We are about to release a new version of our current remote control product, and our new Enterprise Edition remote control.

To make distributing the remote control agent easy, we have created two online tools.

One will build a custom MSI package, and the other will create a custom EXE package:

The MSI package is made to be group policy friendly, and both package types can be run silently by using command line arguments.

Here are the links to both builders:

MSI Agent Builder

EXE Agent Builder

If you get a chance, please try them out and let us know if you find any issues.

Also, please note that when you create an Enterprise edition agent, after the install it takes about 2 to 3 minutes (Random interval) to activate and register with the server. This is to prevent a sudden surge on your Enterprise server if you deploy it to a large number of machines.

In addition we have finalized our pricing structure for the Enterprise Edition:

That is why our pre-order offer of $599 is a heck of a deal. Once we release after June 1st, the above pricing will be in effect.

Get your unlimited agent and viewer edition for only $599 by clicking the purchase link below.

Click here to pre-order today

Click here to Find out more about the Enterprise Edition Beta

So as you can see we are right on track for June 1st. Still have a few loose ends in the documentation, and we will publish it for all to see. Check out the beta if you get the chance.

Lately many of you have been emailing us about getting our Remote Control product to work with Windows 7.

If you install the agent manually, or via an MSI group policy – not much to do, it should work right out of the box. Many of you like that automatic install feature, and Microsoft has put some roadblocks in your way to keep this from working.

Let me walk you through what you need to do to get this to work.

The first thing we need to allow access to is the admin share. This special share is automatically created when Windows is installed, but it is not available unless file and printer sharing is turned on.

This is disabled by default in Windows 7, and unfortunately Microsoft has yet again changed the method to turn it back on. The steps you need to take are now different than the ones you took in Vista.

How do you allow access to the admin share in Windows 7?

Start by going into the control panel.

Click on “Network and Internet”

Then click on “Network and Sharing Center”

A new window will be displayed. Look on the left side.

See the item that says “Change Advanced Sharing Settings” – Click on it.

Now you are shown different profiles.

The list can change depending on how your system is configured. Windows 7 will determine automatically what profile your network card is using. You may want to enable file and printer sharing on all of them, or limit it to the “Home or Work” profile for higher security.

Expand the profile you want to modify, and scroll down until you see “File and Printer Sharing”

Click on “Turn on file and printer sharing”

Save your changes.

Now, we need to make sure the remote registry service is set to automatic and is started. Again, like the admin share, this is on the computer you want to control.

You need to open the service manager. You can do this by clicking on the start button, and typing “services.msc”. It should show up in the top of your start menu.

Click on it, and a window will open. Scroll down until you find the service named “Remote Registry”:

Right click on it, and go to properties. Change the service to automatic, and start it up:

I wish I could say that is all you need to do, but unfortunately you also need to make a registry change.

Open regedit, and drill down to this key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System

Under this key you will need to create a new DWORD value called:

LocalAccountTokenFilterPolicy

Set it to 1, and reboot.

Now the automatic install feature will work under Windows 7.

Since the 3.1 release of our Remote Control Product it has supported group policy. Supporting is nice, but if there is no way to get to these settings, then it does not exist for the customer.

Recently we have been getting requests for a finer level of control over who, and how people can remote into a machine – and a way to lock it down. The group policy method is a great way to do this. You can pick specific users, or groups and grant those groups specific rights, and lock them so they cannot be changed.

Lets say I want my entire IT staff to be able to remote into machines, but the accounting departments says no way – not unless the IT staff is forced to ask permission first. With our group policy administrative template you can do this. Since it uses group policy, even local administrators cannot override the settings.

Now – how do you do it?

First, download our custom administrative template:

http://www.intelliadmin.com/IntelliAdmin5.adm

Save this to the desktop of your domain controller.

Our next step is to add it to the domain controller’s administrative templates in the group policy object editor. That way you can apply it to any group of machines you want. In our demonstration we will only update the default domain policy – which updates all machines within a domain.

Windows 2008 Group Policy

Windows Server 2008, and 2003 have slightly different ways of editing group policy. If you are using 2008 then this is what you need to do to get it open:

Click on the start menu. Then click on Administrative tools, and then click on the item that says “Group Policy Management”:

Then drill down to Domains -> [Your Domain] -> Group Policy Objects

Right click on Default Domain Policy, and click on edit

Then the group policy editor will be displayed

Windows 2003 Group Policy

If you are running 2003, then the process is slightly more complicated. On the domain controller, open Active Directory Users and Computers.

Right click on your domain:

Click on properties. Then a dialog will show up. Go to the tab titled “Group Policy”

Click Edit, and the group policy management editor is displayed.

Adding the IntelliAdmin.adm template

From here, both servers are the same. Expand to Computer Configuration->Policies:

Right click on “Administrative Templates” and pick “Add/Remove Templates…”

Now, you are shown a list of custom templates that have been installed (In the case of my screen shot, none have been installed)

Click Add, and add the IntelliAdmin.adm that you downloaded to the desktop.

After you close out, a new folder will appear “IntelliAdmin Remote Control” (Under 2008 this will appear under Classic Administrative Templates)

Changing and locking down agent settings

Click on it, and you will see these options on the right:

First, lets look at the agent settings. Do this by double clicking on “Agent Settings”:

Set it to enabled, and then make the changes you want to lock into the agent. Most of them are self explanatory, but two items have a special format – Filtered IP addresses, and Listen IP addresses. Lets look at filtered IP addresses first:

The current value you see in the screen shot is:

*:1;

This means all IP addresses are allowed. * is a wild card. The 1 means that it is allowed. Each filter entry is separated by a ; and the list must end with a ;

If we wanted to only allow computers in the 192.168.1.X range to connect, we could have something like this:

192.168.1.*:1;

Or if we wanted to allow all computers to connect, but prevent 10.10.10.6 from connecting:

10.10.10.6:0;*:1;

Note that these are processed in order. When the agent finds a match, it will discontinue processing. So if you had done the reverse:

*:1;10.10.10.6:0;

It would never get a chance to prevent 10.10.10.6 from connecting

The other value is “Listen IP Addresses”. The format for this value is :[PORT];

If you wanted the agent to listen on ports 2792, and 5900 it would look like this:

:2792;:5900;

Or simply, if you wanted to change the default port to 3300

:3300;

Adding Users
Now that you have changed the default agent settings, how do you add users? The IntelliAdmin.adm template allows you to configure up to 5 windows users. To add a user, simply double click the user entry and enable it. Always start with User 1, then User 2. If you skip a user (Like enable User 5 when there is no user 4), then the agent will not properly read it from the registry – so make sure they are enabled in order.

In our example, I will go into the properties of user 1 and enable:

If you notice, the default user name is “BA”. What the heck is BA? Well, BA is an internal identifier that windows uses for the Built-in administrators group. This needs to be used instead of “Administrators” since it is possible that a foreign language version of windows will have a different word for “Administrators”. This is what you want to change. You can type in a security group, or a single user name. Then turn on features you want to lock in. In my case I changed the “Always Request Access” to 1, and the group to “IT Support”. Since I only enabled User1, this means that only members of the “IT Support” group can remote into machines, and the agent will ask the end user permission before they can connect. No matter what those IT people do (Short of getting on the DC and removing this policy) they will always have to ask permission.

Now, if we load up the agent settings on a machine that is under the applied policy we see our settings, and notice that all of the buttons are grey – no changes can be made:

This stuff can seem complicated at first, and I wish there were an easy wizard we could create to do this for you – but it when it comes to domain policy our options are limited. If you need help, feel free to email us at support@intelliadmin.com

The latest version of our Remote Control, can be downloaded from here:

http://www.intelliadmin.com/setupex.exe