Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to figure out how to allow a group of users to offer unsolicited remote assistance using msra /offerra to their fellow domain members.

I have created a policy enabling "Offer Remote Assistance" and filling the DOMAIN\RAHelpers user group into the "Helpers" list. I can see the DOMAIN\RAHelpers group turning up as a member in the local "Offer Remote Assistance Helpers" group of the targeted domain computers after the policy is applied. Yet, I am unable to set up a remote assistance connection with one of these users unless they are also a member of the local Administrators group of the to-be-assisted machine. The error message is rather unspecific ("Your offer to help could not be sent"), but I suspect a DCOM permission issue since RA seems to use DCOM and local administrators can connect for help just fine.

What minimal permission set would I need to allow for unsolicited remote assistance? I obviously do not want to promote all helpers to local administrators.

share|improve this question

It turned out to be as easy as adding the users to the "Distributed COM Users" local group.

The "Enable remote assistance" policy does not change this group's memberships and unsolicited remote assistance seems to depend on DCOM remote activation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.