KACE Desktop Authority 11.2.1 - ExpertAssist User Guide

Installed Applications

Typically, you can view applications installed on a remote computer using the Add or Remove Programs. However, this requires you choose Start|Control Panel|Add or Remove Programs right on the remote computer or press <Windows Logo> + <R>, type appwiz.cpl and press <Enter>. Whilst you can do that from the Remote Control applet, it is much easier to do that from the Installed Application page. It will save your traffic, and allow you export the retrieved list of all the applications, hotfixes, service packs to your local computer right from the browser. If some of the applications installed on the remote computer is failing, you can review the list and locate the faulting one.

To remove the application:

1. If necessary, you can remove the application by copying the string present in the Uninstall String for the application. This string is only displayed if supported by the application itself.
2. To uninstall the application, open the Command Prompt page under the Computer Management object, paste the copied string and hit <Enter>.

Please note that Command Prompt runs applications non-interactively (technically, in another Window Station).

When uninstalling applications by executing the uninstall string in the Command Prompt window, make sure to use switches that will force the uninstall to run quietly without requiring remote user input. Use /quiet switch when executing the spuninst.exe: “C:\Windows\$NtUninstallKBXXXX$\spuninst\spuninst.exe” /quiet

Alternatively,

1. You can write a custom PowerShell script that will execute the uninstall script. For example, suppose that you have to uninstall a KBXXXXX update that has the following in the Uninstall Script:

   C:\Windows\$NtUninstallKBXXXX$\spuninst\spuninst.exe

2. Copy this string from the page. Now you can write the following single-line script and execute it with ExpertAssist:

   & env:windir\`$NtUninstallKBXXXX`$\spuninst\spuninst.exe

3. Executing this will automatically run the Software Update Removal wizard on the remote computer.

   Note: Use escape sequences to enable PowerShell correctly handle special symbols like dollar sign ($). Use the backwards apostrophe (`).

   Please refer to Scripts to find out more about PowerShell scripting functionality integrated into the ExpertAssist.

Manipulating installed applications from the page is even easier that doing so from the Control Panel applet. For example, simply hovering your mouse over the row with a particular application in the list will display support information for the application-something that would usually require you clicking the link.

Security

The pages items under Security object allow you access to ExpertAssist’s various enhanced security features.

Access Control

Here you can control who has access to ExpertAssist.

The upper portion of this page lists users already granted access to ExpertAssist (if any).

The Add button lets you specify a Windows user or group, and their permissions within the ExpertAssist.

The red Delete button next to each entry in the list will remove that user or group from the access list.

The following list details the options available for an entry in the permission list.

Table 6: Permission list options.

*
[R]     Read Access
[W]    Write (Update) Access
[D]     Delete (Remove) Access

You can select individual permissions, or specify Full Control.

You can also restrict the user to an IP address or a network by creating an IP Filter on the IP Filtering page under the Security object.

You can also restrict a certain user to an IP address or an IP address range. Please remember that access rights are cumulative: if Group X has full access to ExpertAssist and is not bound to an IP address and User Z is a member of that group, he will always have full access, even if you bind him to a specific IP address or network. To allow a user or group access from two or more IP addresses or networks, simply grant them the same permissions several times, but with different IP restrictions.

Access rights are cumulative. That is, if Group A has access to the Event Viewer, and Group B has access to the File Manager, a user who is a member of both groups will have access to both modules.

If the machine is a domain controller, the user accounts and groups that appear are listed from its domain. If the computer is not a domain controller, local users and groups are displayed. You can specify where to list accounts from by typing the name of the domain or the computer in the input field and clicking the List accounts button.

Access rights are stored under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\DesktopAuthority\V5\Permissions\ in binary form. This data is basically stored in a particular key with the name of the Security Identifiers (SIDs) of the groups or users. The particular key contains registry parameters that define the access mask associated with SID, and the specific IP Filter applied. Each created IP Filter and its IP address restrictions are stored under the HKEY_LOCAL_MACHINE\SOFTWARE\DesktopAuthority\V5\IPFilter\Profiles\. By default, any data under the HKEY_LOCAL_MACHINE\SOFTWARE\ key can only be changed by Administrators, PowerUsers, or the SYSTEM account.

There are a few options on the lower part of the Access Control page. Here you can enable or disable the following features:

Allow full control to administrators

This is enabled by default. It adds Full Control permission to all administrators of the computer. If you turn it off, only users explicitly granted permission to use ExpertAssist will have access.

NT LAN Manager authentication

Enable/Disable NTLM authentication. For those of you concerned about security, ExpertAssist supports the Windows Challenge/Response type authentication. You must use Internet Explorer to take advantage of this feature. You need not worry about exposing your password to eavesdroppers if you are using HTTPS to secure all communications between your browser and ExpertAssist.

Save user name in a cookie

Finally, you can configure ExpertAssist to remember your user name in a cookie.

Any Access Control permissions set locally on a workstation will be overwritten by the permissions specified in the Remote Control tab of the Desktop Authority Manager.

Configuration Permissions and Registry Permission

Special care needs to be taken with a few of the above options. Users with access to Security > Access Control page (Configuration permission) and Computer Management > Registry Editor page (Registry permission) can also access and change the ExpertAssist configuration data, including users’ permissions. However, the Registry permission can be considered safe, since the administrator can change permissions on the HKLM\Software\DesktopAuthority key and protect it from unwanted access. Users who can Create/Edit Scripts can also create programs in the Small language that run on the remote computer. These scripts will be run under the account of the person starting the script from the Scripting page – except when a Small program is called from the system monitoring script. In this case, the program is run under the LocalSystem account.

Reboot Permissions, Remote Control Permissions, Processes Permissions

With the exception of the objects and pages that the user is given access within the ExpertAssist by applying Reboot, Remote Control and Processes permissions to them, user’s Windows account permissions is used by ExpertAssist on the remote computer. For example, you can grant someone access to the File Manager page within the ExpertAssist, but they will only be able to access files and directories their Windows user account has permissions to on the remote computer. The same goes for the Registry Editor, User Manager, etc.

The above exception for objects and pages that can be accessed having the Reboot, Remote Control and Processes permissions applied within ExpertAssist is made to provide you maximum control over your system. The ExpertAssist uses the all-powerful LocalSystem account to perform the tasks via these objects and pages. For example, not even an Administrator has sufficient rights to terminate a service process - but with ExpertAssist performing this action under the LocalSystem account, any process can be terminated. Remote Control is another exception. When you are remotely controlling the system with ExpertAssist, you have access to the mouse and the keyboard of the system. If nobody is logged on interactively, you will need to use the Windows logon screen to gain access to the desktop, typing in a username or password, possibly different than the one you are accessing ExpertAssist with. If there is a user logged on to the host computer, you will be working under this user account.

IP Address Lockout

With ExpertAssist’s IP Address Lockout feature you can detect and temporarily lock out potential intruders.

This security precaution allows you to configure two specific types of filter. These are called the Denial of Service Filter and the Authentication Attack Filter. The first is a precaution against unwanted intruders who slow your remote machine to a halt by continuously requesting the same service. The second locks out those who persistently try to get past your log-in screen without authorization.

The configuration for each is identical, although the default values differ due to the differences in the kind of attack they are designed to prevent.

Active

By ticking this checkbox you will enable this feature. This can be useful if your server is exposed to the Internet. IP Lockout will prevent people from gaining access to the administrator username and password using brute-force methods, or from tying up your services through relentless requests.

Number of invalid attempts before locking out

Specify the number of login attempts before a lockout occurs.

Reset invalid attempt counter after

After the amount of time specified in this box elapses, the invalid attempt count of the offending IP address will be reset to zero.

Lock out for

If there were a number of bad login attempts from the same IP address, as specified in the second field, within the time period specified in the reset count field, all attempted connections from the offending IP address will be rejected for the amount of time given here.

Bad login attempts and lockouts are logged in the DesktopAuthority.log file if you have logging enabled. Bad login attempts are also logged into User Management Logs.