Successful deployment of VNC to W10 Stations and appropriate firewall modifications?

[talksr]

Has anyone managed to successfully deploy VNC/WinVNC or similar to Windows 10 stations via Group Policy and made appropriate Firewall modifications via Group Policy?

 

I am looking to undertake this for our systems and would be grateful if anyone has a tried and tested method.

[Katy]

I install TightVNC using a .bat script set as a Startup Script in group policy (as I couldn't get the huge list of property values to save correctly in an MST):

 

 @echo off
if exist "c:\program files\TightVNC\tvnserver.exe" goto :END

msiexec /i "tightvnc-2.7.10-setup-64bit.msi" /quiet /norestart ADDLOCAL="Server"  VIEWER_ASSOCIATE_VNC_EXTENSION=1 SERVER_REGISTER_AS_SERVICE=1 SERVER_ADD_FIREWALL_EXCEPTION=1 VIEWER_ADD_FIREWALL_EXCEPTION=1 SERVER_ALLOW_SAS=1 SET_USEVNCAUTHENTICATION=1 VALUE_OF_USEVNCAUTHENTICATION=1 SET_PASSWORD=1 VALUE_OF_PASSWORD=******* SET_USECONTROLAUTHENTICATION=1 VALUE_OF_USECONTROLAUTHENTICATION=1 SET_CONTROLPASSWORD=1 VALUE_OF_CONTROLPASSWORD=*******
:END
exit

 

That command should install the server only (no viewer), configure the firewall and set the passwords.

 

There is also a section in Group Policy somewhere that you can set firewall rules, not sure if I also set it there or not.

[Chuckster]

Here is my MST file for TightVNC.

 

Server

TightVNC - Server Install - Copy.mst

This has all the shortcuts removed for the start menu and references for Viewer. It disables the ability of uninstalling the program; displaying the VNC icon in the system tray, and it leaves the desktop wallpaper alone when remotely viewing a workstation. It also creates automatic firewall rules whilst disabling HTTP access.

 

Viewer & Server

TightVNC - Viewer Install - Copy.mst

Has all the shortcuts for the start menu. Installs the Viewer and Server component, and it also disables the ability of uninstalling the program; displaying an icon in the system and it also creates automatic firewall rules whilst disabling HTTP access. Use this for your own machine.

 

Note: Change the default password that I've set, which is Password.

 

@Katy, it's probably worthwhile testing the MST in your environment.

Edited February 28, 2017 by Chuckster

[talksr]

Thanks both, very helpful.

Don't think I have yet used an MST. How do you deploy this?

Is it via the start up script or group policy?

[Chuckster]

Group policy.

 

Add the MSI to a GPO... select advanced.... go to the Modifications tab and add the MST file here.

[cpjitservices]

Skeep VNC Console is your friend.

[Geoff]

As I threatened to do in a previous thread I have a PSADT script that uninstalls old VNC and puts on the new version with the correct settings. I have a seperate 'firewall' GPO for controlling the Windows Firewall ports. I am deploying via SCCM but that wouldn't be required to use the script.

[Yert1969]

Would you mind sharing your deployment script? I need to complete an Ultra VNC deployment and could really use it. Thanks.

[Arcolite]

Out of interest, why use VNC? Don't get me wrong, it was great when there was no alternative - but since Vista there are been built in tools that work just as well.

 

For the last 8 years we've been using the built in Remote Assistance for helping users and regular Remote Desktop for administration when needed.

Both work flawlessly and require very little configuration and no deployment.

Edited July 27, 2017 by Arcolite

[DJ-1701]

Out of interest, why use VNC? Don't get me wrong, it was great when there was no alternative - but since Vista there are been built in tools that work just as well.

 

For the last 8 years we've been using the built in Remote Assistance for helping users and regular Remote Desktop for administration when needed.

Both work flawlessly and require very little configuration and no deployment.

 

Remote Assistance needs a user to be at the computer to reply to requests for control. Sometimes you need to do things under a users context with user rights, but they have stepped away from the computer. Even if you have their username and password, usually Remote Desktop is restricted for Administrators of that computer unless you want to go about changing GPO settings and even then if the problem is something to do with video software or playback certain features are disabled under Remote Desktop.

[Arcolite]

Remote Assistance needs a user to be at the computer to reply to requests for control. Sometimes you need to do things under a users context with user rights, but they have stepped away from the computer. Even if you have their username and password, usually Remote Desktop is restricted for Administrators of that computer unless you want to go about changing GPO settings and even then if the problem is something to do with video software or playback certain features are disabled under Remote Desktop.

 

I guess policies are different elsewhere, but here - if it needs to be done as the user, the user has to be present. We never access a users session without them being either on the phone with us, or stood next to us.

We would never remote into someones machine without them accepting the request (our VNC config had a prompt the users had to click) even if they had asked us to do it. They need to be there.

 

If it can't be fixed over MSRA/RDP then they either need to come to our office (Laptop users) or we'd schedule a time to visit them.

 

We function very much like a corporate environment in that regard.

Edited July 27, 2017 by Arcolite

[Blue_Cookeh]

As I threatened to do in a previous thread I have a PSADT script that uninstalls old VNC and puts on the new version with the correct settings. I have a seperate 'firewall' GPO for controlling the Windows Firewall ports. I am deploying via SCCM but that wouldn't be required to use the script.

 

Just out of interest, since you use SCCM - why are you deploying VNC? SCCM has a Remote Control console built right in with auditing and a configuration policy (through the SCCM client policy settings)

[Geoff]

Would you mind sharing your deployment script? I need to complete an Ultra VNC deployment and could really use it. Thanks.

 

	If ($deploymentType -ine 'Uninstall') {
	##*===============================================
	##* PRE-INSTALLATION
	##*===============================================
	[string]$installPhase = 'Pre-Installation'
	
	## Show Welcome Message, allow up to 3 deferrals, verify there is enough disk space to complete the install, and persist the prompt
	Show-InstallationWelcome -AllowDefer -DeferTimes 3 -CheckDiskSpace -PersistPrompt
	
	## Show Progress Message (with the default message)
	Show-InstallationProgress
	
	## Clean up and remove old VNC installs 

       ## Old MSI Installs (Probably only on Newer Win10 Images)
       Remove-MSIApplications -Name 'UltraVNC'

       ## Old INNO Installs (Win7, Win10 LTSB Images)
       ## Parameters for INNO Uninstall are here: http://www.jrsoftware.org/ishelp/index.php?topic=uninstcmdline

       if (Test-Path "$envProgramFiles\uvnc bvba\UltraVnc\unins000.exe") 
           {
               Execute-Process -Path "$envProgramFiles\uvnc bvba\UltraVnc\unins000.exe" -Parameters '/SUPPRESSMSGBOXES /NORESTART /SP-'
           }
       if (Test-Path "$envProgramFilesX86\uvnc bvba\UltraVnc\unins000.exe") 
           {
               Execute-Process -Path "$envProgramFilesX86\uvnc bvba\UltraVnc\unins000.exe" -Parameters '/SUPPRESSMSGBOXES /NORESTART /SP-'
       	}
	
	
	##*===============================================
	##* INSTALLATION 
	##*===============================================
	[string]$installPhase = 'Installation'
	
       #Check Architecture and install correct version of VNC MSI

       Switch ($is64Bit)
	  {
           $True
               {
                   Execute-MSI -Path 'UltraVnc_1212_X64.msi'
               }

		$False
   			{
                   Execute-MSI -Path 'UltraVnc_1212_x86.msi'			
               }
       }
	
       ## TODO: Copy and register mirror driver (Make sure the uninstall is written too!)

       ## TODO: Copy screen recorder

       ## TODO: Copy Encryption Plugins

	
	##*===============================================
	##* POST-INSTALLATION
	##*===============================================
	[string]$installPhase = 'Post-Installation'
	
       ## Stop UltraVNC service

       Stop-ServiceAndDependencies -Name 'uvnc_service'
       
       ## Copy UltraVNC.ini

       Switch ($is64Bit)
	  {
           $True
               {
                   Copy-File "$dirSupportFiles\ultravnc.ini" "$envProgramFiles\uvnc bvba\UltraVnc\"
                   # Ammend Path for Arch
                   Set-IniValue -FilePath "$envProgramFiles\uvnc bvba\UltraVnc\ultravnc.ini" -Section 'admin' -Key 'path' -Value "$envProgramFiles\uvnc bvba\UltraVNC"
                   # Import AD groups
                   Execute-Process -Path "$envProgramFiles\uvnc bvba\UltraVnc\MSLogonACL.exe" -Parameters "/i /o $dirSupportFiles\mslogin.txt"
               }

		$False
   			{
                   Copy-File "$dirSupportFiles\ultravnc.ini" "$envProgramFilesX86\uvnc bvba\UltraVnc\"
                   # Ammend Path for Arch
                   Set-IniValue -FilePath "$envProgramFilesX86\uvnc bvba\UltraVnc\ultravnc.ini" -Section 'admin' -Key 'path' -Value "$envProgramFilesX86\uvnc bvba\UltraVNC"
                   # Import AD Groups
                   Execute-Process -Path "$envProgramFilesX86\uvnc bvba\UltraVnc\MSLogonACL.exe" -Parameters "/i /o $dirSupportFiles\mslogin.txt"
               }
       }


       ## Start Ultra VNC service to pick up new settings
	
       Start-ServiceAndDependencies -Name 'uvnc_service'
}
ElseIf ($deploymentType -ieq 'Uninstall')
{
	##*===============================================
	##* PRE-UNINSTALLATION
	##*===============================================
	[string]$installPhase = 'Pre-Uninstallation'
	
	## Show Welcome Message
	Show-InstallationWelcome
	
	## Show Progress Message (with the default message)
	Show-InstallationProgress
	
	
	##*===============================================
	##* UNINSTALLATION
	##*===============================================
	[string]$installPhase = 'Uninstallation'
	
	
       Remove-MSIApplications -Name 'UltraVNC'		

       ## TODO: Uninstall mirror driver
	
	##*===============================================
	##* POST-UNINSTALLATION
	##*===============================================
	[string]$installPhase = 'Post-Uninstallation'
	
	## Clean up install folders so no old ultravnc.ini, mirror drivers or encryption plugins are on the machine
	
       Remove-Folder "$envProgramFiles\uvnc bvba" -ContinueOnError $True
       Remove-Folder "$envProgramFilesX86\uvnc bvba"-ContinueOnError $True

}

##*===============================================
##* END SCRIPT BODY
##*===============================================

[Geoff]

Just out of interest, since you use SCCM - why are you deploying VNC? SCCM has a Remote Control console built right in with auditing and a configuration policy (through the SCCM client policy settings)

 

Technical Debt

[PBrawn]

Sorry to drag up an old thread, but I'm having a lot of issues trying to create / customise the MST to work the way I want it.

I plan to deploy this to all our classroom 'teacher' PCs, which would only allow student(s) to connect if the teacher actively runs TightVNC server (so not to be run as a service)

The student who wants to use this has a macbook, so I'm using the realvnc 'vncconnect' client, which I've tested and works fine as a viewer.

I can get to the point where it installs as a server only, and not as a service, with only the relevant server shortcut available.

I have successfully set up a view only connection password, but it seems each time I install the TightVNC server, the necessary setting for session sharing (always treat as shared) doesn't apply, and is stuck on 'Disconnect existing clients......' - preventing the client from connecting (is fine when set manually)

(I have tried using an MST just to create the needed shortcuts, whilst using MSI property switches to set passwords, and I have tried configuring fully through MST (which often throws up errors)).

What I did notice is that lots of registry settings specific to TightVNC seem to stick, even after uninstallation - is there a method to properly clean up the installation settings so that each time I try a new MST, I know I'm working from a blank template?

I've also tried amending the above MST (and applied it to the matching v2.5 version of TightVNC), but it has the same result (plus I'd really like to be running the latest version).

 

I've been through the PDF documentation for 2.5 and 2.8.27, and followed the guidelines for MSI property settings in the PDF on their website, but I can only assume I'm creating a conflict somewhere that prevents this setting from sticking.

 

Is anyone able to offer a little help on this? Our hard-of-seeing student is having difficulty in lessons without this!

Thanks.

Edited January 13, 2020 by PBrawn

[PBrawn]

Ok, I got a little further and figured out that if it runs as a service, the connection works fine. Unfortunately, I need it to run on demand to prevent the students looking at screens whilst staff are unaware, and we also need to have to have a view only password set.

 

The only way I can get this to work in app mode, is by manually setting the 'session sharing' setting to 'always shared......', (which then also complains about passwords not being set), and despite trying to set in both the MST, or as an installation property, it doesn't install 'always shared' set.

 

Any hints? It seems like I'm almost there - but missing something!