Figure 13-12 The expert s Remote Assistance interface in VB.NET

Paint Data Matrix in VB.NET Figure 13-12 The expert s Remote Assistance interface

Because an expert offering remote assistance to another user can perform virtually any activity on the remote computer that the local user can, this feature can be a significant security hazard. An unauthorized user who takes control of a computer using Remote Assistance can cause almost unlimited damage. However, Remote Assistance is designed to minimize the dangers. Some of the protective features of Remote Assistance are as follows:

Invitations No person can connect to another computer using Remote Assis tance unless that person has received an invitation from the client. Clients can configure the effective lifespan of their invitations in minutes, hours, or days, to prevent experts from attempting to connect to the computer later.

13-25

Interactive connectivity When an expert accepts an invitation from a client and attempts to connect to the computer, a user must be present at the client console to grant the expert access. You cannot use Remote Assistance to connect to an unattended computer. Client-side control The client always has ultimate control over a Remote Assistance connection. The client can terminate the connection at any time, by pressing the Esc key or clicking Stop Control (ESC) in the client-side Remote Assistance page. Remote control configuration Using the System Properties dialog box or Remote Assistance group policies, users and administrators can specify whether experts are permitted to take control of client computers. An expert who has readonly access cannot modify the computer s configuration in any way using Remote Access. The group policies also enable administrators to grant specific users expert status, so that no one else can use Remote Access to connect to a client computer, even with the client s permission. Firewalls Remote Assistance uses Transmission Control Protocol (TCP) port number 3389 for all its network communications. For networks that use Remote Assistance internally and are also connected to the Internet, it is recommended that network administrators block this port in their firewalls, to prevent users outside the network from taking control of computers that request remote assistance. However, it is also possible to provide remote assistance to clients over the Internet, which would require leaving port 3389 open.

While Remote Assistance is intended to enable users to obtain interactive help from other users, Remote Desktop is an administrative feature that enables users to access computers from remote locations, with no interaction required at the remote site. Remote Desktop is essentially a remote control program for computers running Windows Server 2003 and Windows XP; there are no invitations and no read-only capabilities. When you connect to a computer using Remote Desktop, you can operate the remote computer as though you were sitting at the console and perform most configuration and application tasks.

One of the most useful application of Remote Desktop is to connect to servers, such as those in a locked closet or data center, that are not otherwise easily acces sible. In fact, some administrators run their servers without monitors or input devices once the initial installation and configuration of the computer is complete, relying solely on Remote Desktop access for everyday monitoring and maintenance.

13-26

13

Be sure that you understand the differences between Remote Assistance and Remote Desktop, and that you understand the applications for which each is used.

Remote Desktop For Administration is essentially an application of the Terminal Services service supplied with Windows Server 2003. A desktop version called Remote Desktop is included with Windows XP Professional. When you use Terminal Services to host a large number of clients, you must purchase licenses for them. However, Windows Server 2003 and Windows XP allow up to two simultaneous Remote Desktop connections without the need for a separate license. When you connect to a computer using Remote Desktop, the system creates a separate session for you, independent of the console session. This means that even someone working at the console cannot see what you are doing. You must log on when con necting using Remote Desktop, just as you would if you were sitting at the console, meaning that you must have a user account and the appropriate permissions to access the host system. After you log on, the system displays the desktop configuration asso ciated with your user account, and you can then proceed to work as you normally would.