I’m using 5.5.16 at the moment because until a few hours I didn’t know there was a 6.3. Anyways. I’ve just created a new Technician Group and unchecked every Permission I could find except the “Allow Remote Access” option. In this new and severely restricted group i’ve put a new technician. In the technician account I added one machine. The idea is that this new technician can see and do only one thing: remotely access that one machine. So far so good, but in the menu of the new technicians’ console I see this very annoying button: “Add a preconfigured machine”.
Via that button the technician can suddenly add new Remote Access Apps.
I don’t like that. The new technician seems to be able to create apps and links and that’s absolutely not a good idea. I’ve been searching all over the place to find a checkbox that I can uncheck but alas.
Anybody out here that has tried the same and has the same issue? Did you find a solution and if yes, can you share it with us please?
Access to this button doesn’t give Technicians additional capabilities. A “Remote Access App” is essentially just a saved profile of a Remote Access download URL, and the button just provides a handy UI to do it instead of having to edit an Access app’s download URL. It is how you get to Mass Deploy, but presumably that’s disabled for these techs?
All URL pre-configuration does is set some of the values and settings a Remote Access service will launch with to save you having to set names and groups etc after the services have installed and registered as part of a deployment, and these are available to anyone: SimpleHelp - Remote Access Installer Preconfiguration . Anyone with admin privileges over a machine is able to configure these same settings post-installation ( SimpleHelp - Remote Access Guide ), and since installation requires admin privileges anyway, restricting it would be a bit silly.
If you don’t like the idea of pre-configuration:
- Don’t advertise it (it’s not discoverable without looking at SimpleHelp documentation).
- Enable Review New Service Installations in Administration; Remote Access Machines.
- Restrict network availability of your server to intended target networks.
Hi Chris.
Thanks for your information.
This extremely restricted technician will be an external party, that needs to access a certain pc a few times a year, to work in a certain application. He won’t be a local admin, he’ll just be able to take over that pc, do what he needs to do, and leave. I suppose the ”Remote Control” feature would even be better but that needs a license and we have some stingy managers over here.
To be honest, I already thought there wasn’t a way to deactivate it, but thanks to confirm it.
best regards,
Paul
