Remote Assistance
Workspaces includes remote assistance tools so that an operator can efficiently access a device and take control of the user's session to solve problems and make system changes.
The operator can manage all the applications the user sees, including those requiring elevated permissions, launched with Run as administrator or executed under User Account Control (UAC).
Features of remote assistance
- It supports all types of sessions, such as users on physical devices, VDIs, shared desktops, and even in virtualized application environments.
- It is designed to cover end-user devices and devices that do not have a user in front of them, like servers or kiosk-type customer service devices.
- It supports devices running Windows as an operating system.
- Thanks to its configuration options, it can be used for quick remote assistance sessions with users and as a remote access mechanism to infrastructure devices, like servers.
To minimize the attack surface, exploit vulnerabilities, and maintain device security, FlexxAgent does not install any additional software, so there is no service "listening" for incoming connections. The process runs only (without installation) in real-time when requested from Workspaces.
Types of remote assistance
There are three types of remote assistance:
Interactive remote assistance
Interactive remote assistance is aimed at end users. It allows support staff to access the user's session to see what is happening on their screen or take control easily. This type of assistance requires user consent.
Unattended Remote Assistance
Unattended remote assistance allows access to server type or self-service kiosk computers, where no specific user is working.
When the operator performs this action, Workspaces sends the order to FlexxAgent to install a custom Flexxible service, start it up, set up an access password, and inform the operator through the console that the session is already accessible with its respective authentication data:
- Session ID: session identifier.
- Password: dynamic password that regenerates with each session, it is not recommended to store it.
- Download the remote assistance access file for the operator.
Once the access file has been activated by the support operator, it will be necessary to enter the session password to take control of the device.
After 15 minutes since the end of the unattended remote assistance connection, it will no longer be possible to reuse the same authentication data or access file. The service will be deactivated from the device, and the session password will have expired.
Dynamic Remote Assistance
Dynamic remote assistance allows an operator to act on a device regardless of whether the user has a session at that time.
When a dynamic remote assistance is launched, FlexxAgent checks the active sessions on the device; if there is any, it launches the interactive remote assistance process. On the contrary, if there is no user session active, it will trigger the unattended remote assistance process, allowing the operator to access the device to perform maintenance tasks, even using other user accounts to log in, without interfering with the user's session or data.
To perform and receive dynamic remote assistance, both devices must have version 24.9.2 or higher of FlexxAgent installed.
Although the reporting group to which the device belongs has been configured to receive dynamic remote assistance, Workspaces will display the three options to start remote assistance: interactive, unattended, and dynamic. In that specific case, the operator will not be able to activate interactive or unattended remote assistance. If attempted, Workspaces will display an error message.
Requirements to perform remote assistance
- Have FlexxAgent 23.7 or higher (24.9.2 for dynamic remote assistance) installed on the remote device (where the remote assistance is received) and on the technician's device providing the service.
- Device connectivity to ras.flexxible.com, through TCP port 443.
Configuration
For a device to receive remote assistance, it must be configured from the FlexxAgent Settings (Remote Assistance) of its reporting group. From there, you can choose which type of remote assistance devices will have access to.
Activation
Once the configuration is made, from the support side, when wanting to provide remote assistance to a device, it must be done from the Workspaces module, previously selecting the device to which assistance is to be provided. Level 1 -> Operations -> Remote Assistance. And then choose the type of remote assistance to be provided: interactive, unattended, or dynamic.
The remote assistance operation can be activated both from the Sessions view and from Workspaces.
When the operator launches the Start remote assistance request, FlexxAgent launches a process (with user permissions) on the device and notifies the user.
On the support side, the ".flxra" file will automatically download, which will activate with a single click. The user's consent request will then be launched.
The remote assistance session access file expires after 15 minutes.
Wait to receive user consent:
Once remote assistance is accepted, the support operator can gain control of the session.
The file will only be present in the device's filesystem when remote assistance is requested. It will run with user permissions, without installation, and remain active for the duration of the remote assistance session. After the session is finished, the process will be stopped, and the file removed from the filesystem.
El hecho de que el archivo se ejecute sin permisos administrativos no impide el acceso a las herramientas administrativas necesarias para la entrega de soporte. Estas se ofrecen para la asistencia remota dentro del menú Flexxible Tools en la parte superior izquierda de la ventana de la asistencia remota.
Processes
When the operator downloads the remote assistance file from Workspaces, the following processes are generated, which run automatically.
- FlxRA_xxxx: file downloaded from the web.
- FlexxibleRemoteAssistance_xxxx: process responsible for initiating the remote assistance connection.
Flexxible Tools
Since the remote assistance file is executed with the user's permission level, it may happen that the user is not a local administrator of the device. To cover these cases, the Flexxible Tools have been incorporated.
Flexxible Tools allow activating administrative tools for remote assistance. This is a series of functions embedded in the remote assistance application that can be accessed from the top left part of the interface.
These tools can be executed with the following administrative permissions:
- CMD
- PowerShell
- Registry Editor
- Task Manager
If the user has permissions in the Portal, the Flexxible Tools can be activated for users by role. This can be done in two ways:
- From
Portal->Configuration->Products: for each product in the list, there is aFlexxAgent Configurationbutton that allows applying the change to all reporting groups. - From
Portal->Configuration->Reporting Groups: for one or several reporting groups, functionality can be activated or deactivated.