Remote Windows admin utilities

I'm working on a standard image for my company's Windows machines and I was hoping there were some Windows admins on here that could suggest some remote admin utilities.

I've found that the most important thing to do is to disable the stupid firewall so that the computer can be accessed. Fortunately, MS was nice enough to include a setting that allows me to set it up to turn off when it's on the same network with an Active Directory server and on when it's not. This works well for laptops, as if it's here, I don't really need to worry about network attacks, and if it's not, I don't really need to worry about remote admin. (Actually, I guess I might be more interested in it then, but I think the VNC server I've installed pokes a hole.)

Anyway, here's what I have so far:

freeSSHd
UltraVNC
psexec
wscript -regserver

I'm also considering WPKG. Anyone have any thoughts on that, or another remote package installer?

Any other suggestions? I don't really have much, if any, money to spend on commercial products. Also, I'm not a Windows admin by profession — I'm a Unix guy — so don't overlook something because it seems obvious you; it probably isn't obvious to me.

A couple of comments on what I have already:

freeSSHd: I like that it will accept NT authentication, but I wish it would do group authentication, as it'd be nice to set it up to allow the local admins group.

UltraVNC: At some point they changed the server so that every time you tweak a setting you get a RunAs dialog, and you have to select the correct user to run as, which is not the default. This is a gigantic pain, but no other VNC server that I'm aware of does NT authentication. Also, they broke their video hook driver at some point. I've actually been considering revving back to a version that worked better.

If anyone has solutions for either of those problems, I'd love to hear about them.

What remote admin functions are you wanting to do? Remote Desktop is built in, though it doesn't allow collaborative sessions (IE, the user is presented with a lock screen while remote desktop is connected), but works well normally. You can also use the Microsoft Management Console to connect to a remote computer to see the event log, and other functions. The MMC on your local computer is what is run when you right click My Computer and choose Manage. One of the menus has an option to connect to a remote system. Functions not in that default console view can be opened by running the appropriate .msc plugin.

There was an article not long ago about some small s/w company in New York, about their simple salary plan. Everyone with the same level/experience there earns exactly the same salary. That kind of article.

Anyway, this same company has a web-based product for remote desktop access/collaboration which works through any firewall/NAT stuff on both ends.

It's just a pay-per-use (like, $3 or something) java applet that uses their server as a middleman. No installation required on either end of the shared desktop.

If your google-fu is good enough, you can probably find them.

Cheers

I meant to mention that I knew about MMC's snap-ins' abilities to attach to remote computers. They almost never seem to have a feature to let me do what I want, though.

Remote Desktop is not very useful for much of anything as far as a client computer is concerned, as far as I can figure. If a person is in a situation where they need my help, chances are that it's going to be hard to get them to do the remote collaboration thing properly.

Things I want to do.... I don't know; everything? I hate the fact that MS (at least used to) promote how easy Windows machines are to administer, yet you have to go way out of your way to do anything remotely. Yet with Unix, which is supposed to be so difficult, I can do virtually anything remotely. As such, that questions is so absurd to me that I don't know how to answer it. I don't know what I'll want to be able to do until it hits me.

That's why things like psexec and WPKG are nice. They ought to allow me to do remote installations of other utilities that I might need in order to do one of these unforeseen administrative functions.

I've got that covered via VNC, my control over the entire network at the office, and an enterprise WebEx account. I guess I'm, at this point, more interested in behind-the-scenes admin stuff. Software demployments, upgrades, and things I won't think about until I get there.

Ahh... Fog Creek Software's copilot is what I was thinking of. Probably VNC based under the hood, but nifty nonetheless.

Cheers

At my request we have a Copilot subscription at work. By and large it's great and it saves me a lot of time while supporting users in any number of different companies. My biggest complain is its speed these days; a year ago it was pretty responsive, nowadays I often have users telling me what's on their screen 10 seconds before I get to see it. One other complaint I have about it is that Vista's UAC is on the remote display only so I need the user present to click through it.

I have recently been looking at Log Me In Free (www.logmein.com). That does all that CoPilot does and is free. The big benefit is you don't need any user help to use it once it's installed.

I've tried a thing called Yoics that's kind of an IMish remote access goodie.

Copilot is very handy indeed. However it isn't java based, you download and run an executable from their website (with the session authentication baked into the exe).

Edit:

As Mark guessed elsewhere, copilot is based on the VNC codebase.

we use Dameware NT Utilities at work. Absolutely brilliant product. It's relatively inexpensive ($285) and does way more than you can do with just a remote session. You can kill processes remotely, reboot, view installed software, start and stop services, ad nauseum. Oh, and if you forget to install the client on a machine, you don't need to, it will install itself remotely (provided you have admin access to the machine.)

The only caveat is it's primarily for use on machines on the network. For machines off the network I use Teamviewer (free for personal use) or tightVNC.

Nice thing about Teamviewer is that it requires no installation or holes in a firewall. You can talk someone through downloading it and running it. They give you their account # (auto assigned) and session password (also auto assigned) and you're in.

pskill, shutdown, regedit, sc.

Other than pskill, those are all builtins. And, admittedly, the UI to look at installed software using a remote registry is not that great, but I'm not really interested in that in general, and it's certainly not worth $300.

I may check it out, though.

I've used the free Adobe Acrobat ConnectNow product in the past, and it's worked pretty good. It's also cross platform.

Checked out logmein.com yet?

Oh, I should have mentioned the ought-to-be-built-in RemoteUnlock. God forbid an administrator want to bypass a user's screenlock without logging him out.

Let me change part of my prerequisites. Assume I have no money. This is probably more accurate. If something is cheap and not a subscription, and makes my life a lot easier, I might pay for it out of my own pocket. But I basically am not going to be able to get the company to pay for anything.

Oh, and PowerShell, which I can start from the SSH connection, actually allows you to cd to a remote fileshare, unlike cmd.exe. So that's useful.

pushd

There's a free version of Logmein that I mentioned further up this thread LogMeIn Free.

Edit: Okay, it's for home and personal use. As you were.

You mention psexec. I take it you've seen the "PsTools" package which includes a whole bunch of command line utils beginning with ps. Originally written by a company called SysInternals, later taken over by MS.

http://technet.microsoft.com/en-us/sysinternals/bb896649.aspx

AND

http://technet.microsoft.com/en-us/sysinternals/0e18b180-9b7a-4c49-8120-c47c5a693683.aspx

Yes.

Well, that's good to know.

Well, I've pretty much settled on what I need for remote Windows admin now, and it's really pretty basic:

psexec
UltraVNC

I decided to get rid of freeSSHd. It bothers the user frequently. It's always trying to contact the freeSSHd site and generating a popup (not just a balloon notice) when it can't. I wanted it to be virtually invisible to the user, and it's just not.

However, it turns out that psexec handles anything I really need to do along those lines, including running an interactive cmd.exe shell. I haven't tried running PowerShell via psexec, but with cmd.exe's pushd to easily get to UNC shares, I don't really need to. Also, drive letters mapped with pushd don't show up for the console user, and seem to get automatically unmapped when I exit the shell, so it's really no more difficult than using PowerShell's native UNC support.

I still have PowerShell installed, though. No reason to get rid of it. And I still have "wscript -regserver" enabled, though I haven't used it since I got psexec running.

I never got around to installing WPKG. It needs silent installers anyway, and I can batch those using psexec and its "@" syntax pretty easily. Its only advantage is that systems need not be online right when I want to do the upgrade.

My first real test of this was when I uninstalled freeSSHd from the computers I had installed it on. Once I figured out how to do a silent uninstall, it went swimmingly.

My only remaining problem is with VNC. For some reason, some of my users prefer the RealVNC client. I don't know why, but they're welcome to install pretty much what they want, but they end up installing the server part of the other VNC distributions and it always ends up treading on my UltraVNC server. I'm thinking of just preinstalling other VNC clients so that they won't won't install their own "incorrectly".

Must say I prefer the RealVNC client, don't know why.

We used UltraVNC in my last shop and found it to be the most Windows-capable of VNC packages. Used it over SSH


We've used WPKG since 2004 and it is huge bang for (zero) buck. Relatively easy to maintain XML configs. Lots of on-line examples for silent installers. We even use it to config laptops now. For true lights-out operation we needed to add a dummy wpkg user on each machine, but that was worth it and better than some of the alternatives. All hail WPKG.

(The hard part is dealing with some brain-dead Windows installers but again there are hundreds of pre-supplied examples on the wpkg.org site.)

We looked at Dameware back in 2004 but they were going through a bad patch with some exploits and there were exploits *using* the dameware engine. Seems like that has settled down.

I thought I'd mentioned WinExe here, but apparently not. Basically, it's psexec, except it (the client) runs on Unix. Seems to work just as well. Just thought I'd come back and list it for completeness' sake.