You cannot offer remote assistance to a user whose computer is running Windows Server 2003 with Service Pack 1

When you try to offer remote assistance to a user whose computer is running Microsoft Windows Server 2003 with Service Pack 1 (SP1), you are not successful. You may receive the following message:

This problem may occur if the following conditions are true:

• One or both of the following Group Policy settings are enabled on the computer that is running Windows Server 2003 with SP1:
  DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax
  DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax
• The users who try to offer remote assistance do not have security permissions for these policies.

To resolve this problem, follow these steps:

1. Create a security group in your domain to contain the user accounts of remote assistance helpers. For example, create a group that is named "Remote Assistance Helpers".
2. Modify Group Policy settings for the Active Directory container where you enabled the DCOM security-related policies. (For example, modify the site, the domain, or the organizational unit.) Add the Remote Assistance Helpers group, and then assign both local and remote access permissions to the group. To do this, follow these steps:
   1. Click Start, point to All Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
   2. Locate the container where you enabled the DCOM security-related policies.
   3. Right-click the container, click Properties, and then click the Group Policy tab.
   4. In the list of Group Policy Object Links, click the Group Policy object (GPO) that contains the DCOM security-related policies, and then click Edit.
   5. Expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then click Security Options.
   6. Double-click DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax if this policy is enabled.
   7. Click Edit Security, and then click Add.
   8. Click Locations, click your domain, and then click OK.
   9. Type Remote Assistance Helpers, click Check Names, and then click OK.
   10. Click to select the Remote Access check box in the Allow column, and then click OK.
   11. Click Apply, and then click OK.
   12. Double-click DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax if this policy is enabled.
   13. Follow steps d through f to add the Remote Assistance Helpers security group to this policy.
   14. Click to select all the check boxes in the Allow column, and then click OK.
   15. Click Apply, and then click OK.
   16. Close Group Policy Object Editor, click OK on the Active_Directory_Container Properties dialog box, and then close Active Directory Users and Computers.
3. Add the domain group to the helpers list in the Offer Remote Assistance Group policy if it is not already added. To do this, follow these steps:
   1. Click Start, point to All Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
   2. Locate the container where you enabled the DCOM security-related policies.
   3. Right-click the container, click Properties, and then click the Group Policy tab.
   4. In the list of Group Policy Object Links, click the GPO that contains the DCOM security-related policies, and then click Edit.
   5. Expand Computer Configuration, expand Administrative Templates, expand System, click Remote Assistance, and then double-click Offer Remote Assistance.
   6. Click Show, click Add, type Domain_Name\Remote Assistance Helpers Group, and then click OK.
   7. Click OK, click Apply, and then click OK.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

The DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax policy determines the users or groups that can log on remotely or locally.

The DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting determines the users or groups that may start a process remotely or locally.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base: