Remote Support - Getting Started

What is Remote Support?

BeyondTrust Remote Support is a secure remote support tool for IT teams. Your representatives use it to connect to and control remote computers and devices so they can fix problems. Service desks, help desks, and support teams use it every day.

Remote Support covers three kinds of work:

• Attended support. A customer starts a session and asks for help. The customer enters a session key on your support portal, selects a representative from a list, or clicks a Support Button on the desktop. Your representative then joins the session.
• Unattended access. Your representative connects to a computer when no one is sitting in front of it. Jump Clients and Gateways make this possible, so you can fix servers and offline machines after hours.
• Security and audit control. You decide what each representative can do in a session. Remote Support records sessions, injects passwords without showing them, and keeps a full log of who did what.

Remote Support capabilities and benefits

Use Remote Support to run and resolve sessions:

• Support many platforms from one tool, including Windows, macOS, Linux, iOS, and Android.
• Take control of a remote screen, or share your own screen with the customer.
• Chat with customers, transfer files in both directions, and push a web link to the customer's screen.
• Reach a computer even when no user is signed in, so you can patch and repair systems outside of business hours.
• Bring more than one representative into the same session when a problem needs a second opinion.

Use Remote Support to route, control, and audit access:

• Route each request to the right person. Skills-based routing, called Equilibrium, sends a session to the least busy or best-skilled representative on the team.
• Inject stored credentials into a remote system so a representative never sees or types the password.
• Record sessions and pull reports for audits and compliance reviews.
• Connect Remote Support to your service desk tools, such as ServiceNow, Salesforce, and Jira, so tickets and sessions stay in sync.
• Add your own logo, colors, and wording to the customer-facing portal.

Together, these features raise your first-call resolution rate, cut downtime, and limit how much access a representative needs to solve a problem.

Prerequisites

Before you start using Remote Support, make a few decisions. The right choices depend on the size of your organization and your security rules. This is not a full checklist, but it gives you a solid starting point for planning.

• Choose your deployment model, cloud or on-premises. Your choice usually depends on your infrastructure, your security policies, and how much you want to manage yourself.
• Choose a web address for your site. Customers and representatives both use this Domain Name System (DNS) name, so keep it short and easy to say, such as support.example.com. Point a DNS A record or a canonical name (CNAME) record at your site.
• Open the ports your deployment needs. Every client makes an outbound connection to the site, so TCP 443 is required in all deployments. On-premises deployments also need ports for Session Traversal Utilities for NAT (STUN) and Traversal Using Relays around NAT (TURN): UDP and TCP 3478 and 5349, plus UDP 49152–65535. They might also need ports for NTP, LDAP, syslog, DNS, and email.

• Get a TLS or SSL certificate. Your site needs a valid certificate before BeyondTrust can build your custom software package. A certificate from a trusted certificate authority is the best choice. A self-signed certificate works for short-term testing only. Import the full certificate chain.

• Decide how users sign in. Remote Support can check users against LDAP (including Active Directory), SAML, Kerberos, or OpenID Connect. You can also require two-factor authentication.

• Check your license count. Remote Support is licensed by concurrent users. You can create as many accounts as you want, but only the number of representatives you licensed can be signed in to the representative console at the same time.

• Confirm your systems are supported. Review Remote Support supported platforms for the operating systems and browsers each component supports.

Deployment methods

Deploy Remote Support in the cloud, or on-premises on a B Series Appliance. Very large environments can also use Atlas clustering to spread the load across several appliances.

Remote Support Cloud

With Remote Support Cloud, BeyondTrust hosts your site on a single-tenant instance and manages the servers, the database, and the updates. You choose the region that stores your data. Your site gets an address such as yoursite.beyondtrustcloud.com, and you can add a CNAME record to use your own web address with your own SSL certificate.

Cloud deployments keep your firewall work small. Your network needs only outbound TCP 443 to reach the site. BeyondTrust applies critical updates for you and backs up your data on a schedule.

On-premises (B Series Appliance)

The B Series Appliance is a self-contained appliance that hosts Remote Support in your own data center. It is the central routing point for every connection, and it encrypts all session traffic end to end. You can run it as physical hardware or as a Virtual Appliance on VMware, Hyper-V, Nutanix AHV, AWS, or Azure.

BeyondTrust recommends placing the appliance in your perimeter network. You own the appliance updates, the backups, and the network setup.

The following table compares the two deployment methods.

Remote Support essentials

When you set up Remote Support, learn a few terms first. The following table defines the building blocks you create during setup, which control who can connect, to what, and with which tools.

Connection types

In Remote Support, an endpoint is any remote computer or device you support. Endpoints include Windows, macOS, and Linux computers, iOS and Android devices, and network equipment you reach over SSH or Telnet, such as switches and appliances.

Know the difference between how a session starts and how you reach the endpoint, because that difference determines what you install first. The following table describes the four connection types.

Remote Support and Privileged Remote Access

Remote Support and BeyondTrust Privileged Remote Access are closely related, so it can be unclear which one a feature belongs to. Both run on the same B Series Appliance, and together they are called Secure Remote Access. The difference is the audience:

• Remote Support serves your service desk. Representatives help employees and customers fix problems on their devices, usually one session at a time.
• Privileged Remote Access serves vendors and internal staff who need ongoing, controlled access to critical systems.

Administrative interfaces and the public portal

Remote Support uses separate interfaces on purpose. This keeps hardware administration apart from user administration, and both apart from what your customers see. The following table describes the differences and when to use each one.

Initial setup

Before your team starts taking sessions, complete the initial setup. This adds your users, your policies, your teams, and your endpoints so access is controlled from the start.

1. Deploy your site

For Remote Support Cloud, BeyondTrust provisions your site. To deploy an on-premises site:

1. Install the appliance and place it in your perimeter network.
2. Point a DNS record at the site.
3. Open the required ports.
4. Import your SSL certificate.

2. Sign in to /appliance

1. Go to your site address followed by /appliance.
2. Sign in with the default credentials.
3. Change the default credentials.
4. On-premises sites only: turn on automatic critical updates so security fixes install during your maintenance window.

3. Sign in to /login

1. Go to your site address followed by /login.
2. Accept the license agreement.
3. Change the default credentials.
4. Select your language.
5. Go to Status > Information and confirm your support license count.

4. Add a security provider and group policies

Set up the security provider first, because it determines how your representatives sign in. Create your group policies at the same time. Any user who authenticates against an external identity provider must belong to at least one group policy, so account setup is blocked without one.

To add a security provider:

1. From /login, go to Users & Security > Security Providers.
2. Click Add.
3. Select your provider type, such as LDAP, SAML, Kerberos, or OpenID Connect.
4. Enter your server details.
5. If you use LDAPS or TLS, upload the root SSL certificate in PEM format.
6. Click Save.

To create group policies:

1. Go to Users & Security > Group Policies.
2. Create a policy for each type of user, such as help desk representative, team lead, and administrator.
3. Grant only the permissions each group needs.
4. Set the default group policy to the lowest privileges.
5. Click Save.

You can also require two-factor authentication in a group policy. See Two-factor authentication guide.

5. Create session policies

A session policy controls which tools a representative can use in a session.

1. Go to Users & Security > Session Policies.
2. Create one policy per level of access, such as view-only and full control.
3. Set each permission to Allow, Deny, or Not Defined.
4. Click Save.

Remote Support evaluates session policies one tool at a time, and the most specific policy takes precedence. The order of priority is:

1. Asset or Jump Client policy
2. Support portal policy
3. User policy
4. Global default

6. Create support teams, skills, and issues

Teams give you queues, and skills and issues route each request to the right queue.

1. Go to Configuration > Support Teams and create your teams.
2. Add members, and assign each member a role of Team Member, Team Lead, or Team Manager.
3. Go to Configuration > Skills and add the skills your team supports.
4. Assign those skills to your representatives.
5. Rank each skill as More Preferred, Less Preferred, or Ignored.
6. Go to Configuration > Issues and create the problem categories customers see.
7. Link each issue to a team and a skill.
8. Turn on Equilibrium routing for the team so waiting sessions are handed out automatically.

7. Configure the public portal

The public portal is where your customers start a session, so set it up before your team goes into production.

1. Go to Public Portals.
2. Configure your site address.
3. Configure the HTML template and branding.
4. Select the default Support Button profile.
5. Add any customer notices.
6. To require customers to sign in first, turn on Require SAML Authentication.
7. Click Save.

8. Install the representative console

1. Go to Consoles & Downloads.
2. Download the desktop representative console, or send your team to /console for the web console.
3. For mobile representatives, install the Android or iOS app.
4. Have each representative sign in and run a test session against the public portal.

9. Set up unattended access

After your policies exist, deploy unattended access. Complete these steps in order:

1. Add Asset Roles, so you control who can manage and use endpoints.
2. Add Asset Policies, so you control when endpoints can be accessed.
3. Add Asset Groups, so you can organize endpoints and limit who reaches them.
4. Go to Asset Management > Jump Clients and deploy Jump Clients with the Mass Deployment Wizard, or install a Gateway on a machine inside each remote network.
5. Choose the asset group and asset policy while you build the installer.
6. Create your assets in the representative console, or import them from /login.

10. Configure Vault

Vault stores credentials so your representatives can sign in to remote systems without seeing the password.

1. Set the Vault role in each group policy to Inject, or to Inject and Checkout if the user also needs to check credentials out from /login.
2. Click Save.
3. Run discovery to find accounts.
4. Add your accounts and account groups.
5. Apply account policies.

11. Connect your integrations and audit tools

Finally, connect Remote Support to the rest of your environment.

1. Connect your service desk tool so sessions and tickets stay linked.
2. Point syslog at your logging platform.
3. Use the Integration Client if you need to move session logs and recordings to SQL Server or a file share.