I am trying to figure out how to allow a group of users to offer unsolicited remote assistance using msra /offerra
to their fellow domain members.
I have created a policy enabling "Offer Remote Assistance" and filling the DOMAIN\RAHelpers
user group into the "Helpers" list. I can see the DOMAIN\RAHelpers
group turning up as a member in the local "Offer Remote Assistance Helpers" group of the targeted domain computers after the policy is applied. Yet, I am unable to set up a remote assistance connection with one of these users unless they are also a member of the local Administrators group of the to-be-assisted machine. The error message is rather unspecific ("Your offer to help could not be sent"), but I suspect a DCOM permission issue since RA seems to use DCOM and local administrators can connect for help just fine.
What minimal permission set would I need to allow for unsolicited remote assistance? I obviously do not want to promote all helpers to local administrators.