Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Configure Solicited Remote Assistance

This computer-scoped Group Policy setting controls Solicited Windows Remote Assistance.

since 0.9.8.11

Purpose

Show registry keys (5)
  • HKLM\Software\policies\Microsoft\Windows NT\Terminal Services\fAllowToGetHelp
  • HKLM\Software\policies\Microsoft\Windows NT\Terminal Services\fAllowFullControl
  • HKLM\Software\policies\Microsoft\Windows NT\Terminal Services\MaxTicketExpiry
  • HKLM\Software\policies\Microsoft\Windows NT\Terminal Services\MaxTicketExpiryUnits
  • HKLM\Software\policies\Microsoft\Windows NT\Terminal Services\fUseMailto

This computer-scoped Group Policy setting controls Solicited Windows Remote Assistance. When fAllowToGetHelp=1, users can invite another person to help them. Windows supports invitations sent by email or file transfer and connections initiated through compatible instant messaging programs. Setting fAllowToGetHelp=0 prevents users from requesting assistance through these methods.

These settings are REG_DWORD values. When the policy is enabled, the additional values determine the permitted session mode and invitation properties:

  • fAllowFullControl=1 permits a helper to request remote control. When fAllowFullControl=0, the helper can only view the computer.
  • MaxTicketExpiry specifies how long an invitation created through email or file transfer remains valid.
  • MaxTicketExpiryUnits selects the corresponding unit: 0 means minutes, 1 means hours, and 2 means days.
  • fUseMailto=1 selects the Mailto standard, in which the recipient accesses the invitation through an Internet link. fUseMailto=0 selects Simple MAPI (SMAPI), which attaches the invitation to the email message.

If the policy is not configured, users can control Solicited Remote Assistance and its options through Windows System Properties.

Notes

Additional effects

The policy applies only to sessions initiated by a user's request or invitation. It does not enable Offer (Unsolicited) Remote Assistance or authorize a designated support group to connect without an invitation.

The maximum ticket time limits how long an invitation can be used to establish a connection. It is not a maximum session duration and does not terminate an established session when the invitation expires.

Security

A valid invitation provides another person with an intended path to the user's interactive session. A longer validity period therefore increases the time during which a forwarded or intercepted invitation might be used. Invitation data and its associated access information should be disclosed only to a trusted recipient.

With fAllowFullControl=1, a connected helper can provide input within the session and may operate applications or access data available to the signed-in user. However, fAllowFullControl does not grant a Windows user right, an administrator account, or unrestricted file access. Administrative actions remain subject to Windows permissions and User Account Control.

With fAllowFullControl=0, the helper can view the shared desktop through Remote Assistance but cannot control it. View-only access can still expose confidential information displayed on the screen during the session.

Possible side effects

Remote Assistance connections can fail when the required Windows Firewall rules are not available, even if this policy is enabled.

The selected email method must be supported by the email application in use. An incompatible selection can prevent invitations from being created or processed correctly. The email-method option is unavailable on Windows Vista, where SMAPI is the only supported method.

Disabling this policy prevents users from creating invitations for classic Solicited Windows Remote Assistance through email, file transfer, or compatible instant messaging programs. It does not configure other remote-support products such as Quick Assist, Remote Desktop, or Microsoft Intune Remote Help.

Notes

fAllowToGetHelp is the policy's primary value. The other listed values represent policy options and have their intended effect only in conjunction with enabled Solicited Remote Assistance.

The underlying Group Policy setting and classic Windows Remote Assistance also existed in earlier Windows releases.

Microsoft documentation

Microsoft Learn: RemoteAssistance Policy CSP — SolicitedRemoteAssistance

Microsoft Learn: Microsoft-Windows-RemoteAssistance-Exe

Microsoft Learn: fAllowFullControl

Microsoft Learn: MaxTicketExpiry

Microsoft Learn: MaxTicketExpiryUnits

See also