Remote Assistance with Mandatory Profiles

[FreeWill]

I currently use Windows Remote Assistance (msra.exe /expert) to connect to, view and control users' computers if they have a software problem.

This works great with users who have roaming profiles - but not for those who have mandatory profiles. When attempting to connect to a user who has a mandatory profile the following error is displayed on the user's screen:
"There was a problem starting Remote Assistance
Remote Assistance is unavailable for the current user account. If you are using a Windows Guest account try logging in with another account. If you are not using a Guest account, try restarting your machine."

The Remote Assistance on the initiator's PC times out after a few minutes.

The problem appears not to be our mandatory profile; I have created a new mandatory profile using the 'default' user profile and this still failed. When the ntuser.dat extension was changed to .man the error above was displayed and the connection would not be made. After rebooting the PC, changing the ntuser.man extension to .dat allowed the connection to be made OK. i.e. the problem appears not to lie within the content of the ntuser file or profile, but the way in which Windows interprets the .man extension - apparently placing a restriction on Remote Assistance connections.

Does anyone have a solution / suggestions that may lead to a solution to this?

We are using Windows 7 64bit Enterprise with all the latest updates. The roaming / mandatory profile is hosted on a share which the users have full control (share & NTFS) over.

Thanks in advance,
FW.

[Superfli]

Our company were also getting this problem when trying to use windows RA instead of Citrix shadowing on Win2008 x64 R2 RDC server.
Apparently PKI and encryption have trouble with temporary profiles since the secrets cannot be persisted (in the profile), this can be fixed by modifying the state key on the profile list:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\<YOUR_SID>\State (REG_DWORD) = 0

Note that Windows 2008 doesn’t do the encryption check; it seems to be something added to R2 only.

We are to add this to a logon script for all users, so we can RA to their Citrix sessions.

Hope this helps

[g0llem]

We have exactly the same problem here:

W7SP1 desktops for users and servicedesk. Mandatory profile for users. When we try to initiate remote assistance we get:

"There was a problem starting Remote Assistance
Remote Assistance is unavailable for the current user account. If you are using a Windows Guest account try logging in with another account. If you are not using a Guest account, try restarting your machine."

When we remove the mandantory profile for the user everything works great.

I tried the fix with the registry key but that didn't work.

I'm open for ideas,

Found what I was doing wrong: I put the regkey with sid of the servicedesk group in the profilelist. I needed to change the created registerkey of the logged in user. After manualy changing the <usersid>\State=0 it works again.

Now I am looking for a way to implement this in the preferences part of the GPO

[brightg]

Hi there

Thanks for the post, worked for me.

I went with a GPO in the end using a group policy preference.

Within the Registry section I created a new action to update

Hive HKEY_LOCAL_MACHINE
Key path SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%LogonUserSid%
Value name State
Value type REG_DWORD
Value data 0x0 (0)


The %LogonUserSid% came in very handy for this tasks otherwise it would have been a little difficult.

Hope that helps someone else