Re: Change desktop when remote connection is established

One issue I have run into with such things, although not this thing 
particularly - what happens if the user changes the config to deny.

So, if you do this, don't give the user permission to change that 
setting from Allow, and, if possible, remove / hide that setting from 
anything the user can normally see.

Even if that can't be done, script Allow settings within the global 
login script.

Alternately, part of the connect process could be to remotely access 
that setting, setting it to Allow - if such setting is read on the fly. 
We used to use rcmd for such. Alternately, schedule a batch script to do 
so every hour or something.

For that matter, script a vnc invite and avoid all of it.

I used to run into problems where backups would fail because some user 
held file(s) open. vnc was of great help in those cases.

In the end, though, this is not a technical problem it is a user / 
training / communications problem. Don't want to get into an ethical 
debate or discussion here, but I.T. -HAS- to be able to get anywhere, 
anytime it feels it needs to, as the guardians of an enterprise's 
privacy, confidentiality, and security. Easy example, a workstation 
broadcasting/flooding a network or distributing a virus.

Along with that, the rigorous confidence in and absolute adherence to 
the absolute and unquestioned maintenance of confidentiality by I.T., 
just like H.R., must, like justice, not only be seen to be fact, but 
must appear to be fact. All else is policy communication and acceptance 
execution, not technical execution.

Including users must understand that I.T. has more than too much on its 
plate, and has no interest in remote controlling anything without good 
reason. There are only so many hours in a day.

Having said all this, bear in mind the easy user workaround - password 
protected screen savers. No way around that without an admin password 
override. You can log out the user and log in as admin, but the act of 
doing so probably closes what you were trying to help with in the first 
place.

If the culture says the users machine is the users machine, and data to 
be backed up is rigorously saved to a server, then I.T. has no business 
enabling carte blanche access. (And I.T. is in a sorry state.) Ce la vie.

In the end, the correct answer is that this is not a technical issue, 
but a policy issue for the OP to go back to upper management on for 
ironing out. Including fostering the understanding that I.T. doesn't 
have time for, and better things to do with its time than, snooping. 
(And that ONLY I.T. can do this. e.g. Non-I.T. managers can't.)

Arguably, even the icon changing colour is too much (but good practice 
to train the users on watching for) - what if the user is suspected of 
fraud ... indicators of screen sharing would be a bad thing. And how do 
you know when, or what, beforehand. You can't, and for system 
integrity's sake, I.T. must be able to get anywhere, any time, for any 
reason. Arguably, though, remotely changing the setting to not change 
the icon upon access should be VERY sparingly used.

CDN$0.02



On 08/30/2016 04:57 PM, Patrick Shoaf wrote:
> If they are at the desk and see the message, they can allow or deny the
> access.  If they do not choose, the default option set happens.  (IE
> "Allow" or "Deny" depending on config settings). This is controlled by
> "Accept connection on timeout" or "Deny connection on timeout".
>
> *Patrick Shoaf*
> IT Special Projects
> [email protected] <mailto:[email protected]>
>
> *Model Cleaners, Uniforms & Apparel
> Model Ohio Enterprises dba The Fussy Cleaners*
> 100 Third Street
> Charleroi, PA 15022
> Direct Dial: 724-565-2033
> 724-489-4386 Fax
> www.modelcleaners.com <http://www.modelcleaners.com>
> www.modelapparel.com <http://www.modelapparel.com>
> www.modeluniforms.com <http://www.modeluniforms.com>
> www.thefussycleaners.com <http://www.thefussycleaners.com>
>
> On 8/30/2016 4:41 PM, Randy Dover wrote:
>>
>> Patrick,
>>
>> Thank you for your reply!
>>
>> What happens if they aren’t at their desk or don’t reply? I’m thinking
>> of instances where they may not even be logged on to the computer. If
>> the action is set to query, and no one is there, what happens?
>>
>> Randy Dover
>>
>> *From:*Patrick Shoaf [mailto:[email protected]]
>> *Sent:* Tuesday, August 30, 2016 3:59 PM
>> *To:* [email protected]
>> *Subject:* Re: Change desktop when remote connection is established
>>
>> There is one way I know to to A) Notify users and B) allow unattended
>> access.  (This is available in Win ver 2.7.10.) From the Access
>> Control Tab on the Server Configuration, Set the IP Range up and use
>> "Action = Query" with at least a 10 second time time out and "Accept
>> connection on timeout".  This way the user is notified as long as they
>> are at their computer.
>>
>> *Patrick Shoaf*
>> IT Special Projects
>> [email protected] <mailto:[email protected]>
>>
>> *Model Cleaners, Uniforms & Apparel
>> Model Ohio Enterprises dba The Fussy Cleaners*
>> 100 Third Street
>> Charleroi, PA 15022
>> Direct Dial: 724-565-2033
>> 724-489-4386 Fax
>> www.modelcleaners.com <http://www.modelcleaners.com>
>> www.modelapparel.com <http://www.modelapparel.com>
>> www.modeluniforms.com <http://www.modeluniforms.com>
>> www.thefussycleaners.com <http://www.thefussycleaners.com>
>>
>> On 8/30/2016 10:17 AM, Randy Dover wrote:
>>
>>     I work for a financial institution and we are audited on a regular
>> basis.
>>
>>     A concern has been raised about having TightVNC installed, that IT
>> may "snoop" on end users without their knowledge.
>>
>>     I know the systray icon changes upon connect, but I doubt that
>> will be good enough for some of our users, plus I have currently
>> chosen to hide the icon.
>>
>>     I have looked on the mailing lists and didn't find what I'm
>> looking for, probably due to putting in the wrong words and getting
>> way too many hits.
>>
>>     What I would like to do is have the desktop change in some way, I
>> am currently choosing to hide the background, but if a user has
>> windows open, then they wouldn't see that.
>>
>>     Is there a way to force the desktop background to black (yes I
>> know, they still may not see that) upon connect, then back to whatever
>> color it was before connection?
>>
>>     Is there a way to force the desktop to be displayed in "basic"
>> mode? WebEx or another remote tool does this, to preserve bandwidth
>> and make screen refresh faster.
>>
>>     I've searched on TightVNC's site, plus the mailing list site, plus
>> "TightVNC for Windows: Installing from MSI Packages" and "TightVNC for
>> Windows: Installation and Getting Started" but didn't see what I'm
>> looking for.
>>
>>     I will be installing by pushing the MSI through a script, so
>> having the commands to put in the script will be a big help.
>>
>>     Thank you all in advance!
>>
>>     Randy Dover
>>
>>     This email is intended for its designated recipients. The
>> information, and attachments, contained in this email may be
>> considered private and/or confidential. If the transmission is
>> received in error, delete messages(s) from your system and notify the
>> sender. You may not, directly or indirectly, use, disclose or
>> distribute any part of this email.
>>
>>
>> ------------------------------------------------------------------------------
>>
>>
>>     ___________________________________________________________
>>
>>     TightVNC mailing list,[email protected]
>>     <mailto:[email protected]>
>>
>>     To change your subscription or to UNSUBSCRIBE, please visit
>>
>>     https://lists.sourceforge.net/lists/listinfo/vnc-tight-list
>>
>>
>> This email is intended for its designated recipients. The information,
>> and attachments, contained in this email may be considered private
>> and/or confidential. If the transmission is received in error, delete
>> messages(s) from your system and notify the sender. You may not,
>> directly or indirectly, use, disclose or distribute any part of this
>> email.
>>
>> This email is intended for its designated recipients. The information,
>> and attachments, contained in this email may be considered private
>> and/or confidential. If the transmission is received in error, delete
>> messages(s) from your system and notify the sender. You may not,
>> directly or indirectly, use, disclose or distribute any part of this
>> email.
>
>
>
>
> ------------------------------------------------------------------------------
>
>
>
> ___________________________________________________________
> TightVNC mailing list, [email protected]
> To change your subscription or to UNSUBSCRIBE, please visit
> https://lists.sourceforge.net/lists/listinfo/vnc-tight-list
>

------------------------------------------------------------------------------
___________________________________________________________
TightVNC mailing list, [email protected]
To change your subscription or to UNSUBSCRIBE, please visit
https://lists.sourceforge.net/lists/listinfo/vnc-tight-list