Quick Assist Download
Rikke Greenlee
The original Remote Assistance is included on all releases of Windows 10 as well, but since the Windows 10 Anniversary Update, its Start menu shortcut is removed, effectively hiding it from the user. Instead, a new app called Quick Assist is added.[14] It has mostly the same functionality and a similar user interface with buttons called Get assistance and Give assistance. The design is like UWP apps. Unlike Remote Assistant, Quick Assist requires the support person to sign in using a Microsoft account before dispensing help.[15][16]
While Remote Assistance establishes a Remote Desktop Protocol (RDP) connection to the end user's computer (requires TCP port 3389 to be opened on the client machine and the firewall/NAT/router behind which the machine is), Quick Assist is cloud-based and requires one outbound connection from the helper's PC to the cloud service/Microsoft server, and a separate connection from the cloud service to the machine of the person getting assistance. There are no ports opened on the client device's firewall.
We have microsoft quick assist remote desktop tool blocked by application control and we are getting hundreds of alerts of users trying to run this application but when we contact these users they say they have never even heard of this application.
[this isn't actually a Malware question - the Endpoint or the Central forum would be a better choice]
according to the Labs' Controlled Applications page it has recently been added in the Remote management tool category. As far as I can see it's a Windows 10 feature and detection is triggered by %windir%\system32\quickassist.exe.
Don't ask me what it does or could do, apparently it has been added recently (and probably upon customer request). As it was there before you might at least temporarily authorize it.
Hi everyone, I have a big problem: microsoft's quick assistance app no longer works across my entire network. Are there any known problems with the latest fw installed? I also tried to open all vs all but it still doesn't connect to any PC. But sometimes it connects, for no reason. PC All the same (clones), before the last FW it worked without particular problems. Thanks
If the firewall is denying this traffic, there should be a deny log in traffic monitor that lines up with that traffic. Quick assist works over port 443 and attempts to access , which is exempted from the HTTPS proxy by default.
Quick Assist is an app in Windows 10 and Windows 11 that enables you to receive or provide assistance with your PC over a remote connection. The current built-in Quick Assist app is reaching end of service.
The Quick Assist wireless shopper call button provides a low-cost, fast and efficient way to boost customer service, control costs and improve employee productivity. With the Quick Assist, customers simply push a button when they need assistance. Your two-way radio-equipped personnel are immediately alerted with a customized voice message. The Quick Assist is compatible with your existing store 2-way radios and talks directly to radio-equipped personnel. It does not require any additional wireless infrastructure (e.g. no WiFi) for operation and is the ideal solution for any business wanting to maximize customer satisfaction, product sales, and employee productivity.
Places to use the Quick Assist Call Button . . .
I installed the latest anniversary update on several domain computers.
I found the quick assist app to be very useful but there is an anoying problem.
Whenever i try to install an app or run something that asks for admin privileges i get a black screen with a pause symbol and cant do anything.
Quick assists perform local code transformations. They are invoked on a selection or a single cursor in the Java editor and use the same shortcut as quick fixes (Ctrl+1), but quick assist are usually hidden when an error is around. To show them even with errors present on the same line, press Ctrl+1 a second time. A selection of quick assists can be assigned to a direct shortcut. By default, these are:
Assign more shortcuts or change the default shortcuts on the General > Keys preference page (in the 'Source' category). A quick assist light bulb can be turned on on the Java > Editor preference page.
For detection rules we are going to use a PowerShell script I created. You can find it in the ZIP above called QuickAssistDetection.ps1. Below is a quick look at the detection script.
As any researcher other would do, I started looking at the interesting features Microsoft added to Windows 10. As you may recall, last year i've found a quite simple vulnerability in Microsoft's Remote Assistance tool which allowed users to ask for assistance. You can read all about it. here.
So I stumbled upon "Quick Assist" I was wondering if it was just MSRA repackaged in a fancy name.
I fired up Burp Suite and let everything pass through the proxy and started looking at the HTTP requests coming in.
Once you startup "Quick Assist" it looks as follows:
You get 2 options, either provide assistance or request assistance.
In order to be able to assist a person you'll have to sign-in/up with a microsoft account (@outlook.com,hotmail.com, live.com, ...), which can be created easily. Once you've logged in, Quick Assist will continue its HTTP requests (HINT: it's setting up an anonymous Skype Businness meeting room) and retrieve a security code which needs to be sent to the person/victim requiring assistance.
There are several ways to send this code as you can see above. Now here things get interesting, since a scammer would like to make the victim believe that he is genuinely someone from Microsoft providing support he can choose the option to send the code via email.
Interesting enough this mail is delivered without any information regarding the person who exactly is sending it. The sender of the mail is a legitimate Microsoft email address. Now this is the first step that makes the "victim" seem confident he/she is talking to a real Microsoft Support representative.
Above you can see the HTTP request, it's a JSON request with "destination" and "code" as the 2 parameters. (FUN FACT: you can put pretty much anything in the "code" parameter value)
The victim will get an email that looks something like the screenshot above.
The attacker/scammer's "Quick Assist" will wait for a reply from the "remoteassistance.support.services.microsoft.com" servers to initiate the next step of the process.
After some HTTP calls the attacker is prompted with the following window:
Quick assist was a cool windows out of the box tool that can get or provide PC support via a remote connection. Because Quick Assist is a pre-installed app in Windows, it can also be used to provide support during setup via e.g. Autopilot. The experience for the user was really easy. You have to only read out a 6 character code from the client and type in on the quick assist app on the supporter site.
But this will be changed quick assist will not be longer a build-in tool in windows. Microsoft posted on April 27, 2022 in the Windows Insider blog that Quick assist will only be available via the Windows Store in the future and that support for the old client will end. So, if you want to continue using Quick assist in the future, you will have to install it from the Windows Store.
However, there are several problems here. The first problem is that the installation of Quick assist from the Windows Store requires admin rights. This is not always the case in a professionally managed business environment where users also have admin rights on their PC. The second problem is that if you are using Windows LTSC there is no Windows Store to get quick assist from. And user getting a error messages about missing WebView2 runtimes.
We will installed Quick assist as offline version from the Windows Store for Business. Offline version does not mean that the app sources are downloaded and a new app must be created for each new version. We will activate the sync of Intune with the Windows Store for Business as a first step. Intune can always pull the latest version of quick assist from the store. As many have already noticed, the support of Windows Store for Business will end in 2023. Again, there is no reason to panic. Rudy Ooms has summarized very well in his blog what this means.
The change that Quick assist now has to be installed via the Windows Store causes some challenges as mentioned above. I hope I could explain you in this blog how you can manage these challenges. It was a great feature that it was possible to connect remotely to a device before it was even enrolled. This will no longer be possible in this way as Quick assist will be installed during enrollment. Nevertheless, it remains that quick assist is a very good tool to remotely support Windows PCs in a very simple way.
For the this post, consider the local machine the computer that obtained the code for sharing and where the person offering assistance is working. Consider the remote machine the computer that is sharing the screen and is being used by the individual requesting assistance.
The wireless quick assist alerting call button provides an efficient approach to improving shopper response times, control costs and accelerate employee reaction times. Workers and shoppers needing assistance are just a button press away from contacting your 2-way radio equipped staff members who will be instantly alerted with a unique and customizable voice response.
Microsoft Quick Assist is a remote assistance tool that allows support teams to resolve tech issues without physically accessing a device. With the Microsoft Quick Assist integration from Incident IQ, technicians can start a remote session straight from a help ticket.
df19127ead