1

We have an employee that works from home on a company supplied desktop that is not on the company domain. He has full administrator right on this computer which allows him to install any software he wants and is prone to viruses. This computer has access via a VPN and connects via remote desktop to a desktop computer in the office. From the desktop he has access to our AMS software, the domain network, exchange etc… I am replacing this computer next week with a desktop that is on the domain with mapped network drives, all company applications and will connect directly to the domain via a VPN. Basically it will just be another desktop on the company domain. My question is: since I am not planning on giving administrator rights to this user how will I access this remote computer for installs and basic administrator tasks. I am assuming that I will be able to access via remote desktop because the computer is connected via VPN and is on the domain. The VPN is a Cisco AnyConnect client through a local broadband connection (comcast) and is not a point to point VPN connection. Does anyone have any experience and advise that I can use?

1 Spice up
2

Have you thought of something like LogMeIn?

They are at www.logmein.com …

3

If the user does not have administrator rights, and I connect via logmein, won’t I have the same rights as the user or will I be able to use logmein as an administrator? I would prefer not to have to use a third party application if this can be accomplish using a standard windows process.

4

You should be able to do a “run as” for software installs etc… Depending on what else your trying to do, it may require they have admin rights.

5

With LogMeIn you can log the user out and log in as an administrator.

6

I had to do this today, i used team viewer to connect to the remote machine and then right clicked the install file, run as and picked a admin account.

7

I just started using team viewer a few weeks ago, gtreat product. So you can do installs of software will it also work for normal admin task?

8

I like setting up a point to point VPN that is always open. Then you can use RDP to manage the computer and do whatever you need to do whenever you want to do it. We generally set up a profile on the host with administrative permissions to prevent any problems.

BTW, I love the fact that you’re locking down the user’s access. Let them have a personal computer for home use.

As for the point to point VPN, I’d lock it down to allow traffic from only the company computer. With the hardware based VPN you could use Spiceworks to manage the PC.

9

BossGeek, I am not using a point to point VPN. I have a Cisco ASA5510 and using the Cisco AnyConnect VPN client through the user’s local broadband connection. I did consider a point to point VPN client but did not want to purchase additional hardware to be placed in a user’s home, I may reconsider. Would RDP still work through the Cisco AnyConnect Client?

10

RDP will work through the VPN but depending on your network configuration ensuring the system is either upto date in DNS or having a static IP is very important. You should be able to do everything you need to with either logging the user out or the run as option. I agree the user should not have admin rights to the system.

11

Moved to Telecommuting forum

12

I just set up the deskstop on and external boadband account, log onto the desktop as a system administrator and tried to connect using RDP from our internal network as the same sytem administrator account that I used on the desktop. It worked perfectly. When I logged on as the remote user and tried to RDP with the system administrator account it began to work and then I lost connectivity when the remote user was forced to be logged off. When the remote user was forced off the sytem, his VPN connection was also forced closed. It looks like the only way this will work is with a point to point always connected VPN appliance.

Thanks eveyione for your advise and assistanace. I am the only IT person here and it nice to have someone to help with the process.

13

If user has a cheapo linksys or dlink router at home you can setup the always on point to point vpn with yourCisco ASA5510 at work, that way it is not dependent on the user being logged into his machine.

14

I just found the perfevct solution that I thought I should share. If you have a Cisco ASA firewall, and you have Cisco anyconnect software you can use the SBL (Start Before Login) feature that forces all users to log onto the VPN client before the windows logon screen appears. This logs into the VPN client and will remain logged into the VPN client until the desktop is shut down. RDP works perfectly just like they are on the local domain network. Cisco calls this feature either SBL or VPNgina.

The Cisco anyConnect software iwas created to allow 64 bit clients and is free if you have a valid service aggreement. It only has 2 licenses and you will have to purchase more if there is going to be more than 2 users.