Remote Assistance

[ejmichaud]

Remote Assistance (more specifcally using "Offer Remote Assistance")
isn't logging enough information in the event log of the computer being
remote controled when remote connections are made. An example event
log entry is as follows:
---- Start of Event Log Entry ----
Event Type: Information
Event Source: Remote Assistance
Event Category: None
Event ID: 5261
Date: 3/3/2006
Time: 2:14:19 PM
User: N/A
Computer: ERICTESTING-001
Description:
User ERICTESTING-001\BuildAdmin has accepted a Solicited Remote
Assistance session from 179.23.129.241 (visible IP address:
179.23.129.241).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
---- End of Event Log Entry ----
The log records the IP Addresss of the computer solicitating the remote
assistance session but not the "Computer Name" or the "User" who is
making the connection. According to KB article 822407 the following
should be logged on a Windows XP SP2 (which is what the above machine
is):
· Remote Assistance connection
· From FQDN to FQDN
· Username
· IP list that is traversed in session
It obviously logs the IP but what about the "Username"? Is this a bug,
am I interpreting the KB artcicle incorrectly, or is there some other
way to increase the amount of logging?

 

[NJITGS]

If this is the case why not just disable even logging on either computer.
Wouldn't this bypass the request?

Remote Assistance (more specifcally using "Offer Remote Assistance")
isn't logging enough information in the event log of the computer being
remote controled when remote connections are made. An example event
log entry is as follows:
---- Start of Event Log Entry ----
Event Type: Information
Event Source: Remote Assistance
Event Category: None
Event ID: 5261
Date: 3/3/2006
Time: 2:14:19 PM
User: N/A
Computer: ERICTESTING-001
Description:
User ERICTESTING-001\BuildAdmin has accepted a Solicited Remote
Assistance session from 179.23.129.241 (visible IP address:
179.23.129.241).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
---- End of Event Log Entry ----
The log records the IP Addresss of the computer solicitating the remote
assistance session but not the "Computer Name" or the "User" who is
making the connection. According to KB article 822407 the following
should be logged on a Windows XP SP2 (which is what the above machine
is):
· Remote Assistance connection
· From FQDN to FQDN
· Username
· IP list that is traversed in session
It obviously logs the IP but what about the "Username"? Is this a bug,
am I interpreting the KB artcicle incorrectly, or is there some other
way to increase the amount of logging?

 

[NJITGS]

Correction-

the line should read:

event logging*