RemotelyAnywhere

 

What is RemotelyAnywhere?

RemotelyAnywhere is a Windows NT service that lets you remotely control the machine it is installed on via TCP/IP, without the need of any special client software. All you need is a decent (forms/tables/frames/JavaScript/authentication capable) browser and you are set.

RemotelyAnywhere (RA) lets you start/stop NT services and drivers, create and terminate processes, simulate keypresses and mouse clicks, look at the screen of the server, edit the registry, look at the event logs, download and upload files, and more.

If you are familiar with other remote administration / remote control packages, you should know that it is something like WebAdmin from Microsoft, but with the some of the capabilities of pcAnywhere from Symantec (http://www.symantec.com) or RemotelyPossible from Avalan (http://www.avalan.com).

It's different from all of these in one respect: it was designed with the System Administrator in mind. Part of my job over the last three years was maintaining Windows NT servers over the Atlantic Ocean, and whenever I needed a feature I added it to RA.

 

Who Created RemotelyAnywhere?

RemotelyAnywhere was created by Márton Anka.

RemotelyAnywhere is © Márton Anka. All rights reserved.

 

How much does it cost?

A single license costs US $50. You can go to RemotelyAnywhere.com and find out about volume discounts.

If you would like to get in touch with me, (suggestions, bugs, special deals, etc) email me at marton@remotelyanywhere.com. Any and all feedback is appreciated.

 

System Requirements

RemotelyAnywhere requires a computer running Windows NT 3.51 or NT 4.0. It might work on earlier/later releases but has never been tried on any other versions of NT. Currently I only support the Intel platform.

 

How to use RemotelyAnywhere?

Installing RA is easy: Unzip the archive into the folder you want to run it from. Make sure to retain the directory structure contained in the ZIP file. From your console, type "RemotelyAnywhere -Install". You can now use the Control Panel to start and stop the service. RA needs to interact with the desktop, if you disable this in the Control Panel you will render some features inaccessible.

Uninstalling is similarly easy: Stop the service, type "RemotelyAnywhere -Uninstall" to get rid of the registry entries, and you are free to delete all the application’s files.

Once you get RA to work, you can access it from your browser by typing http://your.machine.here:2000 as the URL.

You will be prompted for a username and a password. RA will use the Windows NT user database to authenticate the user. Initially, you will need to log on as someone who is the member of the Administrators group. Later you can change this default behavior by creating a special group called 'RemotelyAnywhere' and add all users that need to have access to RA to this group. You can then turn off Administrator access if you wish, but please keep in mind that users who aren't members of the Administrators group have only limited access. They cannot start or stop services, for example.

RA is extremely easy and intuitive to use, but let me walk you through the menu and the screens:

In the main menu, you have the following options:

 

Info Page

The Info page is what you see when you first access RA. It has some useful information, like the server's name, the authentication method used, the OS version, CPU type and speed, the current memory utilization and the IP addresses it was most recently accessed from.

 

CPU Load

On this page you will see three graphs and two lists. The graphs show you the processor utilization on the machine with three different sampling rates.

The first is 10 seconds, so the graph spans not exactly an hour. This is useful to see what's happening right now on the machine. The second is 5 minutes, which shows you a bit more than 24 hours of server activity. The third is one hour, so the graph spans almost two weeks. If you move your mouse over a line in one of the graphs, the tooltip that pops up tells you when exactly the sample was taken.

The two lists at the bottom show the processes that take up most of the processor time. The first list is an absolute list: it simply sorts processes by the number of processor-seconds they have eaten up. The second is more interesting: it's weighted, so younger processes that take up a lot of processing time come closer to the top. (The figure is: processor_seconds/process_age_seconds). So if you see a sudden spike on the first graph you can check the second list and immediately find out which process is eating up processor time.

 

Configuration

This page lets you customize RA to some extent. Here are the settings you can change:

Visit Length (seconds): Every authenticated access to RA is show on the Info page. If there are several successive hits from the same IP address, they are still shown as one access. This setting specifies the number of seconds that must elapse between two hits before it's considered two separate visits.

Number of IP Addresses to watch: The number of elements in the Access List on the Info page.

Maximum number of Event Log records to display: The number of Event Log records per page on the Event Log pages.

TCP/IP port to listen on: Specify the port you want RA to use. Takes effect when the service is restarted.

Write events to a log file: Enable/Disable logging. It's off by default, but if check the box and update the configuration everything that RA does is logged in a file called RemotelyAnywhere.log in the directory RA is installed in.

Secure Authentication: Enable/Disable NTLM authentication. For those of you concerned about security, RA supports the Windows NT Challenge/Response type authentication. You must use Internet Explorer to take advantage of this feature. Netscape will always use the default authentication method, which means that passwords travel in Base64-encoded clear text over the network. The default for Secure Authentication is OFF, because I have had some problems with it on some servers, especially when using non-English versions of Windows95 as clients. Go figure. I am currently working on this.

Allow all administrators in RA: This is on by default. If you turn it off, noone will have access to RA until you create a group called RemotelyAnywhere and add some users (yourself?) to it.

Allow access to user group: Name of the group that holds users who may access RA. If you don't create this group, it's only administrator access.

Select sreenshot image type: GIF or PNG. PNG yields 30% better compression and much better interlacing (important over a slow link) but you need to get the latest version of your browser to be able to make use of it.

Screenshot color depth: Choose between 16 or 256 color screenshots.

Colors: Some might find the default color scheme RA uses overwhelming. You can change most of the colors used here.

 

Screen

This is the most powerful part of RemotelyAnywhere. Selecting this option brings up a form in the upper part of the screen and a screenshot of the server in the lower part. The screenshot (toned down to 16 colors and compressed into a GIF as default) is a clickable imagemap. What exactly happens when you click it is defined by the controls on the form.

The "Click Type" can be Single, Double or Right. You'll always be single-clicking the imagemap (hey, that's the way they work) but what's simulated on the server is determined by the active radio button. Additionally, you can choose to have the server think the Shift or the Control key was depressed while the click happened by checking the appropriate checkbox.

You can simulate dragging the mouse by checking the 'Start Drag' box, clicking on the screen where you are dragging from, selecting 'End Drag', and clicking the screen again at the position you are dragging to.

The first of the six text links will refresh the image when clicked. The others will simulate special keystrokes: Alt-Tab, Control-Alt-Del, Shift-Esc, Control-Esc, Control-Shift-Esc.

If you click on the link that says 'Send text' it will change into 'Send passwd' and anything you type in the input field will be masked by asterisks so that it's safe from curious eyes. Click on 'Send passwd' to get back to normal entry mode.

The text entry field allows you to send keystrokes to the server. Just enter any text you want to type on the server's keyboard, and click the GO button. If you check the 'Special' box, you can enter special characters and simulate special keys. Here's how they work:

Each key is represented by one or more characters. To specify a single keyboard character, use the character itself.

The plus sign (+), caret (^), percent sign (%), tilde (~), and braces { } have special meanings to this function. To specify one of these characters, enclose it within braces ({}). For example, to specify the plus sign, use {+}. To specify brace characters, use {{} and {}}.

To specify characters that aren't displayed when you press a key, such as ENTER or TAB, and keys that represent actions rather than characters, use the codes shown below:

KeyCode
BACKSPACE {BACKSPACE}, {BS}, or {BKSP}
CAPS LOCK {CAPSLOCK}
DEL {DELETE} or {DEL}
DOWN ARROW {DOWN}
END {END}
ENTER {ENTER} or ~
ESC {ESC}
HOME {HOME}
INS {INSERT} or {INS}
LEFT ARROW {LEFT}
NUM LOCK {NUMLOCK}
PAGE DOWN {PGDN}
PAGE UP {PGUP}
RIGHT ARROW {RIGHT}
SCROLL LOCK {SCROLLLOCK}
TAB {TAB}
UP ARROW {UP}
F1 to F24 {F1} to {F24}

To specify keys combined with any combination of the SHIFT, CTRL, and ALT keys, precede the key code with one or more of the following codes:

Key Code
SHIFT
+
CTRL
^
ALT
%

For example, if you wanted to go go to the beginning of an edit field, select the entire line, place it on the clipboard, overwrite it with something else then hit Enter you would type:

{HOME}+{END}^cThis is the new text{ENTER}

This transalates to pressing the HOME key (going to the beginning to the field), then pressing the SHIFT and the END keys at the same time (selecting the entire field), pressing CONTROL+C (clipboard copy), typing the new text and hitting ENTER.

 

Processes

The output of this function will give you a listing of all processes running on the computer.

PID: The internal Windows Process ID.

Name: The name of the executable file with full path. This works as a link, and clicking on it will give you some very detailed information on the process. On that page, you have the option of changing the priority class for the selected module.

Page Faults: A number indicating how many times had the operating system have to swap a page in from disk on behalf of this application. (Just to give you an idea how much more memory you should put into your machine and why.)

Created: The date and time when the process was started.

CPU Time: The amount of CPU time (d hh:mm:ss) the process has used.

Priority: The priority class of the process.

Kill: Clicking this red button will have RA kill the process. The process will be terminated immediately.

 

Services

The Services and Drivers lists look identical. They show you the names of all the services (or drivers) installed on the system and their status.

Clicking on their name will show you more detail about the selected object and will let you control it too. In addition to this, you are able to change its startup options as well. When specifying a user account to be used by a service, it must be in DOMAIN\USER form. If you want to use a local user account, you can type .\USER.

 

Autologon

This option lets you enable or disable NT's autologon feature. You can also do this via the registry or with other small utilities, like the one included in the NT Resource Kit.

Enabling autlogon will cause the server to bypass the logon screen after bootup and log in with the username and password specified here.

 

Reboot

Selecting this option will let you reboot the machine. You will be asked if you are sure you want to do it. You can answer with Yes, No, or Emergency.

Emergency reboot is different from the normal reboot. Normal reboot will shut down all aplications and services nicely, allowing them to save their information.

Emergency reboot will kill all processes and reboot the server quickly. This can be useful if there are hung processes that prevent NT from doing a normal shutdown.

 

System, Application and Security Logs

You can view the NT logs using this option. The use of this feature is very much like NT's Event Viewer.

You'll get a listing of log entries on your screen, and clicking on an entry will display details about it.

You can choose to clear the contents of the log file by pressing the button at the bottom of the screen.

 

File Manager

Selecting this item will display a list of all available drives on the screen, together with their capacity and available free space.

Clicking on the drive names will take you into the root directory of that drive, where files and directories will be links again.

Clicking on the name of the subdirectory will take you into that directory and produce a listing.

Selecting a file will cause RA to send it to your browser. Because of RA's architecture, the file is loaded into memory first, so don't this feature to download very large files!

The checkboxes next to filenames allow you to select multiple files at once. You can then delete, copy or move the selected files or directories by pressing the appropriate button.

Clicking the Upload button will let you upload files to the current directory using your browser.

 

Registry

This option will let you edit the registry of the server. First, the registry roots (HKCR, HKCU, HKLM, etc.) are displayed, and you can dig down into them by clicking on their names.

Registry keys are links that open up that key for you. Key values are also displayed here, with their name, type and value.

You can edit values that are of either text (REG_SZ or REG_EXPAND_SZ) or integer (REG_DWORD) type. Binary, multi-string, etc. values are only displayed but cannot be edited.

Using the links at the bottom you can add a subkey, add a value or delete the currently opened key.

 

Help

You can view this file and the software license, and also find a link to the RemotelyAnywhere web site.

 

Some issues with security

RA basically works like a password-protected webserver. When you type your username and password in the browser's prompt that information is going to accompany each HTTP request the browser sends. If you have Secure Authentication enabled, the browser will attemt to log in with the current interactive user's login name and password.

RA will only reply to HTTP requests that contain a username and a password. The user is checked against the NT user database and if the user is a member of the Administrators or Domain Admins group access is granted. RA will then impersonate the user so (for example, when working with the registry or downloading a file) access restrictions will apply. However, when controlling the keyboard and mouse of the server via the Screen option, everything will be done in the context of the current interactive user on the server.

 

Troubleshooting

RemotelyAnywhere won't run off a network drive - services running under the LocalSystem account can not access network resources.

Make sure you unzip the distribution archive with a 32 bit utility that preserves long filenames. The files included in the archive are described in the readme.txt file.

 

Changes

Aug-17-1998 2.0

  • The final, commercial version!
  • Ability to upload files using your browser
  • Support for domains (and domain admins)
  • Ability to 'drag' the mouse on the remote control screen
  • Fixed a nasty memory leak bug
  • No need for ragina.dll and sshot.dll anymore.
  • Customizable colors.

Aug-4-1998 2.0 B3 101

  • A couple of minor bugfixes, especially for international versions of Windows NT.

Jul-31-1998 2.0 B3

  • HTML changes everywhere... Looks much nicer, loads faster.
  • Rolled my own performance data classes, so pdh.dll is not needed anymore.
  • Smaller executable size.
  • Better, more powerful process information page.
  • Expanded File Manager functionality.
  • RA now uses the console during installation instead of message boxes. This allows you to install it from batch files, scripts, etc.

Jul-20-1998 2.0 B2

  • RA will refuse to install from a network or removable drive to ensure that it's always available.
  • Made all html and gif files part of the main executable.
  • On the Info page, the name of the user appears next to his or her IP address.
  • Added support for 256 color GIF screenshots in addition to 16 color ones, and support for 16 and 256 color PNG screenshots as well. PNG is usually 30% smaller than the GIF counterpart and has a lot better interlacing but requires the latest browser in order to be visible.
  • A new way of specifying who can access RA. Until now, everyone in the Administrators group (and only them) could access the service. Now the default is that all Administrators and everyone in the member of a special group called RemotelyAnywhere have access. You can turn off the Administrator access, and can specify a group name other than RemotelyAnywhere if you want.
  • Configuration page updated to allow for changing options related to authorization and screenshot image format.
  • RA now lets you send passwords that are safe from eyes over your shoulder. On the Screen page, you can switch back and forth normal text and password mode by clicking on the link that says 'Send text' or 'Send passwd' respectively.
  • The Autologon page will mask the password that you enter with asterisks.
  • Drivers/Services have changed. The page only lists the drivers and their status. Clickig on their name will bring up another page that lets you start and stop them. (Or pause and continue, where supported.) This page will also tell you more information, like the binary name for the service, services or drivers this object depends on and what other objects depend on this one. Here you are also able to change startup options.

Jul-13-1998 2.0 B1

  • First release.