2

I've tried:

  • Disabling UAC
  • Every bandwidth optimization option
  • Unchecking all boxes in the Performance Options:Visual Effects tab

But still, every time, all they see is a black screen with my mouse cursor moving about.

Environment is:

  • Remote Assistance requestor (server): Windows 8.1 VMware guest
  • Remote Assistance responder (client): Windows 7, Windows 8.1

Any advice?

3 Answers 3

1

I remember when I had this issue in my environment. Per the following link https://technet.microsoft.com/de-de/library/ee844127%28v=ws.10%29.aspx

In your Group Policy (gpedit.msc) settings (If domain, apply to the appropriate Organizational Unit), go to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.

Change the following setting User Account Control: Switch to the secure desktop when prompting for elevation to disabled.

EDIT Remember to update your computers with the latest group policy change. In CMD Prompt run gpupdate /force to update your computers to the latest group policy settings. To open cmd prompt, in Windows, click in your Search bar and type in Command Prompt.

1

I recently created this PowerShell solution which can be used when need to open a Remote Assistance session and type in the elevated UAC credential that cannot be share with the end-user being assisted.

Technically you can run just the Invoke-Command and point it to the remote computer, and then ensure the Set-ItemProperty has the appropriate 1 or 0 value for "PromptOnSecureDesktop" to enable or disable.

I wanted to ensure that when I need to run msra in an elevated session, I can just execute the script and be assured the UAC secure desktop security is re-enabled automatically after the msra session has ended.

Essentially this will...

  • prompt you for the computer name

  • disable the "UAC secure desktop" via the remote registry change and commands

  • start an msra session that works same way it works always works from here

  • enable the "UAC secure desktop" via the remote registry change and commands once the correlated msra instance ends

To use you only need to...

  1. Save the PowerShell script as a text document with a .ps1 file name extension
  2. Open a PowerShell command prompt and type (or paste) in the full script path and filename, and press Enter
  3. Enter in the computer name of the computer you are connecting to with remote assistance and press Enter.
  4. When done with the remote assistance session, close the mrsa process if it's still running

Tip: Use the non-elevated "other/standard" method of msra most of the time, and only use this as-needed.

PowerShell Script

$pc = Read-Host "Enter the remote computer name to disable secure desktop";

Invoke-Command -ComputerName $pc -Scriptblock {
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Value 0 -Force;
    };

$remoteAssist = "$Env:windir\system32\msra.exe";
Start-Process $remoteAssist "/offerra" -Wait;
Write-Host "Your Remote assist session has ended" -ForegroundColor Red;

Invoke-Command -ComputerName $pc -Scriptblock {
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop"  -Value 1 -Force;
    };

Execute Example

Note: Just paste in the full path script name and press enter.

PS C:\Users\User> \\myserver.domain.com\sharename\folder\script\Elevate-RemoteAssist.ps1

Supporting Resources

  • User Account Control: Switch to the secure desktop when prompting for elevation

    The secure desktop presents the logon UI and restricts functionality and access to the system until the logon requirements are satisfied.

    The secure desktop’s primary difference from the user desktop is that only trusted processes running as SYSTEM are allowed to run here (that is, nothing is running at the user’s privilege level). The path to get to the secure desktop from the user desktop must also be trusted through the entire chain.

    Possible values

    • Enabled

      • All elevation requests by default go to the secure desktop.
    • Disabled

      • All elevation requests go to the interactive user desktop.

    source

  • Invoke-Command

  • Set-ItemProperty
  • Start-Process
     -Wait
       Wait for the specified process to complete before accepting more input.
       This parameter suppresses the command  prompt or retains the window
       until the process completes
    
2
  • Interesting, would you like to adapt this for use with Quick Assist? C:\windows\system32\quickassist.exe – it will probably fit nicely as an answer elsewhere (not under MSRA.EXE). Thanks Feb 8, 2021 at 12:12
  • stackoverflow.com/q/66920815/38108 I'm struggling (PowerShell is quite new to me) … Apr 2, 2021 at 14:36
0

I would get the same thing using RDP at my last job. I would remote to caller, it would require admin user/pass which I couldn't give them or see the prompt to enter. Just got a black screen that said pause.

To resolve according to MS forums, Computer Configuration > Windows Settings > Local Policies > Security Options > User Account Control : Switch to the secure desktop when prompting for elevation. Check Define this policy setting and select Disabled.

However our GPO, at my last job, was causing the problem and I couldn't convince anyone to step in and resolve. So I moved to Bomgar as a remote assistance solution.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .