see the domain/ou node in the tree view can install/uninstall the EA client software on the domain computers within the domain/ou can add/remove/modify permissions on the domain/ou Permissions on an Active Directory Remote Computer The user that has this permission: List View Full Control can see the remote computer in the Grid Delegate Delegate 43

52 can connect to the remote computer as a local user and use the EA management console to reboot, view computer events, file system, registry, performance data, processes, user/group accounts, view and launch scripts; requires interactive user approval to start the remote control session. Chapter 3 RSC Administrator Role can install/uninstall the EA Client can manage the remote computer as a local admin user and access the full functionality of the EA management console. can add/remove/modify remote computer s permissions Permissions on a Remote Computer Group The user that has this permission: List Full Control can see, expand, rename, delete the group node. can create/delete/move a child group can create invitations to add remote computers to this group. can move a remote computer from the group to another remote computers group (and vice versa). has permission to add/remove/modify permissions Permissions on a Remote Computer within Remote Computer Groups The user that has this permission: List Full Control can see the EA Client can delete the EA Client can regenerate an invitation for the EA Client. can manage the EA Client can add/remove/modify remote computer s permissions The RSC permissions description Delegate Delegate Setting user access permissions to an Active Directory domain or group within Remote Computer Groups To set permissions on an entire domain or remote computer group: 1. Locate the desired domain or remote computer group, and select the Users and Permissions tab in the Grid pane. In the window that will open, click Add. 2. In the opened Find Users and Groups window, type in the user/group name/login name or the beginning part of these names. Click Find to list all the matching items. To narrow your search to specific domain, select it in the Domain drop-down box. 3. Select the user(s) or group(s) by setting the checkbox(es) next to their names and click Add. Note 44

53 Chapter 3 RSC Administrator Role Only the selections made on the currently displayed search results page can be added to the RSC Administrators list. Selections made on multiple pages are remembered only for the currently active page. 4. The selected user(s)/group(s) will be added to the list on the Users and Permissions tab with the List permission. 5. If necessary, set the View (available for objects within the Active Directory node), Full Control or Delegate permission by selecting the corresponding checkbox, and click Save Permissions to save and apply all permission changes. The newly added access right will show on the Users and Permissions tab of the domain or the remote computer group. This user will also display dimmed on the Users and Permissions tab of the child organizational unit(s) or remote computer subgroup(s) and on the Remote Computer Properties page of the child computers, signifying that the permission is propagated from the parent object. To know how you can vary the visibility of some domain or remote computer group contents or make them available for management to different RSC Helpdesk Specialists, see Disallowing RSC Helpdesk Specialists to view/push to certain objects within the domain/ou or (sub)group he/she has permissions on and Setting user access permissions to a specific organizational unit(s)/remote computer subgroup(s). Setting user access permissions to a specific organizational unit(s)/remote computer subgroup(s) To set permissions on a specific organizational unit of an Active Directory domain or child subgroup of a remote computer group: 1. In the Tree pane, locate the desired organizational unit or child remote computer subgroup, and select the Users and Permissions tab in the Grid pane. In the window that will open, click Add. 2. In the opened Find Users and Groups window, type in the user/group name or login name or the beginning part of their names. Click Find to list all the matching items. To narrow your search to specific domain, select it in the Domain drop-down box. 3. Select the user(s) or group(s) by setting the checkbox next to their names and click Add. Note Only the selections made on the currently displayed search results page can be added to the RSC Administrators list. Selections made on multiple pages are remembered only for the currently active page. 4. The selected user(s)/group(s) will be added to the list on the Users and Permissions tab with the List permission. The newly defined user permission will show duplicated with its upper duplicate grayed out if the Allow inheritable permissions from the parent to propagate to this object and all child 45

54 Chapter 3 RSC Administrator Role objects option is enabled. Its upper grayed out duplicate ensures that you could access all of the parents that host the container in question. Otherwise, ensure the user is present on the Users and Permissions tab of every parent nesting this computer. 5. If necessary, set the View (available for objects within the Active Directory node), Full Control or Delegate permissions by selecting the corresponding checkbox. Click Save Permissions to save and apply all permission changes. 6. Set the Allow inheritable permissions from the parent to propagate to this object and all child objects option as necessary (the option is enabled by default). When enabled, you can access all of the parents that nest the container and automatically propagate the permissions granted on the current page to all the child objects of the container (both folder-like objects and computers). Uncheck the option if you want only this particular user to have the specified permissions on the organizational unit or remote computer subgroup. When the option is unchecked, it might be reasonable to make sure the user is present on the Users and Permissions tab of every parent of the container in question. Consider using this checkbox if you want the user to access the parent container(s) but view/manage only the object(s) the user has been granted rights on, not all of the available child objects. See Disallowing RSC Helpdesk Specialists to view/push to certain objects within the domain/ou or (sub)group he/she has permissions on for more details.) Once added, the newly defined user permissions will show on its Users and Permissions tab. If the Allow inheritable permissions from the parent to propagate to this object and all child objects option is enabled, the permission record will duplicate. Its upper grayed out duplicate will indicate that this organizational unit/remote computer subgroup inherits the permissions from its parent Active Directory domain/organizational unit or remote computer (sub)group respectively. This user will also display dimmed on the Users and Permissions tab of the child organizational unit(s) or remote computer subgroup(s) and on the Remote Computer Properties page of the child computers, signifying that the permission is propagated from the parent object. Setting user access permissions on specific computer(s) You can set specific permissions on a remote computer by accessing the information page of this remote computer. You may find it convenient to assign permissions on the whole domain right from the remote computer page. 1. Click the desired computer name in the Grid pane to navigate to its Remote Computer Properties page. Click Add under the Remote Computer Users Access Permissions tab. 2. In the opened Find Users and Groups window, type in the user/group name or login name or the beginning part of their names. Click Find to list all the matching items. To narrow your search to specific domain, select it in the Domain drop-down box. 46

55 Chapter 3 RSC Administrator Role 3. Select the user(s) or group(s) by setting the checkbox next to their names and click Add. Note Only the selections made on the currently displayed search results page can be added to the RSC Administrators list. Selections made on multiple pages are remembered only for the currently active page. 4. The selected user(s)/group(s) will show with the List permission on the Remote Computer User Access Permissions tab of the remote computer information page. It will show duplicated with its upper duplicate grayed out if the Allow inheritable permissions from the parent to propagate to this object and all child objects option is enabled. Its upper grayed out duplicate ensures that you could access all the parents that nest the container in question. Otherwise, ensure the user is present on the Users and Permissions tab of every parent nesting this computer. 5. Set the View (available for computers within the Active Directory node), to Full Control or Delegate permission as necessary by selecting the corresponding checkbox. Click Save Permissions to save and apply all permission changes. 6. See if the Allow inheritable permissions from the parent to propagate to this object and all child objects option is marked (the option is enabled by default). This option will ensure that you can access all parents that nest the container. Uncheck the option if you want only this particular user to have the specified permissions on the computer. The selected user/group will show duplicated on Remote Computer Users Access Permissions. Because the Allow inheritable permissions from the parent to propagate to this object and all child objects option is selected by default, it will also show on the Users and Permissions tab and its upper duplicate with the List permission shows grayed out indicating that this computer inherits permissions from its parent Active Directory domain or remote computer group respectively. This ensures that one will access all the parents that nest this remote computer. Disallowing RSC Helpdesk Specialists to view/push to certain objects within the domain/ou or (sub)group he/she has permissions on When adding permissions on a domain, organizational unit or remote computer group/subgroup, it may be necessary to vary availability of some child objects to manage or display in the Grid. To achieve this, use the Allow inheritable permissions from the parent to propagate to this object and all child objects option. To make certain OU or remote computer subgroups unavailable within the Grid or for management within the domain or remote computer group: 1. In the Tree pane, locate the container to which you are going to set specific permissions. 47

56 Chapter 3 RSC Administrator Role 2. Navigate to the Users and Permissions tab of the respective container to set permissions as necessary (see steps 1 through 5 of "Setting user access permissions to a specific organizational unit(s)/remote computer subgroup(s)") 3. Uncheck the option Allow inheritable permissions from the parent to propagate to this object and all child objects which is enabled by default. All of the entries displayed on the users permissions list (if any) will disappear. 4. Uncheck the option, Allow inheritable permissions from the parent to propagate to this object and all child objects, which is enabled by default, on every container that you do not want to be available for the user. You might think of adding the necessary permissions to these containers (see Setting user access permissions to a specific organizational unit(s)/remote computer subgroup(s)). Now this computer will display in the Grid only for RSC Administrators and the user account(s) indicated on the tab of the container in question. The DAWN domain contents available for RSC Administrator and the Administrator and RSCHelpdesk users. 48

57 Chapter 3 RSC Administrator Role The Domain Controller organizational unit is set to be available for management only for the Administrator user. The Frankfurt organizational unit is set to be available for management only for the RSCHelpdesk user. Only the user(s) displayed on the Users and Permissions tab (and RSC Administrators) will have rights on this container. To make certain computers unavailable/available within the Grid or for management for certain users: 1. In the Tree pane, locate the container within which you are going to vary availability for different RSC Helpdesk Specialist accounts. 2. (Optional) From within the Remote Computer Properties page of the computer you want to make unavailable, add the required user and set this user s permissions as required. 49

58 Chapter 3 RSC Administrator Role 3. Uncheck the Allow inheritable permissions from the parent to propagate to this object and all child objects option. All the entries displayed on the Remote Computer User Access Permissions list will disappear. Now this computer will display in the Grid only for RSC Administrators. Only the user(s) displayed on the Remote Computer Properties page (and RSC Administrators) will have rights on this computer. Removing/Modifying user access permissions You can remove/modify only the activated entries within the list of user permissions. To configure permission fields that are dimmed, navigate to the parent object. If you are unable to make a selection, make sure you are an RSC Administrator or if you are an RSC Helpdesk Specialist, have the Delegate permission for the RSC environment object. You can also regulate the scope of remote computers visible within the container for different users or allow/disallow push operations for different users on certain computers by manipulating the Allow inheritable permissions from the parent to propagate to this object and all child objects option (see Disallowing RSC Helpdesk Specialists to view/push to certain objects within the domain/ou or (sub)group he/she has permissions on). To remove one or more users/groups: From within the Users and Permissions tab or Remote Computer User Access Permissions list, select each user to be removed by selecting the box in the left hand column. Once the users/groups are selected, click Remove. The selected user(s)/group(s) will disappear from the list. Note: When removing users from the Users and Permissions tab, you do not remove user rights added from within the Remote Computer Properties page. To modify the user access permissions list for the desired object: 1. Locate the desired entries on the Users and Permissions tab (for a domain/organizational unit or remote computer group) or the Remote Computer Users Access Permissions tab (for a specific computer within domain/remote computer group) and set permissions as necessary by (un)selecting the boxes. To deselect the List permission, see the To remove one or more users/groups paragraph above. 2. Click Save Permissions when finished to save changes. Defining the Active Directory Groups Permissions This section is helpful for those who want to grant an RSC Helpdesk Specialist with the View or Full Control permission to a certain Active Directory user group. 50

59 Chapter 3 RSC Administrator Role In the Administrators group or Users group, you can specify any domain user group, so that all the users could automatically obtain the Full Control permission or View permission within RSC, respectively. You can only add one group of users in each field. The Administrators and Users groups govern access only to computers stored within the Active Directory node. If the permissions for a user account pertaining to one of these groups are separately set/modified within RSC, the permissions allowing more operations will govern RSC access. Note Remember to add the IP addresses of the computers from which the users added to the Administrators or Users group will access the RSC Console or perform remote computer management to the IP Filter table with the Allow Access to RSC permission. To assign Administrators/Users Group: 1. Open the Remote Support Center Security Settings page by selecting Settings-> Security Settings from the menu bar. 2. In the Active Directory Groups Permissions section, click Change next to the Administrators group or Users group. In the search window that will be displayed, type in the group name or login name or the beginning part of the names. Click Find to list all the matching items. To narrow your search to specific domain, select it in the Domain drop-down box. 3. Select the user group by checking the checkbox next to its name and click Add. You can only add one group of users in each field. By default, the users in the Administrators group acquire the Full Control permission while the users in the Users group acquire the View permission within RSC. Once the user group is added, it will display on the Security Settings page, and on the Users and Permissions tabs within the Active Directory node indicating the user permissions on every object of the node. 51

60 Chapter 3 RSC Administrator Role Viewing the Active Directory Groups Permissions section To remove the Administrators/Users Group: Open the Remote Support Center Security Settings page by selecting Settings -> Security Settings from the menu bar, and then click Unassign next to the desired user Group. The Active Directory user group will be removed from the RSC system. To edit/elevate these group permissions, follow the link. Connecting to the RSC Console Remotely Once you have performed all the necessary preliminary configurations of the RSC Console, RSC Users can connect to the RSC Console remotely. Be prepared to provide RSC Users with the RSC Console URL. The RSC Console URL may be either the RSC Server or DMZ Server (if the latter is installed) domain name or IP address. You may use either the short (NetBIOS) or long (FQDN) DNS name of the domain. Use sales.emea.yourcompany.com as a long DNS name or sales as a short name (without quotes). The URL must contain: 52

61 Chapter 3 RSC Administrator Role https to indicate the access protocol to connect to RSC Console; RSC Server or DMZ Server domain name or IP address to indicate the destination location of the RSC Console website. the default virtual directory of the RSC Console website ("rsc" by default). This default name may have been customized during installation. For example, it may look like this: 53

62 Chapter 3 RSC Administrator Role USING THE APPLICATION STATUS PAGE The Remote Support Center Status window displays information about the RSC services statuses. Viewing components statuses This table lists statuses of the following RSC components: RSC Deployment Service, RSC Maintenance Service, RSC LAN Gateway, RSC Internet Gateway (the services are detailed in Remote Support Center Components). Here you can see if the RSC component services are working properly. Additionally, you can (re)generate and download the RSC Internet Gateway package to be deployed on the DMZ Server. To display the Remote Support Center Status window: Select Application Status from the Settings menu bar. Alternatively, click View status on the RSC Home page. The Service statuses table contains the following fields detailed in the table below. Table field Service Description Lists the RSC services by their names. The LAN -> DMZ and the Internet -> DMZ entries display after the RSC Internet Gateway is successfully deployed and details the connection type and data relevant to the RSC Internet Gateway service. Host Specifies the actual port used by the associated RSC component. For the list of default ports used by RSC services, see the RSC Components 54

63 Chapter 3 RSC Administrator Role Default Port Usage chapter. Port Displays the computer hosting the RSC services. If the RSC Internet Gateway is deployed, this column will contain the IP address of the network interface installed on the DMZ Server and used to accept connections from the LAN (LAN -> DMZ) and the network interface installed on the DMZ Server that is used to accept connections from the WAN and allows connecting to the DMZ Server from WAN external networks (Internet -> DMZ). Status Action Contains the status of the component, indicating if the component is running, not running or not installed (the latter is for the RSC Internet Gateway) - Online/Offline/Not installed. Offline status indicates that the service or its host is not running or not available. Allows you to perform an action (if applicable) for the service. Click Download to generate and download the RSC Internet Gateway package. The generation process is detailed in the Preparing DMZ Server Package section of the Remote Support Center 2.5 Installation Guide. Service statuses description 55

64 Chapter 3 RSC Administrator Role USING THE APPLICATION CONFIGURATION PAGE The Remote Support Center Configuration window allows you to check or modify Invitation Settings and Administrator Account settings. Follow the links to find out the details of each section. To display the Remote Support Center Configuration window, select Application Configuration from the Settings menu bar. To edit any of the fields, use the Modify button below the required section to edit the values as necessary, unless instructed otherwise. Configuring the Invitation Settings In the Invitation Settings section of the Remote Support Center Configuration page, you can view, specify, and/or modify network, SMTP settings and other options that are used to create and send RSC Client invitations. The SMTP server-relevant settings display if you defined them during setup. Otherwise, the fields are empty, except for the standard SMTP port. Each time you enter or modify entries in the Invitation Settings dialog, the SMTP server connection data are tested for validity. If test connection fails, the corresponding message will ask you to verify the failed item. Once the test connection is successful, you can save the invitation settings. 56

65 Chapter 3 RSC Administrator Role Network settings and addresses to be used for creating and sending invitations The fields available in the Invitation Settings dialog box are detailed below. LAN Access This field defines the DNS name, NetBIOS name, or IP address of the RSC Server. By default, the RSC Console uses DNS names. If resolving the RSC Server IP address to its DNS name fails, the IP address or NetBIOS name will be used. This RSC server address is used to refer to the domain name part of the URL for downloading RSC Clients via invitations. By modifying the field, you can change to another IP address currently available on the RSC Server. If you want the RSC Remote User to download the RSC Client using the RSC Server via a different address, specify the new address for the remote user to access the RSC Server. This may be helpful if the DMZ Server is located behind the NAT and it is necessary to specify the DMZ Server public IP address. (For DMZ server, see the Preparing DMZ Server Package section of the Remote Support Center 2.5 Installation Guide.) 57

66 Chapter 3 RSC Administrator Role Select an IP address or name to be used for downloading the RSC Client External Access (available if DMZ server is installed) (For DMZ server, see the Preparing DMZ Server Package section of the Remote Support Center 2.5 Installation Guide.) This box shows the DNS name, NetBIOS name or IP address of the DMZ Server that will be used for downloading RSC Clients. By default, the RSC Console uses IP addresses for external access names to avoid resolving the DMZ Server address to an internal DMZ Server name retrieved from internal DNS server. This address is used to refer to the domain name part of the URL for downloading RSC Clients via invitations from external WAN networks. If you want an RSC Remote User to download the RSC Client from the internet using the DMZ Server via the different address (e.g. if the DMZ Server is located behind the NAT), specify the new address of DMZ Server. From Sometimes, it may be necessary to specify the senders address so the can be authenticated on the specified SMTP server when sending the invitation. This address will also be shown in the FROM field of the invitation message when received by the RSC Remote User. By default, invitations are sent from the RSC@scriptlogic.com address. SMTP Server This box shows the IP Address or DNS name of the SMTP server that will be used to send invitations to RSC Remote Users. Port The port number displays the port that will be used to interact with the SMTP server. By default, it contains the standard SMTP port 25. Use secure connection 58

67 Chapter 3 RSC Administrator Role By default, this checkbox is unchecked and the data transfer is carried out without encryption. Activate the box if you need to set a secure connection between the SMTP server and the mail recipient. Then, the sent data will be encrypted according to the secure connection policy of the mail server. To ensure the transfer process runs successfully, make sure the designated SMTP server supports the ability to establish secure connections. Authentication type Provide the Authentication type that corresponds to your SMTP server authentication method: Anonymous Access, Basic Authentication, or Integrated Windows Authentication. Setting the appropriate authentication methods. Be sure to enter the corresponding credentials. Consult the table below for the credentials necessary for each authentication mode. Authentication type Anonymous Access Basic Authentication Integrated Windows Authentication Credentials User name X X Password X X Domain X Credentials associated with the authentication type 59

68 Chapter 3 RSC Administrator Role Setting the Administrator Account The Administrator Account Settings section This is the Administrator account you provided during the RSC installation (see the description of the corresponding step of the Installing Remote Support Center chapter in the Remote Support Center 2.5 Installation Guide). This account is used to authorize push or management ( manage ) operations (when the latter is started by the user with the Full Control permission) initiated from within the RSC Console on a computer within Active Directory. When specifying these Administrator Account credentials, please ensure the user account: is granted local admin rights on all the Active Directory computers meant for remote management; is not disabled or locked; is not assigned with either the Deny log on locally or Deny log on as a service user right in Default Domain Security Settings or Local Security Settings (local to the computer RSC is being deployed); credentials are valid (not misprinted and the password is not going to expire, etc.). 60

69 Chapter 3 RSC Administrator Role RSC LICENSING All RSC Users need to have an Evaluation or Enterprise License to use the product. In addition, users can purchase optional InstantAssist licenses (available for free in the Evaluation license). An Enterprise license allows you to use RSC with ExpertAssist Clients. The license regulates the maximum number of remote computers you can manage within ExpertAssist. Since RSC version 2.1, the Enterprise license has included the RSC Internet Gateway license. The RSC Internet Gateway license extends an Enterprise license to allow management of computers which reside outside of your corporate LAN, and also allows management of LAN computers from the WAN. An optional InstantAssist license allows you to use the InstantAssist Clients to assist users who do not have or cannot have ExpertAssist installed. InstantAssist is a name based license and is limited by number of helpdesk technicians using it. WARNING Previous licenses cannot be applied and require you to update your existing licenses to version 2.0 To see your current license status and look for a complete list of the licensing parameters: Click the link to the License information section on the Home page or select Help->License Information. The Remote Support Center Licenses page with the License Status, ExpertAssist Licensing, InstantAssist Technician Licenses, and RSC Internet Gateway Licensing fields will open. 61

70 Chapter 3 RSC Administrator Role Opening licensing information on the Remote Support Center Licenses from the Home page. License Status Displays the technical support expiration date for the Enterprise or Trial licenses. ExpertAssist Licensing The section shows the ExpertAssist licensing information in the Total Licenses and Used Licenses fields. Total licenses This field shows the total number of ExpertAssist purchased licenses. Used licenses This field displays the number of ExpertAssist licenses currently in use. This typically specifies the number of unique remote computers that have been managed through ExpertAssist. A computer is recognized as managed through RSC if it has ExpertAssist installed and it has been used at least once for remote management. Once the license is used, all following management sessions on this computer will not use an additional license. InstantAssist Technician Licenses The InstantAssist Client usage is licensed per technician (domain users) that has been authorized for managing a remote computer via the InstantAssist Client. Each Active Directory user enabled for managing remote computers using InstantAssist uses one license. Use this page to authorize more Active Directory users as InstantAssist Technicians. Total licenses This field shows the total of the InstantAssist Technician licenses purchased. Used licenses This field shows the number of InstantAssist Technician Licenses currently in use. This is typically the number of unique users that have been authorized to manage remote computers via InstantAssist. The list below specifies all of the Active Directory users that have been enabled for lightweight remote management through InstantAssist. RSC Internet Gateway Licensing The RSC Internet Gateway license (anywhere management) allows the implementation of the Global Model (See Remote Support Center 2.5 Installation Guide). Starting from Remote Support Center 2.1, the RSC Internet Gateway license is combined with your Enterprise license by default and does not require extra payment. The license status always shows as Licensed in the RSC Internet Gateway Licensing section. 62

71 Chapter 3 RSC Administrator Role Adding InstantAssist Technicians The InstantAssist Client usage is licensed per technician (domain users) that has been authorized for managing a remote computer via the InstantAssist Client. Each Active Directory user enabled for managing remote computers using InstantAssist uses one license. Adding a user to authorize for management via InstantAssist To add an Active Directory user to the InstantAssist Technicians list to authorize them for performing remote management via InstantAssist: 1. Within RSC Console, click the link to the License information section on the Home page. Or, go Help -> License Information. 2. Click the Add User button under the Instant Assist Technician Licenses section. 3. In the search window that will be displayed, type in the user name or login name or the beginning part of the names. Click Find to list all the matching items. To narrow your search to specific domain, select it in the Domain drop-down box. 4. Select a user by checking the checkbox next to its name and click Add. Once the user is added to the list, one InstantAssist Technician license will be removed. Applying New Licenses Using RSC License Manager To manage your RSC license or extend the current licensing by adding more licenses, run Remote Support Center License Manager. 1. On the RSC Server, click Start > All Programs > ScriptLogic Corporation > Remote Support Center > License Manager to start the RSC License Manager. 2. In the window that opens, click Browse to locate the purchased license file. Browse for the file and click Open. The license file path will be added to the edit box. Once added, click Apply and RSC will read and apply the file. The license parameters will be updated. If you are applying a restricted license that disables some of the functionality enabled by the previously applied license, the License Manager will warn you with a corresponding message box. Click Yes to confirm the new license and overwrite the existing one. Click No to leave the current license and cancel the application of the newly provided license. 63

72 3. Click Close to exit the Remote Support Center License Manager. Chapter 3 RSC Administrator Role Working with RSC License Manager Click Launch Management Console to open the Remote Support Center Management Console. Once started, you can log into the RSC Console and view additional licensing information, authorize InstantAssist technicians or start managing the application. 64

73 Chapter 3 RSC Administrator Role USING AN EXPERTASSIST DEPLOYMENT PACKAGE RSC Administrators can use the EA Client mass deployment feature. The ExpertAssist Deployment Package is the most flexible mechanism to mass deploy the EA Client. Prepare the ExpertAssist Deployment Package, and then use Desktop Authority (or any other software deployment tools) to define a subset of computers where ExpertAssist will be installed. Once the packages are deployed, the EA Client Computer will register with the RSC Server, and will become available for management. Note ScriptLogic recommends that you try Desktop Authority for implementing granular ExpertAssist deployments. To create an ExpertAssist Deployment Package for mass deployment: 1. From the menu bar, choose Settings, and then select ExpertAssist Deployment Package. Click Download in the window that will show. Generating ExpertAssist deployment package 2. In the ExpertAssist Deployment Package window, click Save to generate and download the distribution package with ExpertAssist. 3. In the File Download window, browse for the place to store the package and click Save. By default, the package is saved to C:\Documents and Settings\USERNAME\My Documents\RSCClient.exe or C:\Users\<USERNAME>\Downloads\RSCClient.exe (depending on your operating system). 4. Once the package is saved, click Close to close the window. You can now use the saved package to install on desired computers. As soon as the package is deployed and the remote computer gets connected and registered with RSC Server (a totally automatic process), the icon of the remote computer within the Active Directory node will turn to Available for management while the remote non-active Directory NetBIOS computer name will show in the Default group of the Remote Computer Groups node appended with the icon. 65

74 Chapter 3 RSC Administrator Role Warning If the File download window did not appear, check the browser settings to see if file downloading is permitted. Tip If the browser has automatically refused to download the file, click the information yellow bar and select File Download Blocked Download File ; What s next: Organize your remote computers installed via EA Deployment Package Configure user access permissions 66

75 Chapter 3 RSC Administrator Role BLOCKING/UNBLOCKING INSTANTASSIST CLIENT COMPUTERS RSC Administrators, even if they are not issued with the special InstantAssist Technician licenses, can limit the number of IA Client Computers available for management through the RSC Console. The Remote Support Center Management Console allows you easily manipulate remote computer access in RSC and prohibit access (block) the remote PC registered with RSC thus hiding it from management within the RSC Console. Should there be the need to manage the prohibited computer again and make it visible in the Grid, an RSC Administrator or an InstantAssist Technician can re-enable (unblock) the PC in a single click right from the RSC Console. The InstantAssist Clients page allows you perform block/unblock operations right from the Grid view. The operations are detailed in Blocking/Unblocking InstantAssist Client Computers. 67

76 Chapter 4 RSC Helpdesk Specialist Role The RSC Helpdesk Specialist is an Active Directory user of Remote Support Center who is authorized by an RSC Administrator to connect to and manage LAN/WAN-based remote computers. This process is performed from within the RSC Console accessed via the RSC User s Browser from an IP address added to the IP Filter list. (See the Before You Begin part of the Logging into RSC Console section.) The chapter covers information necessary to perform the RSC Helpdesk Specialist role and is comprised of the following sections: Logging into the RSC Console Setting/Modifying User Access Permissions Blocking/Unblocking InstantAssist Client Computers Pushing ExpertAssist Client(s) to a Remote Computer Centralized Uninstallation of ExpertAssist Client(s) Inviting Remote Computer for Management with ExpertAssist Regenerating Invitations Deploying Remote Computer with InstantAssist Managing Remote Computer via ExpertAssist Managing Remote Computer via InstantAssist Before You Begin The RSC Administrator needs to perform a security configuration in the RSC Console, to allow the RSC Helpdesk Specialist access RSC. The following settings need to be configured: 1. Your local computer IP address should be added to the list of IP's allowed to access RSC (Defining IP Filter Rules). 2. Your domain account should be added to the list of users permitted at least to access and manage the domain/organizational unit/remote computer (sub)group/remote computer(s) you plan to administer. Follow the link, to see how to view your access permission. 3. (If necessary) If planning to manage remote computers with InstantAssist Client, ensure an InstantAssist Technician License is issued to your domain account. 68

77 Chapter 4 RSC Helpdesk Specialist Role Logging into RSC Console To start accomplishing your RSC tasks, you have to connect to the RSC Console via an internet browser. To log into the RSC Console from your computer: 1. In the browser, type the RSC Console URL into the address bar. (Ask your RSC Administrator to provide you with the right URL to connect to RSC Console. Depending on your location (LAN or Internet) and RSC Console configurations (Internet Gateway installed or not), this may be different. The URL must contain: https to indicate the access protocol to connect to RSC Console; RSC Server or DMZ Server domain name or IP address to indicate destination location of the RSC Console website. the default virtual directory of the RSC Console website - "rsc" by default. (Note that this default name may have been customized during installation). For example, it may look like this: 2. (If logging into RSC upgraded from previous versions and using self-signed SSL certificate generated by these previous versions) Accept the browser security warning by clicking Continue to the website. 69

78 Chapter 4 RSC Helpdesk Specialist Role Accessing the RSC Console despite the Certificate Error 3. (For Windows Server 2003 and Windows Server 2008) When using Internet Explorer with the Internet Enhanced Security Configuration mode (IEESC mode) enabled, click Add and choose to add the automatically provided RSC Console web site URL to the Trusted Sites security zone. To do that, click Add in the Trusted sites dialog box. Click Close to close the window and proceed with opening the RSC Console. 70

79 Chapter 4 RSC Helpdesk Specialist Role Adding the RSC Console site to the Trusted Sites zone 4. In the Remote Support Center Console Login page, provide your Active Directory user name, password and the company domain name. Click the Login button to enter the RSC Console. Once you have successfully logged into the RSC Console, you may start: Exploring your available RSC environment to locate your target remote computers for remote management; Organize within your Remote Computer Groups (if applicable); Provision your target remote computers with ExpertAssist or InstantAssist client software to start the remote management session; Manage your RSC Clients via ExpertAssist or InstantAssist; Grant your RSC objects access permissions to other RSC Users (if applicable). 71

80 Chapter 4 RSC Helpdesk Specialist Role SETTING/MODIFYING USER ACCESS PERMISSIONS If the RSC Administrator has provided you with Delegate permissions on the RSC objects under your management, then you can add/remove/modify permissions on these objects to other Active Directory domain users. The concept of user access permissions implemented in RSC and instructions on how to use it is detailed in the Granting User Access Permissions to RSC Helpdesk Specialists section. To see if you have the Delegate permission, see Viewing User Access Permissions. 72

81 Chapter 4 RSC Helpdesk Specialist Role BLOCKING/UNBLOCKING INSTANTASSIST CLIENT COMPUTERS If you are issued with a special InstantAssist license, the Remote Support Center Management Console allows you easily manipulate InstantAssist Client Computers access to RSC and prohibit access for the computers registered with RSC thus hiding them from management within the RSC Console. Should there be the need to manage the prohibited computers again and make them visible in the Grid, an RSC User can reenable the PC s in a single click right from the Console. To block IA Client Computer(s): 1. Within the InstantAssist Clients node, on the Computers tab, navigate to the desired computer(s) using the Grid. Use filtering when necessary. 2. By marking in the checkbox(s), select the desired computer(s), and then click the Block Computer(s) button on the Grid toolbar that will active. Confirm blocking by clicking OK in the message box. Once confirmed, the selected IA Client Computer(s) will immediately be blocked from accessing RSC Console and moved to the Blocked Computers tab. To view the list of blocked IA Client Computers: Within the InstantAssist Clients node, switch to the Blocked computers tab showing in the standard grid of the Grid pane (lacks some field and values). Click the Refresh button on the grid toolbar if necessary. To unblock IA Client Computer(s): 1. Within the InstantAssist Clients node, on the Blocked Computers tab, navigate to the desired computer(s) using the Grid. Use filtering when necessary. 2. By marking in the checkbox(s), select the desired computer(s), and then click the corresponding Unblock link(s) in the Operation column or use the activated Unblock Computer(s) button on the Grid toolbar. 73

82 Chapter 4 RSC Helpdesk Specialist Role INSTALLING REMOTE SUPPORT CENTER CLIENTS TO REMOTE COMPUTERSERROR! BOOKMARK NOT DEFINED. Note Only RSC Administrators and RSC Helpdesk Specialists with the Full Control permission may install the EA Client onto remote computers from within the RSC Console. In order to perform remote management via RSC, the remote computer should be deployed with one of RSC s two clients - ExpertAssist or InstantAssist. The choice of which client software to install depends on the scope of functionality you need to meet your remote computer administration goals and interactive user availability on the target computer. ExpertAssist This client features the most powerful management functionality and can be installed on a remote computer via bulk deployment (available only for RSC Administrators - refer to Using an ExpertAssist Deployment Package), pushed to a selected Active Directory computer, organizational unit or domain, or via a generated invitation. Pushed EA Clients can also be automatically removed from the remote computer. There are two ways to remotely deploy ExpertAssist to a target computer: push and invite. Push Push is used to automatically deploy the client software to the network computers that are members of Active Directory and located in the LAN without user intervention needed on the target computer to complete the deployment. You can push the EA Client to a number of remote computers in one pass. Invite Inviting a remote computer allows the RSC User to make the target remote computer available for remote management through the RSC Management Console when push operation cannot be performed. Then you can send an invitation to the user whose computer cannot be deployed with ExpertAssist right from the Management Console or via ExpertAssist Deployment Package. Typically these are users using external remote computers located outside the LAN network. It can also be users of LAN computers which are not part of the Active Directory infrastructure. See: Pushing ExpertAssist Client to a Remote Computer Centralized Uninstallation of ExpertAssist Client(s) Inviting Remote Computer for Management via ExpertAssist InstantAssist (requires additional license) This lightweight client enables a quick and easy on-demand management session of a remote computer. InstantAssist does not require installation and can be run on the remote side by simply double-clicking the downloaded file. This streamlined client 74

83 Chapter 4 RSC Helpdesk Specialist Role enables a remote computer for management even if the remote user does not have administrative privileges on his computer. To install the Instant Assist Client, you need to have an InstantAssist Technician license. See: Deploying Remote Computer with InstantAssist Pushing ExpertAssist Client to a Remote Computer ExpertAssist can be remotely pushed to an Active Directory computer(s) or group of computers that are located in the LAN and are powered on during client deployment. Note The account used to authorize the ExpertAssist push is the Administrator Account. Push is used to automatically deploy the client software to the network computers that are members of Active Directory and located in the LAN without user intervention needed on the target computer to complete the deployment. You can push EA Client to a number of remote computers in one pass. To ensure the push operation will run successfully, check that: 1. your user account is provided with at least the Full Control permission or you are RSC Administrator; 2. the target computer is powered on, is a domain member and is located in LAN; 3. the Remote Procedure Call (RPC) service and Remote Registry are running on the remote computer; 4. TCP port 139 and UDP port 137 are opened on the target computer; 5. the Administrator Account meets all the necessary requirements since this is the account used to authorize the ExpertAssist push. To push ExpertAssist Client to computer(s) or a domain: 1. Using the Grid view, navigate to the domain/organizational unit/computer(s) you plan to push with EA Client. Use search or filtering when necessary. 2. Initiate the Push command in one of these ways: a. (When pushing to a single unit: (domain/organizational unit/computer) In the Operation column of the Grid, click Push next to the name of a computer/organizational unit/domain. 75

84 Chapter 4 RSC Helpdesk Specialist Role Pushing ExpertAssist to domain from the Grid Alternatively, when pushing to a single computer, click on the computer name in the Name column to open Remote Computer Properties page, and then click Push ExpertAssist Client Software. Pushing ExpertAssist from the Remote Computer Properties page b. (When pushing to a set of computers/groups) Select the computers/organizational units/domains to install ExpertAssist by checking in the neighboring box, and then click the Push button on the Grid toolbar. 76

85 Chapter 4 RSC Helpdesk Specialist Role The rolling azure ring icon displayed next to each of the computers being pushed indicates a push is in progress. During deployment, the Type column shows Installation is in progress for each of the computers. To look for the push progress within an organizational unit/domain, click on the name of the object. This will open the object, listing all the computers that are members of the selected unit. ExpertAssist push is in progress Once the EA Client is installed and registered with RSC, the remote computer status will change to Available for management. At the same time Push in the Operation column will change to Manage indicating that the remote computer is ready for remote management. (See Managing Remote Computer via ExpertAssist) If for some reason the push operation did not succeed, the computer status icon will be accompanied with the warning icon in the Type column. When hovering over the icon, the description of the problems which prevented the push to complete will show in the tooltip. By clicking on the icon, you ll navigate to the Error Log tab of the Remote Computer Properties page that details the error. To resolve the problem, see Troubleshooting. What's next: Managing Remote Computer via ExpertAssist Centralized Uninstallation of ExpertAssist Client(s) Inviting Remote Computer(s) for Management with ExpertAssist Invite any target computer that does not display in the Active Directory node. You may also decide to invite your Active Directory computer that has failed to be deployed with ExpertAssist via push. By inviting a remote computer, you create and transfer a link to an EA installation package to your remote user by or any other means of your choice. You specify the parameters needed for the RSC system to create an invitation that can be submitted to the user of the remote computer. The created invitation will contain 77

86 Chapter 4 RSC Helpdesk Specialist Role instructions on downloading and installing the RSC client software on the remote computer. Once the remote user installs the software, the RSC User can manage the target computer. To invite a remote computer for management with ExpertAssist Client: 1. Open the Invite New Remote Computer page. a. (For the computer within the Active Directory node), use the link on the name of the desired computer within the Grid to open the Remote Computer Properties page and then click the Invite Remote Computer button. Inviting Active Directory computer that has failed to be pushed with ExpertAssist b. From within the Remote Computer Groups node, navigate to the Default or any other group (if available) and click Invite on the table toolbar. Inviting a remote computer for management via ExpertAssist 2. On the Invite New Remote Computer page, provide the RSC system with data necessary to create an invitation that will be submitted to the user of the remote computer. 78

87 Chapter 4 RSC Helpdesk Specialist Role Use the table below for reference. Field Description Remote (Applicable if the Invite New Remote Computer page is not Computer opened from the Remote Computer Properties section) Name Use alphabetic, numeric, underscore (_), and hyphen (-) characters to reference the invited computer in the Remote Computer Groups node. This name will also be used to address the remote user when sending the invitation by . Invitation Delivery Choose this option to specify the remote user s address if invitation to you want the system to send the user on the remote computer instructions on how to download and install the ExpertAssist once the unique invitation URL is created. If the warning note SMTP Server details were not provided displays, go the Application Configuration page to provide the SMTP server data. Display invitation Choose this option if you are going to provide your remote user with the link on instructions on downloading and installing the ExpertAssist. Advanced Settings Invitation is Modify the default 24-hour interval during which the invitation valid for will stay valid if necessary. Once an invitation expires, an external remote computer user will not be allowed to download the ExpertAssist. The value should not exceed 168 hours - one week). Add new Remote Computer to (Available only for Remote Computer Groups objects) Select the group to place the invited computer to. (You may view and choose only between the groups on which you have permissions.) Tips to specify fields on the Invite New Remote Computer page Specifying invitation parameters 79

88 Chapter 4 RSC Helpdesk Specialist Role 3. When you are done filling in the fields of the Invite New Remote Computer page, click Create Invitation to view/edit the generated invitation data. 4. Confirm and/or edit the invitation confirmation page (if applicable). The invitation confirmation pages differ depending on type of the Invitation Delivery you have selected on the previous step invitation or Display invitation (use the links to detail each type of the confirmation). Once the installation package is generated, the remote computer name will show in the Grid of the Remote Computer Groups node appended with the Invited icon. The icon won t change to Available for management until the Remote User deploys the target computer with the EA Client (see ExpertAssist Installation). What s next: Edit the Invitation Confirm the displayed invitation Centralized Uninstallation of ExpertAssist Client(s) Organize within your Remote Computer Groups by using the Grid toolbar buttons Manage your available for management EA Client Computers Regenerate invitations Editing the Invitation If the Invitation option is selected during invitation creation, the following dialog will be displayed following the Invite New Remote Computer page. The invitation confirmation page You can edit the mail body text or just view and send the invitation message to the user of the target computer. The message contains: 80

89 Chapter 4 RSC Helpdesk Specialist Role addressing the remote user by referring to the name used in Remote Computer Name, identification of the sender by referring to the domain part of the user account name, the invitation expiration date, instructions to install ExpertAssist in order to prepare the target computer for remote administration, download links to the ExpertAssist package via the IP address(es) of the RSC Server and DMZ server (if the latter is installed) specified on the Application Configuration page. You may advise the remote user to use the link with the DMZ server IP address if accessing the install package from the Internet, or the RSC Server if accessing the install package from LAN. package installation links with the package ID incorporated and the option to enter the package ID manually in case the download fails to start. Once the invitation is generated and displayed, click Send invitation to the invitation as is to the user, or Edit to perform additional edits if necessary. To edit the text of the invitation: 1. Click Edit at the bottom of the invitation page. The window to modify the text will open. Editing the generated invitation body. 2. You can modify the text as needed. Take care not to break the placeholders within the [ ], otherwise the invitation links will be corrupted. (The placeholders are referenced in the table below.) If you wish, you may use the placeholders accompanied with text of your own to create the invitation letter as needed. Placeholder [ID] Description Used to enter the unique download ID for the generated ExpertAssist invitation package. 81

90 Tip Chapter 4 RSC Helpdesk Specialist Role [LINK] Used to enter the unique download links for downloading the ExpertAssist without specifying the [ID]. [EXPIRATION_ Used to put the expiration date for the download link. This date DATE] is set on the Invite New Computer page. Using placeholders for customizing an invitation 3. Once the text edits are complete, click Apply to save the changes and click Send invitation, or click Save & send invitation to save the text edits and immediately send the . To specify a custom value to be displayed in the FROM field, please see the Invitation Settings section on the Application Configuration page to configure that. As the user receives the invitation, he or she will see the following in their Inbox. Remote computer user receives invitation Confirming the Displayed Invitation If the Display Invitation option is selected during the invitation creation process, the following dialog will be displayed with the package information. 82

91 Chapter 4 RSC Helpdesk Specialist Role Invitation URLs are being displayed for custom delivery The invitation page provides instructions for downloading the generated ExpertAssist client EXE package. This page includes links for a user to download the package from the LAN or the Internet. The generated ExpertAssist download has a unique package ID. The RSC helpdesk specialist or administrator should provide the end user with the information on the displayed invitation. At the bottom of the page there is an invitation expiration date. Please be sure to use the generated download URLs before this date. After this date the link will expire and you will have to create a new invitation for the user to be able to download ExpertAssist. Regenerating Invitations You can regenerate the EA Client deployment invitations for remote computers in the Invited status. Regenerate the invitation if the invitation has expired before the RSC Remote User could use it to download the EA Client. When regenerating the invitation you can change any data/settings specified during invitation creation, i.e. type of invitation delivery or computer name (for available settings see Inviting Remote Computers for Management with ExpertAssist). To regenerate invitations: 83

92 Chapter 4 RSC Helpdesk Specialist Role Within the Grid, click the Regenerate link in the Operation column of the desired computer name, and then configure the available fields as necessary (see Inviting Remote Computer (s) for Management with ExpertAssist for details). For computers within the Active Directory node for which the link is not available, just use Invite Remote Computer on the Remote Computer Properties page. Centralized Uninstallation of ExpertAssist Client(s) RSC 2.5 features the possibility to remove the EA Client from the Active Directory and Remote Computer Groups computers right from within the RSC Console. Now you can ensure the complete removal of the EA Client software without the need to be physically present at the remote computer. The client software will be instantly removed from the computers that are in the Available for management status. Once the uninstall command is triggered, the client software will be removed from computers in the Client software is inactive or Invited state, as soon as they connect to RSC Console. The uninstall operation is available for RSC Administrators and RSC Users granted at least with the Full Control permission. Note You can uninstall only the EA Clients deployed via RSC 2.5. Consider redeploying the client software with the newer version, if necessary. To uninstall EA Client(s) from computer(s). 1. From within the Grid, select EA Client Computer(s) with,, status, or any other object with computers inside. 2. Click the Uninstall button on the Grid toolbar to entirely remove the EA client software from the remote computer(s). 3. When the uninstallation completes, the remote computer within the Active Directory node shows with the the Remote Computer Groups node with an Client is not installed status, and within Invited status. The computer(s) which were in the, statuses when the uninstall command was initiated will gain the Pending for uninstallation status until they get connected to RSC and remove the EA client software. 84

93 Chapter 4 RSC Helpdesk Specialist Role Uninstalling EA Client from a remote computer. You can cancel uninstallation while the EA Client Computer is in the Pending for uninstallation status waiting in the queue for the client software to be removed. If for some reason uninstallation did not succeed, the computer status icon will be accompanied with the warning icon in the Status column. When hovering over the icon, the description of the problem which prevented the removal to complete will show in the tooltip. By clicking on the icon, you ll navigate to the Error Log tab of the Remote Computer Properties page that details the error to help you overcome the problem. Note We recommend that you reboot the remote computer after removing the client software. Deploying Remote Computer with InstantAssist You can invite the remote user for a quick on-demand management session through the lightweight InstantAssist client. By deploying the InstantAssist client to a target computer you can: Access the remote-control functionality Perform file upload To take advantage of these opportunities, first create an InstantAssist invitation to invite an external remote computer for management via RSC InstantAssist: 1. From the RSC Console menu bar, click Client Deployment and then select InstantAssist Client. The InstantAssist Invitation page will display if your domain account is issued with the special InstantAssist license. 85

94 Chapter 4 RSC Helpdesk Specialist Role 2. (If sending the copied URLs using a standalone client) On the InstantAssist Invitation page, copy the provided URLs for downloading InstantAssist and provide this to the user of the target computer (For instructions to install the InstantAssist executable, see InstantAssist Installation). 3. (If sending invitation via ) a. (Optional) Edit the message body to be sent to the remote user in the Download Instructions section, if necessary. b. In the Send to edit box, specify the address of the remote user to send the InstantAssist invitation automatically. c. Click Send to and RSC will mail the created invitation message to the remote user. 4. Click Close to exit the page. The InstantAssist Invitation page. Sending invitation for management via InstantAssist. As the user receives the invitation into his box, he or she will see the following in their Inbox. 86

95 Chapter 4 RSC Helpdesk Specialist Role The Remote User receives InstantAssist invitation Once the InstantAssist package is installed on the remote computer, the remote computer name will show in the Grid of the InstantAssist Clients node appended with the What s next: Available for management icon. Blocking/Unblocking InstantAssist Clients InstantAssist Installation Managing Remote Computer via InstantAssist 87

96 Chapter 4 RSC Helpdesk Specialist Role MANAGING REMOTE COMPUTER VIA EXPERTASSIST You can start managing a remote computer that has been successfully deployed with the EA Client and is currently connected to RSC Console by opening the ExpertAssist management window in a browser. There are two ways to open the window and conduct the remote management session: via RSC Console, by using the Manage link in the Operation column of the Grid or the Manage Remote Computer link within the Remote Computer Properties page. (For Active Directory computers only) by specifying the remote computer URL in the IE address bar. Thus, you can omit the connecting to RSC Console step to start the remote management session. Note When managing computers within the Active Directory node, your remote administration capabilities differ depending on the permissions, View or Full Control, your user account is granted. To start remote administration from the RSC Console: 1. In the RSC Console, navigate to the desired EA Client Computer, and click the Manage link in the Operation column of the Grid; OR Click on the remote computer name, and then click the Manage Remote Computer link. These options are only available if the EA Client is installed on the remote computer and it stays connected to RSC. 2. If the login page appears, enter either your RSC user account or credentials of the local user on the target remote computer. Starting remote computer management via Grid To start remote administration of the Active Directory computer by specifying its URL: 1. First ensure (contact your RSC Administrator for more info): that the remote EA Client has been installed with RSC version no later than 2.5; 88

97 Chapter 4 RSC Helpdesk Specialist Role that all the IP addresses of the computer from which you initiate the management session are added to the RSC IP Filter table, even if this one is the RSC Server host; you have at least View permission on the computer you are going to manage; 2. Then, in your browser, enter the desired EA Client Computer URL. The URL must contain: the access protocol - https or http; the EA Client Computer NetBIOS or DNS name or IP address (the IP address is preferable); the TCP port on the EA Client computer by default For example, it may look like this: These are the default settings for the first time access to the EA Client management window. They can be configured via the ExpertAssist Console (applicable for RSC Administrators and RSC Helpdesk Specialists with the Full Control or Delegate permission). OR If you are a Help Desk Authority user, just use the link HDA has generated for you to manage the EA Client Computer. 3. If the login page appears, enter your RSC User account. In both scenarios, you'll be connected to the selected EA Client Computer. RSC will confirm that the user account has permission to access and/or manage the remote computer and once validated, a new browser window will open. Note You must install Java Runtime Environment on your computer to start just remotely managing the EA Client Computer within the browser. More information on Java support can be found on Sun Microsystems web site ( 89

98 Chapter 4 RSC Helpdesk Specialist Role MANAGING REMOTE COMPUTER VIA INSTANTASSIST With the InstantAssist Client installed and started on the remote computer, specially assigned RSC Users can perform remote-control or file transfer operations on the InstantAssist Client Computer. Once the remote user starts InstantAssist on his/her computer, it establishes a connection to the RSC Server. The RSC Server IP address used for the current remote session is displayed in the status window of InstantAssist on the remote desktop. InstantAssist can also establish connections to the range of RSC Servers (depending on configuration of RSC). So if one of the client/server communication channels fails, InstantAssist will be able to maintain the management session by switching to another available connection. IA is searching for sources to connect to RSC Server The computers with InstantAssist deployed to them are stored in the special InstantAssist node of the Tree pane. If the computer is ready for a management session, the Manage icon next to its name shows in the Operation column. The Insurance computer displays in the InstantAssist Clients node. The Manage link next to it indicates that the computer is ready for remote management session. Before you begin the management session, ensure: the remote user has received the RSCIA file for download and started it on his/her computer. you are authorized as an InstantAssist Technician (is an Active Directory user enabled for managing of remote computers using an InstantAssist account. 90

99 Chapter 4 RSC Helpdesk Specialist Role To start the remote management session: 1. From within the InstantAssist Clients node, click Manage next to the desired computer. The InstantAssist browser window will download. If a Java message appears, proceed with the download by clicking either the Yes or Ok buttons. 2. The browser window will show the connection status and, if successful, the remote computer desktop will display. (If necessary) To get control over the remote user desktop, instruct the remote user to switch to the Share control mode in the InstantAssist status window. Thus, you will be allowed direct management access to remote desktop and will be granted with privileges to control the remote desktop to perform actions remotely. Remote desktop appears on the Helpdesk specialist workstation. Now you can conduct the remote-control session or perform a file upload. Make use of the available toolbar, when necessary: Icons and menu items Send special keys Description Run hotkey commands on remote user computer 91

100 Chapter 4 RSC Helpdesk Specialist Role Active monitor Zoom Displays the monitor model of the remote computer. Zoom in or out the desktop image. Opens dialogue to upload file to remote desktop Zoom remote screen to fit client screen Set the original remote screen resolution Switch to full screen mode (Performance) Optimized for speed (Performance) Balanced (Performance) Optimized for quality Remote desktop displays at the 8-bit color depth. This reduces bandwidth usage and increase data transfer rate. Depending on network throughput, the session performance balanced for both transfer rate and quality. The session performance is optimized to set the remote desktop picture to the original screen resolution. Tip To achieve quicker screen transmission during the remote-control session, select Optimize for speed from the Performance menu on the toolbar. The color intensity of the desktop picture will drop to reduce remote-control downtimes. Remote Desktop File Upload InstantAssist provides the opportunity to upload files to the remote desktop. To take advantage of this functionality: 1. In the InstantAssist IE window, click the icon on the toolbar. 92

101 Chapter 4 RSC Helpdesk Specialist Role File for upload is selected. It will be transferred to remote desktop once the Open button is clicked on. 2. Locate the desired file on your computer in the window that appears and click Open. The selected file will upload to the remote user desktop. The progress bar next to the Note icon will display when the data transfer process has started. File upload causes overload on a remote session channel and blocks running any commands until the file upload is finished. 93

102 Chapter 5 RSC Remote User Role When an invitation is created, an executable is made available for download by an RSC Remote User. The package consists of the ExpertAssist Client. The InstantAssist Client is downloaded as a tiny executable. The user of the remote computer can be sent an telling them to access and download the package, or the invitation can simply be displayed to the RSC User creating the invitation. Regardless of how the user of the remote computer is made aware of the remote management client available for download, it must be downloaded and installed so that the RSC User can manage the computer. See: ExpertAssist Installation Manually Installing the ExpertAssist Package InstantAssist Installation ExpertAssist Installation Respond to the invitation: 1. Enter the provided secure URL in the address bar of the browser. This URL will connect to the server which allows the download of the ExpertAssist package. 2. Click Continue to this web site if the Certificate Error appears. 3. Enter the provided Package ID, if necessary, and click Install. This will download and automatically install ExpertAssist to your computer. 94

103 Chapter 5 RSC Remote User Role Automatically Installing ExpertAssist to your computer 4. Confirm to install the Remote Support Center Binary add-on. This ActiveX component is necessary to proceed with automatic ExpertAssist installation. Internet Explorer information bar asking for permission to install the add-on Right-click the information bar and select Install This Add-on for All Users on This Computer. Click Install in the Security Warning message box. Installing add-on 95

104 Warning Chapter 5 RSC Remote User Role Once the Package ID is verified, the EA Client will be downloaded and automatically installed to the remote computer. No user interaction is necessary. If asked to choose whether to remove or repair the software, choose Remove, and then reboot when finished. Repeat the installation process. When installing ExpertAssist, make sure you are running the web browser with administrative privileges. Warning On Vista/Windows Server 2008 systems, make sure to run the web browser with elevated privileges. Manually Installing the ExpertAssist Package If, for some reason, the package cannot be automatically installed: 1. Click the Download link to download the installation files to your computer for manual installation. Downloading ExpertAssist package for manual installation 96

105 Chapter 5 RSC Remote User Role Saving downloaded ExpertAssist package for manual setup 2. Click Save. The package RSCClient.exe will be saved to the target destination. When download is complete, run the downloaded ExpertAssist setup package. Alternatively, click Run to launch the client installation process immediately. 3. When beginning the installation process, the following dialog will be displayed to the user. Click Run to start the installation program. Starting ExpertAssist setup 4. The first dialog is Welcome to the ExpertAssist Installation dialog. Click Next to continue and install the ExpertAssist Client on your computer. Click Cancel to quit. If asked to choose whether to remove or repair the software, choose Remove, and then reboot when finished. Run the downloaded ExpertAssist setup package again. Warning During the client installation, the screen may become blank for a few seconds. This is normal and is a necessary part of client installation procedure. 97

106 Chapter 5 RSC Remote User Role 5. Once all files are successfully installed, click Close to complete the installation of ExpertAssist. The ExpertAssist icon will be displayed in the system tray. The ExpertAssist software automatically installs a client certificate so that the remote computer can communicate with RSC. InstantAssist Installation Respond to the invitation sent by the RSC Helpdesk Specialist using the provided secure URL in the address bar of the browser. This URL will connect to the server which allows the download of the InstantAssist package. Once connected to the RSC Server, the web browser will automatically offer to download or run the InstantAssist package. Saving InstantAssist to your computer Click Save. The executable RSCIA.exe will be saved to the target destination. When download is complete, run the downloaded InstantAssist executable. Alternatively, click Run to launch the client immediately. When beginning the installation process, the following dialog will be displayed to the user. Click Run to start the installation program. 98

107 Chapter 5 RSC Remote User Role Starting InstantAssist client Once the client has extracted the necessary system files packed within the executable, it will immediately launch on your desktop. When started, the small InstantAssist window will appear in the down right corner of your screen right top of the taskbar notification area. InstantAssist client has started and ready for management Once started, InstantAssist is ready for external connections. It will notify RSC about its presence online and become available for management through the RSC Console. Any RSC User can now securely connect to the desktop from RSC. By default, InstantAssist starts in protected mode. This mode allows the caller (the one who has started management from the Console) to only monitor your actions. This guarantees no one will be able to use your data, change your settings, move your windows, and interfere with your work until permitted by you. Click the Share control button to allow the caller direct management access to your desktop thus granting him with privileges to control your desktop and perform actions remotely. Warning When working on Windows Vista/Server 2008, please ensure to run the InstantAssist executable with elevated privileges if you want the remote administrator be able to remotely control elevated applications (like command prompt) running on your desktop. 99