5.1.9. Use remote access technologies. (Obj. 4.9)

💡 First Principle: Remote access tools enable technicians to support users and manage systems efficiently without being physically present.

Remote access technologies are fundamental to modern IT support. They allow you to see a user's screen, control their mouse and keyboard, or manage a server from anywhere in the world, as if you were sitting right in front of it. This dramatically increases efficiency, allowing you to support users in different buildings or even different countries without travel time.

Figure: A remote desktop session - technicians can see and control a user's desktop from anywhere

You should be familiar with the most common remote access protocols and tools:

• RDP (Remote Desktop Protocol): This is Microsoft's proprietary protocol for providing graphical remote access to Windows machines. It's built into Windows Pro and Server editions. When you connect via RDP, you get the full desktop experience. It's fast and efficient because it only sends the drawing commands over the network, not a full video stream. The standard RDP port is TCP 3389. Because every screen update crosses the network, a slow or laggy session usually points to high latency or low bandwidth between the two ends.
• SSH (Secure Shell): This is the standard for secure command-line access. It's used primarily to manage Linux/macOS servers and network devices like routers and switches. It provides a secure, encrypted terminal session. The standard SSH port is TCP 22.
• VNC (Virtual Network Computing): An open-source, platform-independent graphical remote access system. Unlike RDP, which logs you into a new session, VNC typically shares the exact same screen the local user is seeing. It works by sending a compressed video stream of the screen, so it can be slower than RDP but is useful for user support scenarios where you need to see what the user sees.
• RMM (Remote Monitoring and Management): This isn't a single protocol but a category of comprehensive software suites used by IT departments and especially by Managed Service Providers (MSPs). RMM tools bundle remote access (often using a VNC-like technology) with other features like patch management, asset inventory, system monitoring, and script deployment, all into a single dashboard.
• VPN (Virtual Private Network): Creates an encrypted tunnel across the internet between a remote user (or site) and the corporate network, so the user can reach internal resources as if on the LAN. It protects traffic in transit; it does not speed up the connection or bypass company firewall rules.
• WinRM (Windows Remote Management): Microsoft's built-in service for running PowerShell commands and scripts on remote Windows machines (PowerShell Remoting, e.g., Enter-PSSession). It is enabled by default on Windows Server and needs no graphical desktop on the target. Default ports are TCP 5985 (HTTP) and 5986 (HTTPS).
• SPICE (Simple Protocol for Independent Computing Environments): An open protocol for remote display of virtual machines, common with KVM/QEMU.
• Screen sharing and third-party tools: Screen sharing lets you work in the user's own session while they watch and approve. Windows includes Remote Assistance (msra) and Quick Assist; third-party options include screen-sharing and video-conferencing software. The objectives also list third-party file transfer software (use SFTP, which runs over SSH on TCP 22, rather than unencrypted FTP) and desktop management software.

Security considerations: Remote access is a favorite attack path. Require strong passwords and MFA, and enable Network Level Authentication (NLA) for RDP so users must authenticate before a session is created. Never expose RDP directly to the internet; put it behind a VPN or gateway. Avoid unencrypted protocols such as Telnet (TCP 23) and FTP, and keep remote-access software patched.

Technician's Action Plan: Scenario: A user who is working from home calls for assistance. They are having trouble with a specific feature in an application and you need to see their screen to help them. Their computer is running Windows 11 Pro.

1. Choose the Right Tool: Since you need to see the user's screen to guide them, and they are on Windows, the built-in Remote Assistance feature is a perfect choice. It's designed for this type of collaborative support. Alternatively, a third-party tool like TeamViewer or the RMM software your company uses would also work. RDP is less ideal here, as it would log the user out and give you a separate session.
2. Guide the User to Launch Remote Assistance: Instruct the user to open the Start Menu and type "Remote Assistance." Have them select "Invite someone you trust to help you."
3. Create the Invitation: Tell them to choose the option to "Save this invitation as a file." This will generate an invitation file and display a password.
4. Receive the Invitation and Password: Have the user email you the invitation file and tell you the password over the phone (never in the same email).
5. Initiate the Connection: Open the invitation file on your computer and enter the password when prompted. The user will then see a pop-up on their screen asking for permission to allow you to connect.
6. Request Control: Once you are viewing their screen, you can request control of their mouse and keyboard. They will get another prompt to approve this. Now you can directly point to things on their screen, demonstrate the feature they are having trouble with, and resolve their issue interactively.

Reflection Question: What is the primary difference between RDP and VNC in terms of how they provide remote graphical access to a computer?