I'm pretty sure if all the workstations are a member of a domain, and you have full domain admin rights, you can just run this from your run screen, and the user won't have any clue you’re watching them. That's the main reason I disable it on every single one of my personal computers, and just enable remote desktop.

hcp://CN=Microsoft%20Corporation,L=Redmond,S=Washington,C=US/Remote%20Assistance/Escalation/unsolicited/unsolicitedrcui.htm