Author Topic: Remote Assistance Not Connecting on Some Clients  (Read 10760 times)

0 Members and 1 Guest are viewing this topic.

Offline zlloyd

  • Jr. Member
  • **
  • Posts: 23
Remote Assistance Not Connecting on Some Clients
« on: February 10, 2015, 05:30:18 PM »
We're experiencing a strange problem with remote assistance not working for some clients - see attached for the error message we are receiving.  We are running client version 8.0.1603.

As stated above, the problem only affects some clients.  After Wiresharking clients that are working and ones that aren't, we've been able to narrow down the difference to a resolved IP address for rh.ara.avast.com.  The clients that aren't working are resolving to 77.234.41.84, while the clients that do work resolve to 77.234.44.84.  I'm not certain if this has anything to do with it, but it was the only difference we saw.  We also connected  a few machines that weren't working to an open offsite internet connection to eliminate any content filtering/local network issues, but the problem remained.  I have the Wireshark files available by request - thank you.

Offline Chad-bisd

  • Hopeful, yet discontent
  • Jr. Member
  • **
  • Posts: 49
    • Beckville ISD
Re: Remote Assistance Not Connecting on Some Clients
« Reply #1 on: February 10, 2015, 05:44:28 PM »
Unless you have a support contract with Avast! or whoever provides the paid support, I'm going to suggest you implement a workaround until the problem is resolved.  More than likely, one group of remote help servers is having issues with it's configuration or is unreachable.

In your DNS, create a new zone file named rh.ara.avast.com and create a new host record, same as parent domain, and have it resolve to the working IP address.  Flush your DNS cache, check you are getting the working IP when trying to connect to the rh.ara.avast.com

Offline zlloyd

  • Jr. Member
  • **
  • Posts: 23
Re: Remote Assistance Not Connecting on Some Clients
« Reply #2 on: February 10, 2015, 07:11:51 PM »
Thanks for the suggestion.  Unfortunately (or fortunately?), it appears the IP address difference doesn't matter.  I forced a working computer to resolve to the "not working" IP address via the hosts file and it connected just fine.  I also tried the same by adding the "working" IP address into a machine's host file that wasn't working and was met with the same error - so we're back to square one.

Offline Chad-bisd

  • Hopeful, yet discontent
  • Jr. Member
  • **
  • Posts: 49
    • Beckville ISD
Re: Remote Assistance Not Connecting on Some Clients
« Reply #3 on: February 10, 2015, 07:56:59 PM »
Do you use a proxy or content filter that requires authentication? Can you check the logs there to see if one of the non-working hosts is getting denied for some reason?

As a side note: I thought the remote help feature used the local server to perform its function. I could be wrong, but I don't understand why it would going out to one of avasts servers to remote help someone on the local LAN.

Offline zlloyd

  • Jr. Member
  • **
  • Posts: 23
Re: Remote Assistance Not Connecting on Some Clients
« Reply #4 on: February 10, 2015, 08:18:06 PM »
According to our content filter logs, there isn't anything being blocked.  That was our first thought as well, so we took a few machines offsite and hooked them up to an open internet connection but had the same issue.

I'm purely speculating, but I think it uses the remote Avast server to generate the remote code.
« Last Edit: February 10, 2015, 08:20:17 PM by zlloyd »

Offline Chad-bisd

  • Hopeful, yet discontent
  • Jr. Member
  • **
  • Posts: 49
    • Beckville ISD
Re: Remote Assistance Not Connecting on Some Clients
« Reply #5 on: February 10, 2015, 08:32:04 PM »
Do your clients have an agent installed that forces them to proxy or check-in?  Maybe something that would be doing SSL decryption?

Is the date and time/timezone correct on the non-working machines?

I'm grasping at this point :D

Offline zlloyd

  • Jr. Member
  • **
  • Posts: 23
Re: Remote Assistance Not Connecting on Some Clients
« Reply #6 on: February 10, 2015, 08:37:26 PM »
No to the proxy/SSL decryption question - our content filter resides inline and doesn't use any proxy settings (in other words, once you're off network, you get free reign), and yes to the time being correct on the client machines that aren't working.  We're grasping at straws too!  We use this feature in our helpdesk extensively for remote support and its inaccessibility is crippling us.  Thank you for the suggestions thus far!

Offline Chad-bisd

  • Hopeful, yet discontent
  • Jr. Member
  • **
  • Posts: 49
    • Beckville ISD
Re: Remote Assistance Not Connecting on Some Clients
« Reply #7 on: February 10, 2015, 09:37:54 PM »
At this point, I would start looking for similarities between the machines that aren't working.
*Are they in the same container in AD?
*Same security group?
*Maybe based on the same version of an image file or operating system service pack level?
*Do you have WSUS or other patch management in place? Are they in the same group in that system?
*Are they in the same group in Avast! for getting their policy file?
*Did some update, patch, or configuration recently get applied to the computers in the non-working group that didn't get applied to the working group?[/li][/list]

How are they different from the ones that do work? Other than resolving to the other IP address?

At this point, I would just have to sleuth it out step by step, comparing and contrasting until I pinned it down.

Offline zlloyd

  • Jr. Member
  • **
  • Posts: 23
Re: Remote Assistance Not Connecting on Some Clients
« Reply #8 on: February 26, 2015, 09:33:11 PM »
In an attempt at further troubleshooting, we removed Avast EPS from a machine that didn't work and installed the free version.  We confirmed that the remote assistance in the "free" version of Avast works without fail!  The URL of the remote server is slightly different (free.ara.avast.com rather than rh.ara.avast.com), but the resolved IP address was the same in both cases.  After removing the free version and re-installing the full version, remote assistance stopped working again (though the resolved IP was the same).

Needless to say we are stumped and slightly frustrated.

Offline Chad-bisd

  • Hopeful, yet discontent
  • Jr. Member
  • **
  • Posts: 49
    • Beckville ISD
Re: Remote Assistance Not Connecting on Some Clients
« Reply #9 on: February 26, 2015, 09:46:44 PM »
Have you checked the certificates to make sure something is not invalid or revoked on the machines that are not working? I'm grasping at straws again.

Offline zlloyd

  • Jr. Member
  • **
  • Posts: 23
Re: Remote Assistance Not Connecting on Some Clients
« Reply #10 on: February 26, 2015, 09:49:09 PM »
Can you expound a bit on how we can do this?  Our subscription file states that we have an active subscription with 65 days remaining if this is what you mean.

Offline Chad-bisd

  • Hopeful, yet discontent
  • Jr. Member
  • **
  • Posts: 49
    • Beckville ISD
Re: Remote Assistance Not Connecting on Some Clients
« Reply #11 on: February 26, 2015, 10:04:57 PM »
Backing up a bit, since certificates are complex.  Did you make sure the date, time, and time zone settings on the machines are correct? Still having to do with certificates, but not diving into the deep end yet.

Offline zlloyd

  • Jr. Member
  • **
  • Posts: 23
Re: Remote Assistance Not Connecting on Some Clients
« Reply #12 on: February 26, 2015, 10:07:41 PM »
Yes, time on all machines are synced to a local NTP server which reflects our correct time/time zone/etc.

Offline zlloyd

  • Jr. Member
  • **
  • Posts: 23
Re: Remote Assistance Not Connecting on Some Clients
« Reply #13 on: February 27, 2015, 02:45:04 PM »
I found this thread after some Googling:  https://forum.avast.com/index.php?topic=133412.msg982445

It's an older thread, but someone has replied recently with the same problem we're having. 

Offline Chad-bisd

  • Hopeful, yet discontent
  • Jr. Member
  • **
  • Posts: 49
    • Beckville ISD
Re: Remote Assistance Not Connecting on Some Clients
« Reply #14 on: February 27, 2015, 03:53:48 PM »
Any chance the problem clients have some kind of firewall or filter turn on locally? Windows firewall or maybe even Avast! shield that the working clients do not have?