Hi, my domain is at the 2008R2 functional level, and I have a group policy which configures the "offer remote assistance" setting (Computer Configuration>admin templates>System>Remote Assistance). I have noticed some interesting
behavior, and I'd like to know if there's a more efficient way to do this: Whenever this policy gets applied, it seems as if it removes all individuals from the "Offer Remote Assistance" group, then re-adds them. I notice this because
when I update the group policies on the clients, I see security log event 4733 (removing the account from the "offer remote assistance group") for each defined helper, then see security log event 4732 (adding the account to the "offer remote
assistance group") for each helper.
Is there a better way to accomplish this without adding and removing the accounts from the "offer remote assistance" group every time the policy is refreshed?
I ask because I'm using a SIEM for logging privileged account usage or membership changes, and the hundreds of events per day are a bit noisy.
As always, any recommendations are greatly appreciated!
Thanks,
Kevin
