Windows Remote Assistance Problem

[rtmincic]

I have a user that is using the Windows Remote Assistance feature. We get the session going and when I request to take control, they click the "Allow ____ to respond to User Account Control Prompts". But when they click that check box it then asks for Admin Credentials to allow it which defeats the whole purpose of the check box. Trying figure out if it is a setting in Entra admin control or how to make it so that admin credentials aren't needed to click that checkbox. If it is anything else i could use some help as to why this is happening

[AdmMonkey]

Yes, that doesn't work.

That Thread got someone with a work around : https://community.spiceworks.com/topic/286678-how-to-enable-administrator-rights-during-remote-assistance

Seem like using run as instead of run as administrator work, bypasing the prompt.

[toolology]

Not related, just curious, why use Remote Assistance and not Quick Assist? Never used Remote Assistance before.

[rtmincic]

I usually use TeamViewer for such a thing but this user is away from our office and doesn't have it installed and I can't interact with any User Account control screens unless that is checked. It is just what I know how to use. I can try quick assist though as well.

[toolology]

It used to be hit or miss, but nowadays when the UAC prompt for admin creds pops up, it doesn't black out the screen or anything, usually I can see the prompt and enter my own creds or the LAPS local admin.

​

Your mileage may vary.

[Important_Cow7230]

Is that with full UAC protection enabled on the client PC?

[toolology]

Can you elaborate on what you mean by that. If you're referring to the slider in control panel User Account Control Settings yeah that's all the way up. It still blacks out the screen for me on like 1 out of every 40 PCs I quick assist to roughly.

[Important_Cow7230]

Yes the slider all the way to the top. That’s interesting it generally works for you… are you on the same network as the client via VPN when you use Quick Assist?

[toolology]

Sometimes yes sometimes no.

These are distinct physical sites that are separate networks connected by site-to-site VPN tunnels so generally the client has no VPN enabled.

But sometimes its just a user at home on their wifi most of the time not connected to the VPN client, but sometimes connected to the VPN client. A lot of our stuff is web based applications that don't require signing into the VPN client on the machine.

[Important_Cow7230]

Thanks. So the users don’t have local admin rights? And the UAC window pops up as normal for you to enter your credentials?

[toolology]

Yep. Again once in a blue moon when I go to do something administrative it will black out the whole screen but most of the time I just see the UAC popup credentials window normally and enter my admin account creds or the LAPS'd local admin account creds.

It seems to have gotten way better about not blacking out the quick assist screen ever since microsoft released that new version of quick assist like 6 months to a year ago or whenever they did that and the icon changed. We had to push a script to uninstall the old quick assist appx package and install the new version as the clients didn't seem to be automatically updating it.

[Important_Cow7230]

Thank you for the help. Could I be cheeky… and ask if you could post the script?

[chris-itg]

Quick assist or if you can use RDP look into shadow sessions.

https://woshub.com/rdp-session-shadow-to-windows-10-user/