Lesson 12: Configuring Remote Management MOAC 70-687: Configuring Windows 8.1

Overview Exam Objective 3.4: Configure remote management Choose the appropriate remote management tools Configure remote management settings Modify settings remotely by using MMCs or Windows PowerShell Configure Remote Assistance, including Easy Connect Lecture notes go here © 2013 John Wiley & Sons, Inc.

Using Remote Access Technologies Lesson 12: Configuring Remote Management Lecture notes go here © 2013 John Wiley & Sons, Inc.

Using Microsoft Management Console The shortcuts to various Microsoft Management Console (MMC) tools that appear in Windows 8.1 are all configured to manage resources on the local system. There are two ways to access a remote computer using an Microsoft Management Console (MMC) snap-in: Redirect an existing snap-in to another system Create a custom console with snap-ins directed to other systems © 2013 John Wiley & Sons, Inc.

Redirecting a Snap-in A snap-in that is directed at a specific system typically has a Connect To Another Computer command in its Action menu. Selecting this command opens a Select Computer dialog box in which you can specify or browse to another computer on the network. Once you select the name of the computer you want to manage and click OK, the snap-in element in the scope pane changes to reflect the name of the computer you selected. © 2013 John Wiley & Sons, Inc.

The Select Computer dialog box in an MMC console Redirecting a Snap-in The Select Computer dialog box in an MMC console © 2013 John Wiley & Sons, Inc.

Creating a Remote Console When you add a snap-in to a custom console, you select the computer you want to manage with that snap-in. You can also add multiple copies of the same snap-in to a custom console, with each one pointed at a different computer. This enables you to monitor the event logs for computers all over the network from a single console. © 2013 John Wiley & Sons, Inc.

Using Remote Assistance Remote Assistance eliminates the need for administrative personnel to travel to a user’s location for any of the following reasons: Training Technical support Troubleshooting To receive remote assistance, the computer running Windows 8.1 must be configured to use the Remote Assistance feature in one of the following ways: Using Control Panel Using Group Policy Training – Trainers and help desk personnel can demonstrate procedures to users right on their systems, without having to travel to their locations. Technical support – A desktop administrator can use Remote Assistance to connect to a remote computer to modify configuration parameters, install new software, or troubleshoot user problems. Troubleshooting – By connecting in read-only mode, an expert can observe a remote user’s activities and determine whether improper procedures are the source of problems the user is experiencing. The expert can also connect in interactive mode to try to recreate the problem or to modify system settings to resolve it. This is far more efficient than trying to give instructions to inexperienced users over the telephone. © 2013 John Wiley & Sons, Inc.

Using Remote Assistance The Remote tab of the System Properties sheet © 2013 John Wiley & Sons, Inc.

Using Remote Assistance The Solicited Remote Assistance policy in the Group Policy Object Editor console © 2013 John Wiley & Sons, Inc.

Creating an Invitation To request a Remote Assistance session, a client must issue an invitation and send it to a particular expert. The client can send the invitation using email, or save it as a file to be sent to the expert in some other manner. © 2013 John Wiley & Sons, Inc.

Creating an Invitation The How do you want to invite your trusted helper? page in the Windows Remote Assistance wizard © 2013 John Wiley & Sons, Inc.

Creating an Invitation The Give your helper the invitation file and password page of the Windows Remote Assistance wizard © 2013 John Wiley & Sons, Inc.

Securing Remote Assistance An unauthorized user who takes control of a computer using Remote Assistance can cause almost unlimited damage. Remote Assistance is designed to minimize the dangers. Some of the protective features of Remote Assistance are: Invitations Interactive connectivity Client-side control Remote control configuration Firewalls • Invitations – No person can connect to another computer using Remote Assistance unless that person has received an invitation from the client. Clients can configure the effective lifespan of their invitations in minutes, hours, or days to prevent experts from attempting to connect to the computer later. • Interactive connectivity – When an expert accepts an invitation from a client and attempts to connect to the computer, a user must be present at the client console to grant the expert access. You cannot use Remote Assistance to connect to an unattended computer. • Client-side control – The client always has ultimate control over a Remote Assistance connection. The client can terminate the connection at any time, by pressing the ESC key or clicking Stop Control (ESC) in the client-side Remote Assistance page. • Remote control configuration – Using the System Properties sheet or the Remote Assistance Group Policy settings, users and administrators can specify whether experts are permitted to take control of client computers. An expert who has read-only access cannot modify the computer’s configuration in any way using Remote Assistance. The group policies also enable administrators to grant specific users expert status, so that no one else can use Remote Assistance to connect to a client computer, even with the client’s permission. • Firewalls – Remote Assistance uses Transmission Control Protocol (TCP) port number 3389 for all its network communications. For networks that use Remote Assistance internally and are also connected to the Internet, it is recommended that network administrators block this port in their firewalls to prevent users outside the network from taking control of computers that request remote assistance. However, it is also possible to provide remote assistance to clients over the Internet, which would require leaving port 3389 open. © 2013 John Wiley & Sons, Inc.

Using Remote Desktop Remote Desktop is essentially a remote control program for Windows computers; there are no invitations and no read-only capabilities. The Remote Desktop Connection client communicates with a host computer using the Remote Desktop Protocol (RDP). When you connect to a computer using Remote Desktop, you must log on, just as you would if you were sitting at the console. © 2013 John Wiley & Sons, Inc.

Activating Remote Desktop Before you can connect to a distant computer using Remote Desktop, you must start it using the controls on the Remote tab of the System Properties sheet, which you access from the Control Panel. Select the Allow remote connections to this computer option and, depending on your security needs, you can select the checkbox requiring Network Level Authentication. © 2013 John Wiley & Sons, Inc.

Using the Remote Desktop Connection Client In addition to the Remote Desktop Services service, Windows 8.1 includes the Remote Desktop Connection client program needed to connect to a host computer. © 2013 John Wiley & Sons, Inc.

Run the Remote Desktop Client The General tab in the Remote Desktop Connection dialog box © 2013 John Wiley & Sons, Inc.

Run the Remote Desktop Client The Display tab in the Remote Desktop Connection dialog box © 2013 John Wiley & Sons, Inc.

Run the Remote Desktop Client The Local Resources tab in the Remote Desktop Connection dialog box © 2013 John Wiley & Sons, Inc.

Run the Remote Desktop Client The Experience tab in the Remote Desktop Connection dialog box © 2013 John Wiley & Sons, Inc.

Using Windows Remote Management Windows Remote Management is a Windows 8.1 service that enables administrators to execute commands on remote computers, using Windows PowerShell or the Windows Remote Shell (WinRS.exe) command line program. Windows 8.1 does not start the service by default or configure the computer to allow remote management communications. You can configure this manually or through Group Policy settings. © 2013 John Wiley & Sons, Inc.

Configure Remote Management Configuring a listener and firewall exception © 2013 John Wiley & Sons, Inc.

Using Windows Remote Management WindowsRM Service Group Policy settings © 2013 John Wiley & Sons, Inc.

Using WinRS.exe Once you configure the Remote Management service, you can execute commands on other computers that have been similarly configured. To execute a command from the Windows 8.1 command prompt, you must use the WinRS.exe program. To use WinRS.exe, you frame the command you want to execute on the remote computer: winrs –r:computer [-u:user] [-p:password] command • –r:computer – Specifies the name of the computer on which you want to execute the command, using a NetBIOS name or a fully qualified domain name (FQDN) • -u:user – Specifies the account on the remote computer that you want to use to execute the command • -p:password – Specifies the password associated with the account specified in the –u parameter. If you do not specify a password on the command line, WinRS.exe prompts you for one before executing the command. • command – Specifies the command (with arguments) that you want to execute on the remote computer © 2013 John Wiley & Sons, Inc.

Using WinRS.exe –r:computer – Specifies the name of the computer on which you want to execute the command, using a NetBIOS name or a fully qualified domain name (FQDN) -u:user – Specifies the account on the remote computer that you want to use to execute the command -p:password – Specifies the password associated with the account specified in the –u parameter. If you do not specify a password on the command line, WinRS.exe prompts you for one before executing the command. command – Specifies the command (with arguments) that you want to execute on the remote computer © 2013 John Wiley & Sons, Inc.

Windows Remote Shell Group Policy settings Using WinRS.exe Windows Remote Shell Group Policy settings © 2013 John Wiley & Sons, Inc.

Using PowerShell Remote Commands It is also possible to execute commands on remote computers using Windows PowerShell version 3, the version included with Windows 8.1. To execute a PowerShell command on a remote computer, you must open an elevated PowerShell session and use the following syntax: icm computer {command} computer specifies the name of the computer on which you want to execute the command {command} specifies the PowerShell command you want to execute of the remote computer. The command must be enclosed in curly brackets. © 2013 John Wiley & Sons, Inc.

Lesson Summary The shortcuts to various Microsoft Management Console (MMC) tools that appear in Windows 8.1 are all configured to manage resources on the local system. However, many of the snap-ins supplied with Windows 8.1 enable you to manage other Windows computers on the network as well. Remote Assistance is a Windows 8.1 feature that enables an administrator, trainer, or desktop technician at one location to connect to a distant user’s computer, chat with the user, and either view all the user’s activities or take complete control of the system. Remote Desktop is an administrative feature that enables users to access computers from remote locations, with no interaction required at the remote site. © 2013 John Wiley & Sons, Inc.

Lesson Summary Windows Remote Management is a Windows 8.1 service that enables administrators to execute commands on remote computers, using Windows PowerShell or the Windows Remote Shell (WinRS.exe) © 2013 John Wiley & Sons, Inc.

Copyright 2013 John Wiley & Sons, Inc.. All rights reserved. Reproduction or translation of this work beyond that named in Section 117 of the 1976 United States Copyright Act without the express written consent of the copyright owner is unlawful. Requests for further information should be addressed to the Permissions Department, John Wiley & Sons, Inc.. The purchaser may make back-up copies for his/her own use only and not for distribution or resale. The Publisher assumes no responsibility for errors, omissions, or damages, caused by the use of these programs or from the use of the information contained herein.