Επεξεργασία

Deploying Remote Help with Microsoft Intune

This article describes the steps to deploy Remote Help with Microsoft Intune.

When planning your deployment of Remote Help, consider the following best practices:

  • User communication and training: To drive adoption and effective use, provide documentation or brief training for both your helpdesk and end-users.

  • Helpdesk training: Make sure your support team knows how to initiate sessions. Make them aware of the capabilities like launching a session through the Intune admin center or the Remote Help app, how to generate/enter session codes. Also make them aware of the limitation of not being able help users outside the tenant. Emphasize security practices, like confirming end-user consent on the call before taking control.

  • End-user guidance: Let your users know that a new remote support tool is available. Instruct them on how a support session is initiated – for example, "When you contact the IT helpdesk, they might ask you to open the Remote Help app and share a code, or you might receive a popup notification to allow screen sharing." Reassure them that the tool is secure and only authorized IT can connect, and that they must allow any screen sharing or control.

  • Security monitoring: Keep an eye on the usage to detect any anomalous behavior. For instance, Intune's audit logs and Entra ID sign-in logs show who is signing in to Remote Help. Unusual times or unknown helpers should be investigated. Also ensure that when a staff member leaves the support team, they're removed from the Remote Help roles to revoke their ability to use the tool.

  • Updates and new features: Remote Help is evolving. Microsoft might roll out new features (for example, the ability to support more platforms or an improved web helper dashboard). Stay updated via the Intune release notes or tech community blogs. Knowing these updates can help you refine your support process.

Configure Remote Help for your tenant

To configure your tenant to support Remote Help, review and complete the following tasks. These tasks are important to configure for all Remote Help platforms that are supported.

Task 1: Enable Remote Help

  1. Sign in to the Microsoft Intune admin center and go to Tenant administration > Remote Help.

  2. On the Settings tab:

    1. Set Enable Remote Help to Enabled to allow the use of Remote Help. By default, this setting is disabled.
    2. Set Allow Remote Help to unenrolled devices to Enabled if you want to allow this option. By default, this setting is disabled.
    3. Set Disable chat to Yes to remove the chat functionality in the Remote Help app. By default, chat is enabled and this setting is set to No.

  3. Select Save.

Note

New licenses or trial licenses could take a while to become active, from anywhere between 30 minutes to 8 hours. New Remote Help sessions might continue to indicate Remote Help isn't enabled for the tenant, even if Remote Help is enabled.

Task 2: Configure permissions for Remote Help

Remote Help uses Microsoft Intune role-based access controls (RBAC) to set the level of access a helper is allowed. Through RBAC, you determine which users can provide help and the level of help they can provide.

The built-in Help Desk Operator role includes most required permissions but doesn't include the Remote Help app - Windows unattended control remote sign-in permission. To grant unattended control on Windows devices, create a custom Intune role that includes this permission. You can assign the built-in Help Desk Operator role for standard Remote Help scenarios, or create custom roles to grant only the Remote Help and remote task permissions required for specific groups of users. For more information about the individual permissions required for Remote Help, see Plan Remote Help.

Download Remote Help apps

For Windows support, attended and unattended support use separate applications and workflows. This separation helps organizations distinguish between user-assisted and help desk-initiated support and provides greater control over how each type is managed, deployed, secured, and permitted.

Attended support

Attended support refers to sessions in which an end user participates and grants access to the helper. Attended sessions support view-only access, full control, and optional UAC elevation.

Directly download the latest version of Remote Help from Microsoft at aka.ms/downloadremotehelp.

The most recent version of Remote Help is 5.2.1037.0.

Unattended support

Unattended support refers to sessions that allow authorized helpers to access and control an Intune-managed device without an active participant in the session.

The Azure Virtual Desktop agent and Azure Virtual Desktop agent bootloader must be installed. Install the agent first, and then install the bootloader. No further configuration is required after installation. Download the installers from the following links:

Follow the prompts. When the installer prompts for a registration token, it automatically populates the field with INVALID_TOKEN. Leave this value unchanged, select Next, and complete the installation.

Install Remote Help apps

Remote Help is available as a download from Microsoft and must be installed on each device before that device can participate in a Remote Help session. For Windows support, attended and unattended support use separate applications and workflows. This separation helps organizations distinguish between user-assisted and help desk-initiated support and provides greater control over how each type is managed, deployed, secured, and permitted.

Attended support

Remote Help's default behavior opts users into automatic updates and updates itself when an update is available. When a new version of Remote Help is required, the app prompts users to update. To install an updated version, you can use the same process you used before to download and install Remote Help. There's no need to uninstall the previous version before installing the updated version.

  • As an Intune admin, you can download and deploy the app to enrolled devices. For more information about app deployments, see Install apps on Windows devices.
  • Individual users who have permissions to install apps on their devices can also download and install Remote Help.

Note

  • On May 2022, existing users of Remote Help see a recommended upgrade screen when they open the Remote Help app. Users are able to continue using Remote Help without upgrading.
  • On May 23, 2022, existing users of Remote Help will see a mandatory upgrade screen when they open the Remote Help app. They can't proceed until they upgrade to the latest version of Remote Help.
  • Remote Help requires Microsoft Edge WebView2 Runtime. During the Remote Help installation process, if Microsoft Edge WebView2 Runtime isn't installed on the device, then Remote Help installs it. When Remote Help is uninstalled, Microsoft Edge WebView2 Runtime isn't uninstalled.
Deploy Remote Help as an Enterprise App Catalog app

The Enterprise App Catalog is a collection of prepackaged Win32 apps that are prepared by Microsoft to support Intune. An Enterprise App Catalog app is a Windows app that you can add via the Enterprise App Catalog in Intune. This app type uses the Win32 platform and has support for customizable capabilities. Remote Help is available in the Enterprise App Catalog. To learn more, see Add an Enterprise App Catalog app to Microsoft Intune.

Deploy Remote Help as a Win32 app

To deploy Remote Help with Intune, you can add the app as a Windows Win32 app, and define a detection rule to identify devices that don't have the most current version of Remote Help installed. Before you can add Remote Help as a Win32 app, you must repackage *remotehelpinstaller.exe* as a *.intunewin* file, which is a Win32 app file you can deploy with Intune. For information on how to repackage a file as a Win32 app, see Prepare the Win32 app content for upload.

After you repackage Remote Help as a .intunewin file, use the procedures in Add a Win32 app with the following details to upload and deploy Remote Help. In the following, the repackaged remotehelpinstaller.exe file is named remotehelp.intunewin.

Important

To take advantage of the command line example, ensure the downloaded file is renamed to remotehelpinstaller.exe.

  1. On the App information page, select Select app package file, and locate the remotehelp.intunewin file previously prepared, and then select OK.

    Add a Publisher and then select Next. The other details on the App Information page are optional.

  2. On the Program page, configure the following options:

    • For Install command line, specify remotehelpinstaller.exe /quiet acceptTerms=1.
    • For Uninstall command line, specify remotehelpinstaller.exe /uninstall /quiet acceptTerms=1.

    To opt out of automatic updates, specify enableAutoUpdates=0 as part of the install command remotehelpinstaller.exe /quiet acceptTerms=1 enableAutoUpdates=0.

    Important

    The command line options acceptTerms and enableAutoUpdates are always case sensitive.

    Leave the rest of the options at their default values and select Next to continue.

  3. On the Requirements page, configure the following options to meet your environment requirements, and then select Next:

    • Operating system architecture
    • Minimum operating system

  4. On the Detection rules page, for Rules format, select Manually configure detection rules, and then select Add to open the Detection rule pane. Configure the following options:

    • For Rule type, select File

    • For Path, specify C:\Program Files\Remote Help

    • For File or folder, specify RemoteHelp.exe

    • For Detection method, select String (version)

    • For Operator, select Greater than or equal to

    • For Value, specify the Remote Help version that you're deploying. For example, 10.0.22467.1000. See the next note in this article for details on how to get the Remote Help version.

    • Leave Associated with a 32-bit app on 64-bit clients set to No

      Note

      To get the version of the RemoteHelp.exe, install RemoteHelp manually to a machine and run the following PowerShell command: (Get-Item "$env:ProgramFiles\Remote Help\RemoteHelp.exe").VersionInfo. From the output, make a note of the FileVersion and use it to specify the Value in the detection rule.

  5. Proceed to the Assignments page, and then select an applicable device group or device groups that should install the Remote Help app. Remote Help is applicable when targeting groups of devices and not for user groups.

  6. Complete creation of the Windows app to have Intune deploy and install Remote Help on applicable devices.

Unattended support

Unattended support refers to sessions that allow authorized helpers to access and control an Intune-managed device without an active participant in the session.

Unattended control remote sign-in relies on the Azure Virtual Desktop agent and Azure Virtual Desktop agent bootloader. Install the agent first, and then install the bootloader because the bootloader depends on the agent.

When the device is powered on and has internet access, the agent will update automatically. The Azure Virtual Desktop agent self-updates when newer versions are available. The update process can't be controlled or managed, and the agent remains current with the latest version available for the Azure Virtual Desktop service.

Deploy Remote Help unattended support as a Win32 app

For Windows devices that use unattended control, deploy the Azure Virtual Desktop agent before deploying the Azure Virtual Desktop agent bootloader. To ensure the apps install in the correct order, configure the bootloader app to depend on the agent app.

First, prepare each installer as a separate Win32 app package:

  1. Download the following installers:

  2. Create separate source and output folders for each installer.

  3. Use the Microsoft Win32 Content Prep Tool to package each MSI file as an .intunewin file. For more information, see Prepare the Win32 app content for upload.

After you prepare both packages, create the Azure Virtual Desktop agent app:

  1. Use the procedures in Add a Win32 app to add a Windows app (Win32).

  2. On the App information page, select Select app package file, select the Microsoft.RDInfra.RDAgent.Installer-x64-<version>.intunewin file previously prepared, and then select OK.

    For Publisher, specify Microsoft. Configure any other app information required by your organization, and then select Next.

  3. On the Program page, review the automatically populated install and uninstall commands. You don't need to modify them. Select Next.

  4. On the Requirements page, configure the following options, and then select Next:

    • For Minimum operating system, select Windows 10 1607 or a later version supported by your environment.

  5. On the Detection rules page, configure the following options:

    • For Rules format, select Manually configure detection rules, and then select Add.
    • For Rule type, select MSI.
    • Confirm that the MSI product code is populated, select OK, and then select Next.

  6. On the Dependencies page, don't add a dependency. Select Next.

  7. On the Supersedence page, configure supersedence if required by your organization, and then select Next.

  8. On the Assignments page, add the device groups that should receive the app, and then select Next.

  9. Review the app configuration, and then select Create.

After the Azure Virtual Desktop agent app is created, create the bootloader app:

  1. Repeat the preceding steps using the Microsoft.RDInfra.RDAgentBootLoader.Installer-x64-<version>.intunewin file that you prepared.

  2. On the Dependencies page, select Add, and then select the Azure Virtual Desktop agent app, Remote Desktop Services Infrastructure Agent, that you created.

  3. Keep Automatically install set to Yes, select the agent app, and then select Next.

  4. On the Assignments page, assign the bootloader app to the same device groups as the agent app.

  5. Review the app configuration, and then select Create.

Intune installs the Azure Virtual Desktop agent first, and then installs the bootloader after detecting the agent dependency.

Configure Remote Help

Attended support

Depending on which environment Remote Help is utilized in, it might be necessary to create firewall rules to allow Remote Help through the Windows Firewall. In situations when it's necessary, the following Remote Help executables should be allowed through the firewall:

  • C:\Program Files\Remote help\RemoteHelp.exe
  • C:\Program Files\Remote help\RHService.exe
  • C:\Program Files\Remote help\RemoteHelpRDP.exe

Unattended support

Enable Remote Desktop with a configuration profile

To allow target devices to accept remote connections, use a Windows settings catalog configuration profile to enable Remote Desktop.

Before you create the profile, ensure the firewall allows Remote Desktop Protocol (RDP) traffic.

To create and assign the configuration profile:

  1. In the Microsoft Intune admin center, go to Devices > Manage devices > Configuration.

  2. Select Create > New policy, and then configure the following options:

    • For Platform, select Windows 10 and later.
    • For Profile type, select Settings catalog.

    Select Create.

  3. On the Basics page, enter a name and optional description for the profile, and then select Next.

  4. On the Configuration settings page, select Add settings.

  5. In the settings picker, search for Remote Desktop, and then select Allow users to connect remotely by using Remote Desktop Services.

  6. Set Allow users to connect remotely by using Remote Desktop Services to Enabled, and then select Next.

  7. On the Assignments page, select the device groups that should receive the profile, and then select Next.

  8. Review the profile configuration, and then select Create.

After you assign the profile and the targeted devices check in, Intune applies the Remote Desktop setting. To monitor deployment, go to Devices > Manage devices > Configuration > Policies, and then select the profile. Review Device and user check-in status, Device assignment status, or Per setting status.

To verify the setting on a device, go to Settings > System > Remote Desktop, and confirm that Remote Desktop is enabled.

Update Remote Help apps

Remote Help receives updates via Microsoft Update if configured. Otherwise, you need to update the application by using the Enterprise App Catalog (available as part of Intune Suite) or by packaging and deploying the update as a Win32 app.

Set up Conditional Access for Remote Help

This section outlines the steps for provisioning the Remote Help service on the tenant for Conditional Access.

  1. Open PowerShell in admin mode.
  2. Within PowerShell, enter the following commands:

Installation

Install-Module Microsoft.Graph -Scope CurrentUser

Sign in

Use the Connect-MgGraph command to sign in with the required scopes. You need to sign in with an admin account to consent to the required scopes.


Connect-MgGraph -Scopes "Application.ReadWrite.All"

Create the service principal

Create a Service Principal using the Remote Assistance Service AppId 1dee7b72-b80d-4e56-933d-8b6b04f9a3e2.

New-MgServicePrincipal -AppId "1dee7b72-b80d-4e56-933d-8b6b04f9a3e2"

DisplayName                                     Id AppId                                   ServicePrincipalType
----                                         ------- -----------                                   ---------------
RemoteAssistanceService                      3d5ff82b-a5f2-483a-xxxx-9514ed66f7c5        1dee7b72-b80d-4e56-933d-8b6b04f9a3e2

The output has been shortened for readability.

The ID corresponds to the app ID for the Remote Assistance Service.

The display name is Remote Assistance Service, which is the backend service for Remote Help. 

Sign out

Use the Disconnect-MgGraph command to sign out.

Disconnect-MgGraph

Building a Conditional Access policy

After the Remote Help service principal is created, learn more about how to set up a conditional access policy.

To apply conditional access policies to Remote Help, follow these steps:

  1. Navigate to the conditional access policy that you created.
  2. Select Target resources.
    1. Select Resources (formerly cloud apps) to specify what this policy applies to.
    2. Select Exclude.
    3. Select Select resources.
    4. Under Select, check the RemoteAssistanceService with the app ID of 1dee7b72-b80d-4e56-933d-8b6b04f9a3e2.

Next Steps

Next: Using Remote Help >

  • Last updated on