View AD user desktop without alerting the user

You need to set via group policy a shadowing of sessions.  This can be done without the user knowing:
https://social.technet.microsoft.com/wiki/contents/articles/19804.remote-desktop-services-session-shadowing.aspx

Hope this helps!
-J

Which setting should I use?

I assume that
View Session without user’s permission
is the correct one?



Five different levels of control are available:

No remote control allowed

Full control with user’s permission

Full control without user’s permission

View Session with user’s permission

View Session without user’s permission

My solution does not bump the user off.  It also costs $0 to implement.  View session without the users permission is the setting you want.

I use shadowing every day to monitor contractors while they work on our systems.  It has never been a problem.  Love M$ delivered solutions that work :-)

The end user has to be in a RDP session for it to work.

Or this: https://www.experts-exchange.com/questions/27596838/remote-assistance-without-needing-permission.html The Unsolicited remote assistance.

Remote assistance needs users approval

Again, so quick to answer negatively.

I have set the GOP to

View Session without user’s permission

However when i use
mstsc.exe to connect to a remote machine they get an approve or deny dialogue to allow or refuse my connection.  IF they approve it it blacks out their screen and I cannot see their session as it logs me in to my own session.

You have to use MSRA.exe

More detail on this: https://community.spiceworks.com/topic/446811-remote-desktop-allow-admin-to-login-without-user-confirmation

BTW: NIRCMD is found and quarantined by most AV software. Intelliadmin is $259.00 WinVNC which opens security implications.

@PatWrigley

Are the users logged in locally with their AD credentials ?? >>>Then you gotta use MSRA.exe (Remote assistance)

Nircmd runs just fine in our environment (Nessus doesn't even flag it) same with Intelliadmin.

259 $ BTW is a small price for how incredibly useful I have found it to be. I even have it set up where when a user calls me with a problem, I just go to a logon script created batch file(With their username) and connect immediately.

The batch file is just shortcut to intelliadmin with their computername included.

No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I have recommended this question be closed as follows:

Split:
-- John Gates CISSP (https:#a42216537)
-- Donald Stewart (https:#a42216496)


If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.

Pber
Experts-Exchange Cleanup Volunteer