Information
This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer.
The recommended state for this setting is: 'Disabled'.
Rationale:
There is slight risk that a rogue administrator will gain access to another user's desktop session, however, they cannot connect to a user's computer unannounced or control it without permission from the user.
When an expert tries to connect, the user can still choose to deny the connection or give the expert view-only privileges.
The user must explicitly click the Yes button to allow the expert to remotely control the workstation.
Solution
To establish the recommended configuration via GP, set the following UI path to 'Disabled':
Computer Configuration\Policies\Administrative Templates\System\Remote Assistance\Configure Solicited Remote Assistance
Note: This Group Policy path may not exist by default.
It is provided by the Group Policy template 'RemoteAssistance.admx/adml' that is included with the Microsoft Windows 8.0 & Server 2012 (non-R2) Administrative Templates (or newer).
Impact:
Users on this computer cannot use e-mail or file transfer to ask someone for help.
Also, users cannot use instant messaging programs to allow connections to this computer.