Engage Remote Access using ConnectWise ScreenConnect

TABLE OF CONTENTS

• Engage Remote Access
• How does it work?
• Is it secure?
• Frequently Asked Questions

Engage Remote Access

Sometimes you may wish Engage support staff to connect to your laptops, PC, Macs or Engage servers within your school to help you with your case. This allows us to see your issues first-hand, or work on your servers to assess more complex issues. 

Engage use a remote access tool called ConnectWise ScreenConnect. This is the only remote access method we will use to access customers. 

How does it work?

ConnectWise ScreenConnect can be used in two ways: 

Permanent Remote Access: This option is ideal for accessing servers. Engage Support will help you install the ConnectWise ScreenConnect agent on your server. Your server is then registered with our ConnectWise ScreenConnect server. Our staff can then access your server in response to a support request. 

Temporary Remote Access: This option is ideal for accessing workstations (laptops, PCs or Macs). An Engage Support agent will send you an invitation or give you a code for ConnectWise ScreenConnect. A temporary piece of software is then downloaded to allow remote access. The software is automatically removed when the support session ends. This option can also be used for servers if your policies do not allow permanent access.

Is it secure?

Your IT team and Data Protection Officer should review the following information. Our security team are happy to answer any additional questions.

• All communications are sent directly between client workstations or servers and our support agents via our own dedicated remote access server. Data is never through third party routers or servers.
• All sessions are encrypted.
• ConnectWise ScreenConnect provides direct remote access to client workstations or servers. Unlike a VPN, there is no need to allow access to your whole network.
• Only authorised Engage and Education Horizons staff have access to ConnectWise ScreenConnect and all access is audited.
• ConnectWise meets a wide range of security standards. More information can be found at https://www.connectwise.com/company/trust/compliance
• Any passwords you give to us are stored in our password vault, which is only accessible by authorised Engage and Education Horizons staff.
• Engage and Education Horizons staff will only connect to your equipment or transfer data with your written

When setting up Permanent Remote Access for servers, we recommend some additional good practices are considered. 

• The ConnectWise ScreenConnect service can be disabled and only enabled by school IT staff whilst a support ticket is in progress. This is your responsibility. The service is called “ConnectWise ScreenConnect Client”.  
• Our ConnectWise ScreenConnect server will occasionally push updates to running ConnectWise ScreenConnect services. If the service is stopped or disabled, the updates will be pushed when the service starts. 
• You regularly rotate the Windows passwords supplied to Engage in line with your security policies, or only enable accounts used by Engage for the duration of a support ticket.

Frequently Asked Questions

What are the costs?

There is no additional cost.

We would prefer you to connect to us using our existing Remote Access solution or VPN? Can this be accommodated?

We will only connect to you using ConnectWise ScreenConnect. This allows us to train our staff on a single secure and audited connection method.

Do we need to add firewall rules?

ConnectWise ScreenConnectmakes outbound connections from school devices to connect.educationhorizons.com and connectrelay.educationhorizons.com (both 40.82.213.263), using HTTPS on port 443.

Most firewalls will pass the traffic without any further change, but school IT teams should confirm that firewall rules, including deep packet inspection and web filtering, are configured to allow traffic. 

We know of the following specific requirements:

• CyberHound - Add https://connect.educationhorizons.com/ (40.82.213.163) to the HTTPS Exclusions under Configuration > Web Proxy > Destination IP address HTTPS exclusions.
• Smoothwall – If Web Filters are being used, add https://connect.educationhorizons.com/ (40.82.213.163) (connect.educationhorizons.com) to Destination Exceptions.

We use the Engage hosted service. Do we still need to set up Permanent Remote Access?

No, Engage staff will automatically set up the necessary access methods to your hosted data.

Your staff sometimes mention Screen Connect. Is this the same thing?

Yes. ConnectWise ScreenConnect is the previous name for ConnectWise.