remote control - florida international university

Remote Control

Table of Contents:

◊ DesktopControl◊ Configure◊ NotificationPolicy◊ Files/Processes◊ MessagewithUsers◊ vPro

Rem

ote

Con

trol

2Chapter 4 - Remote Control Sadjadi et al.

Release Notes

Kaseya 6.2.0.0

• Remote Control SSH -Remote Control > SSH pagerunsanSSHsessiontoconnecttoLinuxandMacmachines.ThisfeatureissimilartoRemote Control > FTP. Someofthescreenshotsinthismodulemaynotincludethisfeature.

Rem

ote Control

3 Chapter 4 - Remote Control Sadjadi et al.

Systemadministratorsfrequentlyneedtodirectlyworkonthecomputerstheymanagetoperformavarietyofservicessuchastroubleshooting,installingsoftwaresystems,downloadingfiles,andsoon.Thisneedsdirectworkoncomputersthatareotherwiseutilizedbytheirusers.However,directaccesstocomputersmustbeperformedwithoutnegativelyimpactingtheproductivityofusers.InadditionnotallsuchcomputersarelocatedinthesamelocationmakingitevenmoredifficultfortheITpersonneltoreachtoeachcomputerpromptly.Clearly, as thenumberof computers increases, thisextremely inefficientprocessofon-sitemaintenancebecomesprohibitivelyexpensive,bothintermsofrequiredmanpowerandlossofproductivityastheusersusuallyremainidlewhilethemaintenanceworkisbeingperformed.Whatisneededisawaytofacilitatearemoteaccesstocomputerthatisquick,secureandnon-intrusive. Kaseya’sRemoteControlmoduleprovidesthisneededfacilitybyallowingyoutoviewandoperatemanagedmachinesasiftheywererightinfrontofyousimplybyclickingitsmachineID.TheRemoteControlmoduleenablesyouto:

• Automaticallyconnecttheusertotheremotecomputerindependentofanygatewayorfirewallcon-figurations,evenforcomputersbehindNAT.

• Remotecontrolevenwithoutanagentusingvideostreaming.

• Workindependentlyorwiththeusertosolveproblemsinteractivelywherebothpartiescanseewhatishappeninginrealtime(i.e.,remotescreensharing).

• Setpoliciesthatallowuserstoblockremotecontrolorrequireuserstoaskpermissionbeforeac-cessingamachine.

• FTPtoanymanagedmachineandaccessfilesevenbehindNATgatewaysandfirewalls.

• Directchatwithanymanagedmachine,which issuitable forsupportingdial-upuserswithonlyasinglephoneline.Remotecontrolandchatcanbeperformedatthesametime.

• Powerup,powerdown,bootuporrebootvPro-enabledmachines.

• UseLive Connecttoperformtasksandfunctionssolelyforonemanagedmachine.LiveConnectisanintegralpartoftheKaseyaITAutomationFrameworkthatallowsashortcutmethodtoperformmanyofthecoreITmaintenanceactivitiesincluding:deployment,configuration,execution,update,logging,reporting,monitoringandremediation.ThesefunctionsarepartofthecoretasksthatanITprofessionalperformsonadailybasis.ThedetailsofLiveConnectisdescribedinsection4.5.3.

Kaseya’sRemoteControlmoduleislightweightandformsitsown,completelysecureTCPconnectionwiththeserver,withouttheneedforaddressmanagement,implementationofportmappingschemesateachsiteortheestablishmentofcumbersomeVPNs.

4.1.1 Control Machine

TheControl Machinepageestablishesaremotecontrolsessionbetweentheuser’slocalmachineandaselectedmachineID.Theremotecontrolsessioncanbeestablishedbyoneof thefollowing third party remote control packages:

Introduction

4.1 Desktop Control

Rem

ote

Con

trol


• WinVNC-Thisopensource,freelyavailable,remotecontrolpackagecomesbundledwiththeVSA.WinVNCisthedefaultpackageusedonallmanagedmachines.TheVSAautomaticallyinstallsWin-VNCserversonselectedmachinesthefirsttimeyouremotecontrolthatmachine.

• K-VNC -TheenterpriseversionofVNC.This remote control option is available for Vista, Windows 7, and Windows Server 2008.ItcanalsobeusedonWindows2000,XP,2003,andMacintoshOSX10.4.x(Tiger)and10.3.x(Panther). TheVSAautomaticallyinstallstheK-VNCserveronselectedma-chinesthefirsttimeyouremotelycontrolthatmachine.

• RAdmin-RAdminisacommerciallyavailableremotecontrolpackageofferingbothhighspeedandfiletransfercapability.UseRAdminwherebandwidthlimitationsexistoryouneedremotefiletransfertothemachine.TheVSAautomaticallyinstallstheRAdminserveronselectedmachinesthefirsttimeyouremotecontrolthatmachine.TheRAdminpackagebundledwiththeVSAexpiresafter30days.Licensescanbeobtainedfromwww.radmin.com.

• pcAnywhere-pcAnywhereisawidelyusedremotecontrolpackageavailablefromSymantec.TheVSAsupportspcAnywherebutdoesnotautomaticallyinstallit.YoumustpurchasepcAnywheresepa-ratelyandinstallitontheworkstationbeforeyoucanusethisoption.CombiningtheVSAwithexistinginstallationsofpcAnywhereallowsyoutoremotecontrolmachinesbehindgatewayswithoutmappingportsoropeningfirewalls.

• RDP -MicrosoftRDPisonlyavailablewithWindowsNT,2000,XP,Vista,Windows7,2003or2008.TheVSAdoesnotautomatically installRDPbutdoesallowyoutoremotecontrolmachinesbehindgatewayswithoutmappingportsoropeningfirewalls.XP,VistaandWindows7comepre-installedwithTerminalServiceaccessforasingleuser.

WinVNC, K-VNC and RAdmin, are all based on VNC technology. VirtualNetworkComputing(VNC),alsocalledremotecontrolorremotedesktop,isagraphicaldesktopsharingsystemwhichusestheRemoteFramebuffer(RFB)protocoltoremotelycontrolanothercomputer.Ittransmitsthekeyboardandmouseeventsfromonecomputertoanother,relayingthegraphicalscreenupdatesbackintheotherdirection,overanetwork.ItisincludedwiththeKServerprimarilytoprovideimmediatetechnicalsupport.VNCisplatform-independent.AVNCvieweronanyoperatingsystemcanusuallyconnecttoaVNCserveronanyotheroperatingsystem.TheVNCserveristheprogramontheremotemachinethatsharesitsscreen.TheVNCclient(orviewer)isthe program on the localmachine thatwatches and interactswith the remotemachine.TheVNC clientmachinerequiresuseraccessrightstotheVNCservermachine.SinceKaseyaVNCsessionsarerelayedthroughtheKServer,allVNCsessionsareprotectedbytheKaseya256bitrollingencryptionprotocol.ThenewK2(Kaseya2)supportspeer-to-peerVNCsessions,removingtherelaytoKServer,whichresultsinmuchfasterremotesessionsandeliminatingtheunnecessaryloadontheKServerandyournetworkconnectiontointernet,incasebothVNCclientandservermachinesarebehindthesamefirewall.

VNC client and server components are normally installed automatically when a remote control session is initiated. IfWinVNC,K-VNCorRAdminarenot installedonamachineandaremotecontrolsessionisinitiatedusingRemote Control > Control Machinethenthesepackagesareautomaticallyinstalledwithoutrequiringareboot.Whilethisautomaticinstallationisquick(usuallyunderoneminute).Thisdelaycanbeeliminatedduring first timeusebypre-installingWinVNC,K-VNC,or RAdminonanymanagedmachineusingRemote Control > Preinstall RC.

ActiveX ControlAnActiveXcontrolautomaticallyconfiguresandrunstheremotecontrolorFTPpackageforyou.ThefirsttimeyouuseanyremotecontrolorFTPpackageonanewmachine,yourbrowsermayaskifitisOKtodownloadandinstallthisActiveXcontrol.ClickYeswhenasked.IftheActiveXcontrolisblockedbythebrowserfromrunning,theuserispresentedwithalinktomanuallydownloadandruntheremotecontrolpackagemanually.

Helper Applications

Rem

ote Control


InsettinguparemotecontrolorFTPsession,gatewayandportblockingproblemsareeliminatedbyalwaysinitiatingoutboundconnections fromboth the targetmachineand theusermachine.Helperapplications,uniquetoeachsupportedremotecontrolorFTPpackage,automaticallydeterminetheoptimalroutingpathbetweentheVSAusermachineandtheremotemachine.IfadirectconnectionisnotpossiblethenthehelperapplicationsroutetheremotecontroltrafficthroughtheKServeronthesameportusedbyagentstocheck-in(default5721).

Remote Control Malfunctions

Reasonsforremotecontrolfailurefortargetmachineswithandwithoutanagentare:

1. Theremotemachineisblockingoutboundtrafficontheagentcheck-inport(default5721).Thefire-wallmayneedtobereconfigured.

2. Theremotemachineisonaslowconnection.Lettheapplicationsrunlongerthanthetimeoutperiodandseeifthatworks.

3. Anti-virussoftwareontheremotemachinemayblocktheconnection.ThisproblemiseliminatedifKaseyaEndpointSecurityprotectionisinstalledontheremotemachine.

4. WrongprimaryKServeraddress-RemotecontrolcanonlyconnectthroughtheprimaryKServeraddress.Machineswithanagentcanconnectthrougheithertheprimaryorsecondaryaddress.VerifytheremotemachinecanseetheprimaryKServeraddressusingAgent > Check-in Control.

5. XPsupportsonlyoneRDP/TerminalServicesessiononthetargetmachineandlogsoffotherusers.Startingaremote logonsession fromasecondmachine logsoff the first remote logonsession.TheVSAusestheportrelaytogetthroughfirewallsandgateways.ToWindowsXP,itappearsasiftheRDPsessionisconnectingfromthelocalhost.

6. ThepcAnywhereviewerisconnectingtoyourlocalmachine,nottheremotemachine.TheKServerrelayistellingtheviewertoconnecttolocalhost. IfyouhaveapcAnywherehostrunningonthemachineyouareviewingfrom,thentheviewerconnectstoitandnottheVSArelay.RightclickthepcAnywhereiconinthesystemtrayandselectCancel Host.

7. pcAnywherepresentsanerrordialogsayingcannotfindcallhostfile:C:\Document and Settings\All Users\Application Data\Symantec\pcAnywhere\Network.CHF.ThereisnoNetworkremotecontrolitemconfiguredinpcAnywhere.

ThefigurebelowshowsthegenericviewoftheControlMachinepage(Fig.4.1).Thefunctionsavailablearelistedbelow.

Fig. 4.1: Control

Machine

Rem

ote

Con

trol


1. Machine.Group ID: ThelistofMachine.GroupIDsdisplayedisbasedontheMachineID/GroupIDfilterandthemachinegroupstheuserisauthorizedtoview.OnlymachineIDswithaororiconcanbeconnectedtotargetmachinesandhavelivelinks;allotherswillbeinactive.ClickingtheKServ-KServ-erlinkstartsaremotecontrolsessiontotheKServeritself.UsethisfeaturetoremotelymanageyourownKServer.OnlymasterroleuserscanremotecontroltheKServer.

2. Current User: Theusercurrentlyloggedontothemanagedmachine.

3. Active Admin: TheVSAusercurrentlyworkingonthismachineIDviaaremotecontrolsession.

4. Enable verbose relay: RemotecontrolorFTPofmachinesbehind firewallsandNATgatewaysmayberelayedthroughtheVSAserverusingahelperapplication.Checkingthisboxdisplaysapopupwindowwithstatusinformationaboutthenormallyhiddenhelperapplication.

4.1.2 Video Streaming

TheVideo Streaming (Fig.4.2)pageallowsyoutoestablisharemotecontrolsessionbetweentheVSAuser›slocalmachineandamachinewithoutanagent.Itcanbeusedtohelpsomeonequicklyonaninfrequentbasis.

ForVideoStreaming,thefollowingconditionsapply:

• TheremoteusermustlogintoaURLaftertheuserhasstartedthevideostreamingsession.

• Theremoteusermusthaveadministratorprivilegesonthelocalmachine.

• EachVSAusercanonlyinitiateasinglevideostreamingsessionatatime.

Note: Use Remote Control > Control Machine to remote control a target machine that has an agent.

IfWinVNC,K-VNC orRAdmin arenot installed on amachine anda remote control session is initiatedusing Video Streaming, then these packages are automatically installed. Installation does not require areboot.WheneithersideterminatestheVideo Streamingsession,theremoteserveronthetargetmachineuninstallsautomatically,removingallremotecontrolfilesandregistryadditions.

ThegenericviewoftheVideostreamingpageisshowninFig.4.2below.Theoperationsthataresupportedinthispagearelistedandexplainedbelow.

Fig. 4.2: Video Streaming

Rem

ote Control


1. Start:TheStartbuttonallowsyoutoinitiateavideostreamingsessionwiththeremoteuser.Providetheremoteuserthefollowinglink:“http://<yourKServerURL>/gethelp.asp”(e.g., http://kaseya2.cs.fiu.edu/gethelp.asp)andrequestthemtoclickyourusernametobeginthevideostreamingsession.Oncetheremoteuserchoosesyourname,thevideostreamingsessioncanbegininavncorRAdminwindowthatisautomaticallypoppedonyourscreen.

2. Enable verbose relay: RemotecontrolorFTPofmachinesthatarebehindfirewallsandNATgate-waysmayberelayedthroughtheVSAserverusingahelperapplication.Checkingthisboxdisplaysapopupwindowwithstatusinformationaboutthenormallyhiddenhelperapplication.

3. Select remote control package to use: ThedefaultremotecontrolserviceusesWinVNC.SeeRe-mote Control > Select Typeforadescriptionofthedifferenttypesofremotecontrolpackages.

• WinVNC

• K-VNC

• RAdmin

4. Specify the default HTML message seen by users when no administrator is waiting to help: Thisisthemessagedisplayedtotheremoteuserswhentherearenoadministratorsavailableforas-sistance.Thisisdisplayedwhentheremoteuserclicksthehttp://<yourKServerURL>/gethelp.aspwebpage.Aftermakingchangestothismessage,clicktheApplybuttontosaveit.ClickDefaulttoresetthemessagebacktoitsdefaultsetting.

4.1.3 Reset Password

TheReset Passwordpage(Fig.4.3)changesthepasswordforauserand,ifnecessary,createsanewuseraccountonamanagedmachine.Itcanalsochangedomainuseraccountsondomainnamecontrollers.Iftheusernamedoesnotalreadyexist,checkingtheCreate new accountcheckboxcreatesanewaccountwiththespecifiedpassword.ResetPasswordreturnsanerrorifyouattempttoresetthepasswordforausernamethatisnotalreadycreatedonthemanagedmachineorifyoucreateapasswordthatisalreadybeingusedbyauseraccount.Blankpasswordsarenotpermitted.

Resetting the User PasswordResetPasswordcanbeusedtoresettheuserpasswordforalocalaccountononeofthemanagedcomputersoradomainaccountasneeded.Auserpasswordcanonlybechangedbygoingtothemachinewheretheaccountresides,inotherwords, alocalaccountcanbechangedonlyonitsrespectivelocalmachineandadomainaccountcanbechangedonlyonitsrespectivedomaincontroller.

Amongotherreasons,thechangemightbeneededbecause:

• Youruserpasswordiscompromised.

• Someoneleavesyourorganizationwhoknewtheuserpassword.

• Itistimetochangetheuserpasswordaspartofagoodsecuritypolicy.

Fig.4.3belowshowstheResetpasswordpage.Thefunctionssupportedbythismodulearelistedonthenextpage.

Rem

ote

Con

trol


1. Apply: ClickApply toapplypasswordanduseraccountparameterstoselectedmachineIDs.

2. Cancel: ClickCancel toclearpendingpasswordchangesanduseraccountcreationsonselectedmachineIDs.

3. Username: Entertheusernameonthemanagedmachine.

4. Create new account: Checkthisboxtocreateanewuseraccountonthemanagedmachine.

5. As Administrator: Checkthisboxtocreatethenewuseraccountwithadministratorprivileges.

6. Password / Confirm: Enteranewpassword.

7. Machine.Group ID: ThelistofMachine.GroupIDsdisplayedisbasedontheMachineID/GroupIDfilterandthemachinegroupstheuserisauthorizedtoview.

8. Status: Thestatusofpendingpasswordchangesanduseraccountcreations.

4.2.1 Select Type

TheSelect Type pagespecifieswhich remote control package isusedbyRemote Control > Control Machinetoremotecontrolamanagedmachine.Youcanassigndifferentpackagestodifferentmachines.EachmachineIDdisplaystheiconoftheremotecontrolpackageitiscurrentlyassignedtouse.

AssignRemoteControlPackagestoMachineIDs

1. Selectthetypeofpackagetousefromthedrop-downlist.(SeeFig.4.4)

2. ChecktheboxtotheleftofmachineIDsyouwanttousethisremotecontrolpackage.

3. ClicktheSelectbutton.

Fig. 4.3: Reset Password

4.2Configure

Rem

ote Control


EnsurethelistofMachine.GroupIDsdisplayedisbasedontheMachineID/GroupIDfilterandthemachinegroupstheuserisauthorizedtoview.

4.2.2 Set Parameters

TheSet Parameterspagesetsthedefaultparametersforyourremotecontrolsession.Thesesettingsarerememberedonaper VSA user basis.Changestakeeffectimmediatelyandarereusedeverytimeyoustartremotecontrol.

Fig.4.5belowshowsthegenericviewoftheSetParameterspage.Theoptionssupportedonthispagearelistedandexplainedbelow.

Fig. 4.4: Assign Remote Control

Packages

Fig. 4.5: Set Parameters

Rem

ote

Con

trol


1. WinVNC and K-VNC Options

• View Only Mode-Youcanviewtheremotemachine.Nomouseorkeyboardeventsaresenttotheremotemachine.

• Hide WinVNC system tray icon on the remote machine-CheckthisboxtohidetheWinVNCiconontheremotemachine.

• Restrict to 64 colors-Thedisplayissetto64colors.Thisisusefulforslowerconnections.

• Full Screen mode-Theentiredisplayofyourlocalmachineisusedtodisplaythescreencontentsoftheremotemachine.Exitbydisplayingtheremotecontrolmenu(defaultF8)andunselectFull screen.

2. RAdmin Options

• Full Control-Youcanviewand/orcontrolthescreenkeyboardandmouseoftheremotemachine.

• View Only-Youcanviewtheremotemachine.Nomouseorkeyboardeventsaresenttotheremotemachine.

• File Transfer-Startafiletransfer(FTP)sessionwiththeremotemachine.Thismodepresentsyouwithtwostandardfilebrowsers,onefortheremotemachineandoneforyourlocalmachine.Draganddropfilesbetweenthetwomachinesinthismode.

• Full Screen View Mode-Theentiredisplayofyourlocalmachineisusedtodisplaythescreencon-tentsoftheremotemachine.ThisoptionisonlyavailableforFullControlorViewOnlysessions.

• Encrypt Data Stream -Checking thisboxencryptsall trafficbetweenyour localmachineand theremotemachine.

• Updates/sec-SetsthemaximumnumberofupdatespersecondRAdmingenerates.HigherupdateratesconsumemoreCPUcyclesontheremotemachine.

• Color Format-Specifiesthenumberofcolorsusedforremotecontrol.Largecolorformatsusemorebandwidth.

3. RDP Options

• Console mode-Remotecontroltheconsolesessionoftheremotemachine.

• Full Screen mode-Useyourfullscreentoremotecontroltheremotemachine.

• Fixed Screen size-Setafixedwidthandheightforyourremotecontrolsession.

• Share Disk Drives-Connectyourdiskdrivestotheremotemachine.

• Only share the following disks-Enterthespecificdriveletterstoshare,orleaveblanktosharealldisks.

• Share Printers-Connectyourprinterstotheremotemachine.

• Disable Desktop Wallpaper-Turnoffwallpaperontheremotemachineforfasterprocessing.

Rem

ote Control


4.2.3 Preinstall RC

ThePreinstall RCpage(Fig.4.6) installsWinVNC,K-VNCorRAdminonselectedmachineIDswithoutinitiating a remote control session. Select the type of package to remote control a managed machineusingRemote Control > Select Type.WhenaninstallispendingonanymachineID,thispageautomaticallyrefreshesevery5secondsuntiltheinstallationprocesscompletes.

Note: Preinstall RC does not install pcAnywhere or RDP.

1. Install: ClickInstalltoinstallWinVNC,K-VNCorRAdminonselectedmachineIDs.

2. Cancel: ClickCancel toclearpendinginstallproceduresforselectedmachineIDs.

3. Last Status: PendingindicatestheinstallwillrunthenexttimethatmachinechecksintotheKServ-er.Otherwise,thiscolumndisplayswhentheremotecontrolpackagewasinstalledonthemachineID.

Steps to install a remote control package PreInstall RC

1. SelectthetypeofpackagetoremotecontrolamanagedmachineusingRemote Control > Select Type andclickSelect.

2. SelectthemachineIDofyourchoiceonPreInstallRCpage.

3. ClickInstall.

4.2.4 Uninstall RC

TheUninstall RCpage(Fig.4.7)uninstallsWinVNC,K-VNCorRAdminonselectedmachineIDs.MultipletypesofremotecontrolpackagesmaybeinstalledonasinglemachineID.SelectthetypeofpackagetouninstallfromamanagedmachineusingRemote Control > Select Type.WhenanuninstallispendingonanymachineID,thispageautomaticallyrefreshesevery5secondsuntiltheprocedurecompletes.

IfanexistinginstallationofWinVNCorRAdminhasproblemsthentheVSAmaynotbeabletoestablisharemotecontrolsession.IfremotecontrolfailsthenrunningUninstall RConthatmachineIDcleansoutanyexistinginstallationproblem.AfreshcopyoftheremotecontrolpackageisinstalledthenexttimearemotecontrolsessionisstartedorusingRemote Control > Preinstall RC.

Fig. 4.6: PreInstall RC

page

Rem

ote

Con

trol


Note: Uninstalling an agent does not remove the installed Remote Control package. Before you delete the agent, use Remote Control > Uninstall RC to uninstall remote control on the managed machine. Uninstall all add-on module clients as well.

Automatic UninstallationUninstallRCisnotrequiredforVideoStreaming.WheneithersideterminatestheVideoStreamingsession,theremoteserveronthetargetmachineuninstallsautomatically,removingallremotecontrolfilesandregistryadditions.

ThegenericviewoftheUninstallRCpageisshowninFig.4.7below.Thefunctionssupportedonthispagearelistedandexplainedbelow.

1. Uninstall: ClickUninstalltouninstallWinVNC,K-VNCorRAdminonselectedmachineIDs.

2. Cancel: ClickCancel toclearpendinguninstallproceduresforselectedmachineIDs.

3. Last Status: Pending indicates theuninstallwill run thenext timethatmachinechecks into theVSA.Otherwise,thiscolumndisplayswhentheremotecontrolpackagewasuninstalledonthemachineID.

4.3.1 User Role Policy

TheUser Role Policypage(Fig.4.8)allowsyoutospecifyhowremoteusersshouldbenotifiedthataremotecontrolsessiontotheirmachineisabouttobegin.PoliciesareappliedbySystem > User Security > User Roles.

Fig. 4.7: Uninstall RC

page

4.3NotificationPolicy

Rem

ote Control


1. Select User Notification Type

• Silently take control -Thisoptionallowsyoutotakecontrolofthemachinewithoutinformingtheuser.Controlcanbetakenimmediatelyandsilently.

• If user logged in display alert–Thisoptionallowsyoutodisplayanalertbeforetakingcontrolofthemachine.Thealerttextcanbeeditedinthetextboxbelowthisoption.

• If user logged in ask permission–Thisoptionallowsyoutoasktheuserifitisalrighttobeginare-motecontrolsession.TheAsk Permission textcanbeeditedinthetextboxbelowthisoption.RemotecontrolcannotproceeduntiltheuserclickstheYes button.Ifnothingisclickedafteroneminute,NoisassumedandtheVSAremovesthedialogboxfromthetargetmachine.Ifnouserisloggedin,proceedwiththeremotecontrolsession.

• Require Permission. Denied if no one logged in–Thisoptionallowsyoutoasktheuserifitisalrighttobeginaremotecontrolsession.TheAsk Permission textcanbeeditedinthetextboxbelowthisoption.Remotecontrolcannotproceeduntil theuserclickstheYesbutton. Ifnothing isclickedafteroneminute,NoisassumedandtheVSAremovesthedialogboxfromthetargetmachine.Theremotecontrolsessioniscancelled.Thisoptionisthesameasabove,butiftheuserisnotloggedin,thepermissionfortheremotecontrolsessionisdenied.

2. Apply: ClickApply toapplypolicyparameterstoselectedmachineIDs.

3. Notify user when session terminates: Checkthisboxtonotifytheuserwhenthesessiontermi-nates.

4. Session Termination Message: Displaysonly if theNotify user when session terminates boxischecked.Modifythedefaultmessageifnecessary.The<admin> variableistheonlyvariablethatcanbeusedinthismessage.

5. Notification Alert Text / Ask Permission Text: ThistextboxisdisplayedonlyiftheSelect User No-tification Type isnotSilently take control.Modifythedefaultmessageifnecessary.The<admin> vari-

Fig. 4.8: User Role Policy

Rem

ote

Con

trol


ableistheonlyvariablethatcanbeusedinthismessage.

6. Remove: ClickRemove toclearpolicyparametersfromselectedmachineIDs.

7. Require admin note to start remote control: ClickthisboxtorequireVSAuserstoenteranotebeforestartingtheremotecontrolsession.Thenoteisincludedintheremotecontrollogandisnotdis-playedtothemachineuser.

8. Role Name: Thiscolumndisplaysthelistofuserrolesthatareavailable.

9. Policy: Thiscolumndisplaystheremotecontrolpolicyappliedtoauserrole.

10. Message: Thetextmessagesappliedtoauserroleisdisplayedinthiscolumn.

Clickingthedeleteiconnexttoauserrolewillclearthepolicyandclickingarow’sediticontopopulateheaderparameterswithvaluesfromthatrow.Youcaneditthesevaluesintheheaderandre-applythem.

4.3.2 Machine Policy

TheMachine Policypage(Fig.4.9)allowsyoutospecifyremoteusersshouldbenotifiedthataremotecontrolsessiontotheirmachineisabouttobegin.Thispolicyisappliedtomachine IDs.

Fig4.9showstheMachinePolicypageandallthefunctionsthatthismoduleprovides.

1. Select User Notification Type

• Silently take control -Donottelltheuseranything.Takecontrolimmediatelyandsilently.

• If user logged in display alert -Displaynotificationalerttext.Thealerttextcanbeeditedinthetextboxbelowthisoption.

• If user logged in ask permission -Asktheuserifitisalrighttobeginaremotecontrolsession.Theaskpermissiontextcanbeeditedinthetextboxbelowthisoption.RemotecontrolcannotproceeduntiltheuserclickstheYesbutton.Ifnothingisclickedafteroneminute,NoisassumedandtheVSAremovesthedialogboxfromthetargetmachine.Ifnouserisloggedin,proceedwiththeremotecontrolsession.

• Require Permission. Denied if no one logged in -Asktheuserifitisalrighttobeginaremotecontrolsession.Theaskpermissiontextcanbeeditedinthetextboxbelowthisoption.Remotecontrolcan-notproceeduntiltheuserclicksthe Yes button.Ifnothingisclickedafteroneminute,Noisassumed

Fig. 4.9: Machine Policy

Rem

ote Control


andtheVSAremovesthedialogboxfromthetargetmachine.Theremotecontrolsessioniscancelled.

2. Apply: ClickApplytoapplypolicyparameterstoselectedmachineIDs.

3. Notify user when session terminates: Checkthisboxtonotifytheuserwhenthesessiontermi-nates.

4. Session Termination Message: DisplaysonlyiftheNotify user when session terminatesboxischecked.Modifythedefaultmessageifnecessary.The<admin> variableistheonlyvariablethatcanbeusedinthismessage.

5. Notification Alert Text / Ask Permission Text: Displays only if theSelect User Notification TypeisnotSilently take control.Modifythedefaultmessageifnecessary.The<admin> variableistheonlyvariablethatcanbeusedinthismessage.

6. Remove: ClickRemove toclearpolicyparametersfromselectedmachineIDs.

7. Require admin note to start remote control: ClickthisboxtorequireVSAuserstoenteranotebeforestartingtheremotecontrolsession.Thenoteisincludedintheremotecontrollogandisnotdis-playedtothemachineuser.


9. Policy: TheremotecontrolpolicyappliedtoamachineID.

10. Message: ThetextmessagesappliedtoamachineID.

Delete Icon: ClickthedeleteiconnexttoamachineIDtoclearthepolicy.

Edit Icon: Clickarow’sediticontopopulateheaderparameterswithvaluesfromthatrow.Youcaneditthesevaluesintheheaderandre-applythem.

4.4.1 FTP

FileTransferProtocol(FTP) isacommonlyusedprotocolforexchangingfilesoveranynetworkthatsupportstheTCP/IPprotocol.TheFTPserver istheprogramon thetargetmachinethat listensonthenetworkforconnectionrequestsfromothercomputers.TheFTPclientistheprogramontheVSAuser’slocalmachinethatinitiatesaconnectiontotheserver.TheFTPclientmachinerequiresuseraccessrightstotheFTPservermachine.ItisincludedwiththeKServerprimarilytoprovideimmediatetechnicalsupport.Onceconnected,theclientcanuploadfilestotheserver,downloadfilesfromtheserver,renameordeletefilesontheserverandsoon.AnysoftwarecompanyorindividualprogrammerisabletocreateFTPserverorclientsoftwarebecausetheprotocolisanopenstandard.VirtuallyeverycomputerplatformsupportstheFTPprotocol.SinceKaseyaFTPsessionsarerelayedthroughtheKServer,allFTPsessionsareprotectedbytheKaseya256bitrollingencryptionprotocol.

TheFTPpageestablishesanFTPsessionbetweentheuser’slocalmachineandaselectedmachineID.OncetheFTPsessionisinitiated,anewbrowserwindowpopsupdisplayingthecontentsofafixeddiskonthemanagedmachine.Justdraganddropfilesasyounormallywould.

FTP Malfunctions

4.4 Files / Processes

Rem

ote

Con

trol


SomereasonsforFTPfailurewithmanagedmachinesare:

1. Theusermachineisblockingoutboundtrafficontheagentcheck-inport(default5721).Thefirewallmayneedtobereconfigured.

2. Thetargetmachineisonaslowconnection.Lettheapplicationsrunlongerthanthetimeoutperiodandseeifthatworks.

3. Anti-virussoftwareonthetargetmachinemayblocktheconnection.ThisproblemiseliminatedifKESSecurityprotectionisinstalledonthetargetmachine.

4. WrongprimaryKServeraddress-RemotecontrolcanonlyconnectthroughtheprimaryKServeraddress.Machineswithanagentcanconnectthrougheithertheprimaryorsecondaryaddress.VerifytheremotemachinecanseetheprimaryKServeraddressusingAgent >Check-in Control.

5. You accessed theKServer from a different address.The helper application gets connection in-formationfromacookieonthelocalmachine.Toaccessthisinformation,thehelperpassestheURLof theKServer toWindows.Sayyoudownloaded thehelperapplication fromwww.yourKServer.net.ThenyouopenanewbrowserandaccesstheKServerbytypinginitsIPaddress192.168.1.34.TheKServerdropsacookiefor192.168.13.34whilethehelpertriestogetacookiecorrespondingtowww.youKServer.net.Thehelperwon’tfindthecookie.Ifthishappenstoyou,justdownloadanewhelperapplicationandtryagain.

Initiating FTPFTPsessioncanbeinitiatedbyclickingthenameoftheremotemachine.Fig.4.10showsthescreenshotof the FTP page. Select themachine ID that youwant to establish an FTP sessionwith. Icons next tothemanagedmachine ID indicate thecurrentconnectionstatus for thatmachine.Onlymachine IDswithanororiconcanbeconnectedtotargetmachinesandhavelivelinks;allotherswillbeinactive.


2. FTP the KServer: ClickingtheFTP the KServerlinkstartsanFTPsessionwiththeKServeritself.Thisoptionisdisplayedonlyformasterroleusers.

3. Enable verbose relay: RemotecontrolorFTPofmachinesbehind firewallsandNATgatewaysmayberelayedthroughtheVSAserverusingahelperapplication.Checkingthisboxdisplaysapopupwindowwithstatusinformationaboutthenormallyhiddenhelperapplication.

Enable / Disable the Machine User’s Ability to Initiate FTP Remotely: Userscanenable /disable themachineuser’sabilityto initiateFTPremotelytotheirownmachinefromanothermachineusingAgent >

Fig. 4.10: Initiating an FTP

session

Rem

ote Control


Portal AccessandSystem >Machine Roles.

AfterselectingthemachineID,weneedtospecifythedriveletterforwhichtheFTPsessionwillbeestablished.Fig.4.11showsthescreenshotofthepagethatappearsafterselectingthemachineID.Youcaneitherselecttheremotefixeddriveoption(driveC)orspecifyanotherdriveletterfortheFTPsession.

Note: Remote Control > SSH page runs an SSH session to connect to Linux and Mac machines. This is a new feature on Kaseya and some of the screenshots may not include the new feature.

4.4.2 Task Manager

TheTask Manager page (Fig. 4.12) performs the same function asMicrosoft’sWindows NT/2000 taskmanager, except that it lists all currently activeprocessesonallmanagedmachines.Clicking the linkofamachineIDtaskstheagentonthemanagedmachinetocollect10secondsofprocessdataatthenextcheck-in.Task ManagerdisplaystheresultsintabularformanditsupportsallWindowsoperatingsystems,Windows95andup.

Kperfmon.exekperfmon.exe isasmallprogramrunbytheagenttocollecttaskdataonthetargetmachine.Itonlyrunswhilecollectingtaskdata.OnsomeOSconfigurationskperfmon.exe maytakeabout4%oftheCPUduringthe10secondsrequiredtocollectdata.zmcEnable / Disable the Machine User’s Ability to Access Task Manager RemotelyUserscanenable/disablethemachineuser’saccesstoTaskManagerontheirownmachineremotelyfromanothermachineusingAgent > Portal Access andSystem > Machine Roles.

To view the tasks runningona particularmachine ID, select themachine ID.The tasks runningon thatmachineIDwillappearonthescreenasshownintheFig.4.12.Toendaprocess,selecttheprocessnamebyclickingonthecheckboxnexttoitandclickonEnd Process.

Fig. 4.11: Select the

drive letter to establish an FTP session

Rem

ote

Con

trol


Fig. 4.12: Task Manager

1. Name: Thenameoftheprocessactivelyrunningonthemanagedmachine.

2. CPU: ThepercentofCPUtimeconsumedbythatprocessoverthe10seconddatacollectioninter-val.

3. Mem Usage: Theamountofmainmemoryusedbyeachactiveprocess.

4. Threads: Thenumberofactivethreadsassociatedwitheachactiveprocess.

5. End Process: Youcankillanyactiveprocessonthemanagedmachinebyselectingtheradiobut-tontotheleftoftheprocessnameandthenclickingtheEnd Processbutton.Inadditiontokillingtheactiveprocess,itre-collectsthetaskdataagain.

4.5.1 Chat

TheChat pageinitiatesorcontinueschatsessionswithloggedonusersonmanagedmachines.Multiplechatsessionscanbeinitiatedatthesametime.EachwindowtitledisplaysthemachineIDnameforthatsession.Thesystemautomaticallyremovesallmessagesolderthanonehour.

ToinitiateachatsessionclickthemachineIDofthemachineyouwishtostartchattingwith.Achatsessionwindowopensonyourmachineandachatwindowopensinabrowserontheremotemachine.Entertextinthetextpane.ClicktheSendbuttonasshowintheFig.4.13tosendthemessage.

4.5 Message with Users

Rem

ote Control


To Respond to a Chat SessionIfachatpopupwindowdisplayswhileyouareloggedontotheKServer,respondbyenteringtextinthetextpane.ClicktheSendbuttontosendthemessage.

Join Session linkMultipleVSAusersmayparticipate in thesamechatsessionwithamachineuser. Ifachatsession is inprogress, theJoin Session linkdisplaysnext to thatmachine ID.Click this link to join thesession. If the session was abnormally shut down,clickthislinktorestartthechatsessionandrecoverallmessagesforthesession.

Chatting with Other VSA UsersThenamesoflogged onVSAuserswhobelongtotheorganizationsandgroupIDscurrentlydisplayedbythemachineID.groupIDfilterdisplayontheChatpageaswell.ClickthelinkofanotherloggedonVSAusertoinitiateachatwiththatVSAuser.

Enable / Disable the Machine User’s Ability to Initiate Chat with VSA UsersUserscanenable/disablethemachineuser’sabilitytoinitiateachatsessionwithVSAusersusing Agent >Portal AccessandSystem > Machine Roles.

Ensuring Chat Opens a New WindowThedefaultsettingforInternet ExplorerreusesopenbrowserwindowswhenanytaskopensanewURL.ThissamebehavioroccurswhenyouclickalinkinanemailorWorddocument(thealreadyopenbrowserwindowisredirectedtothenewURL).TosetInternetExplorer’sdefaultbehaviortoopennewURLsinanewwindowperformthefollowingsteps:

• SelectInternet OptionsfromtheToolsmenuofanyInternet Explorerwindow.

• ClickontheAdvancedtab.

• UnchecktheboxlabeledReuse windows for launching shortcutsintheBrowsingsection.

• ClickOK.

My Machine Makes a ‘Clicking’ Noise Every Time the Chat Window RefreshesManyWindowsthemesconfigurethesystemtoplayasoundeverytimeInternetExplorernavigatestoanewURL.Oneofthese,start.wav,soundslikeaclick.Toturnoffthesoundperformthefollowingsteps:

Fig. 4.13: Initiate a chat

session

Rem

ote

Con

trol


• OpentheControl PanelandselectSounds and Multimedia.

• ClickontheSounds tab.

• ScrolldownandselectStart NavigationintheWindows Explorersection.

• Select(None)fromthedrop-downcontrollabeledName.

• ClickOK.

TheotheroptionsthatareprovidedbytheChatmoduleareshowninFig.4.14below:


2. Play tone with each new message: Checkthisboxtocauseatonetosoundeverytimeanewmessageissentorreceivedbyachatwindow.

3. Automatically close chat window when either party ends chat: Checkthisboxtoclosethechatwindowwheneitherpartyendsthechat.Leaveblank,ifyouwanteachpartytobeabletoviewandcopytextfromthechatwindow,eveniftheotherpartyendsthechat.

4. Remove your name from chat list seen by other administrators: CheckthisboxtoremoveyournamefromthechatlistseenbyotherVSAusers.

5. Remove your name from chat list seen by users: Checkthisboxtoremoveyournamefromthechatlistseenbymachineusers.

4.5.2 Send Message

TheSend Messagepage(Fig.4.15)sendsnetworkmessagestoselectedmachineIDs.Messagescanbesentimmediatelyatthenextmanagedmachinecheck-in,orcanbescheduledtobesentatafuturedateandtime.

Themessageeitherdisplaysimmediatelyonthemanagedmachineortheagenticoninthesystemtrayofthemanagedmachineflashesbetweenawhitebackgroundanditsnormalbackgroundwhenamessageiswaitingtoberead.Whenthemachineuserclick’stheflashingiconthemessagedisplays.

MachineuserscanalsobenotifiedbyaconventionalWindowsdialogboxorthroughabrowserwindow.Ifabrowserwindowisused,enteraURLinsteadofatextmessage.Thisfeaturecanbehandy,forexample,toautomaticallytakeuserstoawebpagedisplayinganupdatedcontactsheetorotherrelevantinformation.

Fig. 4.14: Chat page

Rem

ote Control


ThegeneralviewoftheSendMessagepageisshownintheFig.4.15below.Theoptionsthatareavailableforthismodulearelistedbelow:

1. Enter message/URL sent to remote machines (dialog box or URL): Thetextyouenterdependsonthedisplaywindowyouselect.

• Enteratextmessageifthedisplaywindowisadialogbox.

• EnteraURLifthedisplaywindowisabrowser.

2. Select display window: Select themanner in which the user is notified on themanagedma-chine.ThedefaultisDialogBox,whichdisplaysastandardWindowsdialogboxwiththenetworkmes-sage.BrowserdisplaysaURLinawebbrowserwindow.

3. Send Now: ClickSend Now tosendthemessageimmediatelytoselectedmachines.ThemessagedisplaysintheMessages Not Yet Sent columnuntilthemessageisreceivedbythemachine.Forex-ample,themachinemaybeoffline.

4. Clear Messages: ClickClear Messagestoremovemessagesthathavenotbeendeliveredtoman-agedmachines.Scheduletimetosendmessage.Entertheyear,month,day,hour,andminutetosendthemessage.

5. Schedule: ClickSchedule toscheduledeliveryofthemessagetoselectedmachineIDsusingthescheduleoptionspreviouslyselected.ThemessagedisplaysintheMessages Not Yet Sent columnuntilthemessageisreceivedbytheselectedmachine.

6. Display Immediately/Flash Icon: Thissettingdetermineshowmanagedmachineusersarenoti-fiedoncetheirmessagehasbeenretrievedfromtheKServer.

• Display Immediately notifiestheuserimmediately.

• Flash Icon flashestheagenticoninthesystem tray untiltheuserclickstheicon.ThemessageisthendisplayedaccordingtothesettingsinSelect display window.


Fig. 4.15: Send

message window

Rem

ote

Con

trol


8. Current User: Displaysthecurrentlyloggedonuser.

9. essages Not Yet Sent: Thiscolumndisplaysmessagesnotyetsent.

4.6.1 Power Management

The Power Managementpagepowerson,powersofforrebootsvPro-enabledmachines.Powermanage-mentoptionsareexecutedusingtheagentofthemanagedmachinethatoriginallyidentifiedthevPro-en-abledmachineusingLANWatch.AvProcredentialisrequiredtoexecutepowermanagementoptionsonavPro-enabledmachine.Youcanspecifyacredentialusingthispage.

Note: You can display the hardware assets of vPro-enabled machines with credentials using Agent > View vPro

ThegeneralviewofthePowerManagementpageisshownintheFig4.16below.Theoptionsthatareavailableforthismodulearelistedbelow:

1. Schedule: Scheduleataskonceorperiodically.Eachtypeofrecurrence—Once,Hourly,Daily,Weekly,Monthly,Yearly—displaysadditionaloptionsappropriateforthattypeofrecurrence.Periodicschedulingincludessettingstartandenddatesfortherecurrence.Notalloptionsareavailableforeachtasksched-uled.Optionscaninclude:

• Distribution Window -Reschedulesthetasktoarandomlyselectedtimenolaterthanthenumberofperiodsspecified,tospreadnetworktrafficandserverloading.

• Skipifoffline-Ifcheckedandthemachineisoffline,skipandrunthenextscheduledperiodandtime.Ifblankandthemachineisoffline,runthetaskassoonasthemachineisonlineagain.

• Powerupifoffline-Ifchecked,powersupthemachineifoffline.RequiresWake-On-LANorvProandanothermanagedsystemonthesameLAN.

• Exclude the following time range -Ifchecked,specifiesadate/timerangetonotperformthetask.

4.6 vPro

Fig. 4.16: Power

Management

Rem

ote Control


2. Run Now: RunthepowermanagementoptionsnowonselectedmachineIDs.

3. Cancel: CancelscheduleoptionsforselectedmachinedIDs.

4. Power Up / Power Down / Reboot: Selectthepowermanagementoptiontoexecute.

5. Machine ID. Group ID: ThemachineID.GroupIDofthisvPro-enabledmachine,ifanagentisinstalled.Blank,ifnoagentisinstalled.

6. vPro Host Name: ThenameforthevPro-enabledmachinesetbyvProconfiguration.

7. Proxy Agent: ThemachineID.groupIDofanothermanagedmachineusedtoexecutepoweron,powerofforrebootthisvPro-enabledmachine.TheProxyAgentmustbeonthesameLANasthevPromachine.

8. OS Computer Name: ThenameforthevPro-enabledmachinesetbytheoperatingsystem.

9. IP Address: TheIPaddressofthevPro-enabledmachine.

10. Credentials: AvProcredentialistypicallycollectedduringaLANWatchscan.AcredentialisrequiredbythevPromachinetorespondtobothPowerManagementandRemoteISOBootrequests.Ifnocreden-tialexistsorthecredentialneedstobechangedyoucanclickthiscelltoenteranewcredential.

Theotheroptionsthatareavailableinthispageare:

Expand / Collapse: ClicktheplusiconofavPromachineIDtodisplayahistorytableofpowermanage-mentactionsperformedonthatmachine.Clicktheminusicontocollapsethehistorytable.

Type: Thepowermanagementoptionscheduledtobeexecuted.

Last Power Management: Thelasttimeapowermanagementoptionwasexecuted.

New Power Management: Thenexttimeapowermanagementoptionisscheduledtobeexecuted.

Rem

ote

Con

trol


4.6.2 Remote ISO BootTheRemote ISO Boot pagebootsvPromachinesfromanISOimage.AnagentmachineonthesameLANasthetargetvPromachineisusedtomountavirtualdiskontheVPromachine.ThevirtualdiskpointstoaUNCshareontheLANcontaininganISOimage.TheagentmachinethenbootstheVPromachinefromthevirtualdisk.ARemoteISOBootcannotbescheduled.Thebootoccursimmediately.

VProConfigurationRequirements• TheagentcannotbeonthevPromachine.IthastobeonadifferentmachineinthesameLAN.• TheVPromachinebeingbootedmustbeVPro3.0orgreater.• SOL/IDE-RmustbeenabledintheIntelAMTBIOSextension.Thiscannotbedoneremotely.• TheagentmachineusedtobootthevPromachine,theVPromachinesbeingbootedandtheUNC

mustallbeonthesameLAN.• OnlyUNCsharescanbespecified.Mappeddrivesarenotallowed.• Credentialsmustbedefinedinadvance,providingaccessto:

• Theagentmachine-UseAgent>SetCredentialifnecessary.• TheUNCshareontheLAN-ThenetworkcredentialsandUNCarebothspecifiedwhenthe

ISObooticonisclickedintheRemoteISOBootgrid.• ThevPromachine-vProcredentialsareconfiguredeitherduringLANWatchscanorbyclick-

ingonthecredentialsiconintheRemoteISOBootorPowerManagementgrid.

ComponentsISObootisimplementedviathefollowingcomponents:

• VProProxy.dll -ThisdllisusedbytheagentontheagentmachinetocommunicatewiththeVPromachine.

• Redirect.exe -Thisprocessisrunwiththepassedinnetworkcredentialsandmanagesthevirtualdrive.

SwitchesThefollowingareswitchessenttoVProProxy.dllwhendoinganISOboot.

• -redirect-We’regoingtodoaredirectoperation.Possiblevalues-command• -username-TheVProusername(likeadmin)• -password-ThepasswordfortheVProuser• -ip-Theipaddressofthetargetmachine• -iso-TheUNCpathtotheISOimage• -redirectPath-Thepathtoredirect.exe• -o-ThefullnameandpathoftheoutfileforVProProxy.dll• -redirectOut-Thefullnameandpathoftheoutfileforredirect.exe• -netUsername-Thenameofthenetworkuserwithauthoritytoaccessisoimage.Namemustbein

theformofname@domain.• -newPassword-Thepasswordforthenetworkuser

Fig4.17belowshowsthegenericviewoftheRemoteISObootpage.Theoptionsshownonthispagearelistedandexplainedbelow.

Rem

ote Control


1. Host Name: ThenameforthevPro-enabledmachinesetbyvProconfiguration.

2. Proxy Agent: ThemachineID.groupIDofanothermanagedmachineusedtoexecutepoweron,powerofforrebootthisvPro-enabledmachine.TheProxyAgentmustbeonthesameLANasthevPromachine.

3. Machine.Group ID: ThemachineID.groupIDofthisvPro-enabledmachine,ifanagentisinstalled.Blank,ifnoagentisinstalled.

4. Credentials: ThevProcredentialsaretypicallycollectedduringaLANWatchscan.ThecredentialsarerequiredbythevPromachinetorespondtobothPowerManagementandRemoteISOBootrequests.Ifnonearedefinedortheyneedtobechangedyoucanclickthiscelltodefineanewcredential.

5. Remote ISO Boot: ClicktheRemoteISOBooticontospecifytheUNCFilePath,UserNameandPass-word.ThenclicktheGobutton.

• TheUNCFilePathmustincludethefilenameoftheISOimage.• TheUserNameandPasswordisrequiredtoaccesstotheISOimagefileontheLAN.

Fig. 4.17: Remote ISO

Boot

Rem

ote

Con

trol


remote control - florida international university

Documents