Remote desktop control

Unable to rdp to Windows2008 SBS server from XP client after KB969084 installed

We had an issue when all of a sudden we were not able to remote desktop to a clients SBS 2008 server using the rdp client and the TSGateway functionality. Remote Web Workplace would work fine and so would Windows7 clients.
After proving this patch was the culprit by removing the patch and finding my saved rdp session would work, I went back and read the kbarticle 969084 on this patch. I hadn’t initially read this (in common with a lot of other people) and also because the patch was pushed down via wsus. It turns out that XP does not turn on CredSSP by default and this is needed to work with the new RDP client. I followed the instructions at kb951608 and after a reboot, going to the control box/About I got the message that Network Level Authentication was supported and I was then able to connect succesfully.
MSTSC showing Network Level Authentication Supported
To summarize you need todo the following.

  1. Click Start , click Run , type regedit , and then press ENTER.
  2. In the navigation pane, locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. In the details pane, right-click Security Packages , and then click Modify .
  4. In the Value data box, type tspkg . Leave any data that is specific to other SSPs, and then click OK .
  5. In the navigation pane, locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders
  6. In the details pane, right-click SecurityProviders, and then click Modify .
  7. In the Value data box, type credssp.dll . Leave any data that is specific to other SSPs, and then click OK .
  8. Exit Registry Editor.
  9. Restart the computer.

(Almost) One click remote control for free

Ultravnc is now out as version 1.0 as opposed to being in permanent beta and one really cool feature is the use of a small exe that you can put on a web server, get people to download and run it (yes I know that *could* be a problem but then again if you are going to let someone remote control your pc then you have that trust already implied) and it opens up a reverse vnc session to your listening vnc console on the desktop. You agree to the session and you then have remote control of their desktop.
From a quick play that i had this afternoon, this SingleClick feature worked really well.
The instructions for doing this are not very well documented in my opinion so here is how to get it working (quickly). I’ll update more once I get more experience with the application.

Remote console on W2k3 server

A long time ago, when I had my first exposure to (beta) Windows2003 at a Microsoft roadshow, I saw that the remote desktop actually pulled the console across to the client as opposed to having a new desktop session. I thought this was a pain as it meant that a remote administrator could pinch the console away from the person actually using the console at the server which would be really annoying. However, in my experience on the final product this never happened and you always got a virtual console. This is great unless you want to see the output of any scheduled jobs that are interacting with the desktop. I’ve now found that it is possible to get the console itself by using the -console option as documented in kb278845.
Use mstsc -v:servername -console to “pinch” the console session (the currently logged in user would get logged off) or start a standard terminal session and then in a dos command prompt type in shadow 0. The only downside of this is that you need the logged in user to allow the remote control.

More remote control software

I’ve come across yet more (free) remote control software – this time mywebexpc which has similar functions to the logmein. If you want the pro version then you also get added features with a unique (as far as I know and their blurb tells me) feature where before your pc can be remote controlled, the server dials you on your phone and you enter a pin number into the handset before control is allowed. A neat authentication service but could be annoying in a DOS attack in the middle of the night!
I must admit that I’ve not tried this software yet as I don’t want to open up too many holes to my main pc at home but logmein seems to work ok, even from a dialup phone line and was handy when I needed to control the home pc from a non work pc yesterday (vnc is locked down to only allow connections from certain ip address’s)
Update You even get the pro version for free until the 4th April 2005 after which it is $7.45 per month per pc

logmein.com

Looks like logmein is another tool to use for supporting endusers/relations. This is a cutdown citrix like client that gets installed on your supportees pc’s before they need your help but which you can then access over a web connection. You could have multiple pc’s/owners all logging on with your account but then you’d need to share the password so this would only work for remote support for your close relatives or your own machine. Once the software is installed it creates a web connection to their central server and your control is sent down this encrypted connection. It seems to work well, is fast(er than vnc) but doesn’t have enhanced capabilities such as chat/file transfer unless you pay per month for this capability. The one big advantage is that it doesn’t need any ports opening up on a firewall and the end user is prompted when you attempt to control it.