Edit: Jeff wrote up a much better way to get this information. Please ignore the below (unless you plan on just using it as a template for something else), but if you are looking for Remote Assistance information, use this: http://myitforum.com/cs2/blogs/jgilbert/archive/2007/08/08/inventorying-remote-assistance-requests-and-connections.aspx
By request, and using Jeff Gilbert's original code as a template, here's a MOF edit to pull event ids 5103 from the Application Event Log; which are essentially Remote Assitance Accepted requests. If you are tasked with reporting Remote Assistance performed by technicians, this is one way to gather that information. As cautioned by Jeff, and observed by others, when using a mof edit (like this one) which may perform resource-intensive WMI queries on your client computers, please test this MOF edit thoroughly; or be prepared to remove it from production if you find it has an adverse impact during a Hardware Inventory action on your clients.
//<<<<<<<<<<<<<<Start-Remote Assistance Requests Accepted-Start>>>>>>
#pragma namespace("\\\\.\\root\\cimv2")
[Union, ViewSources{"Select * FROM Win32_NTLogEvent
WHERE LogFile = 'Application' AND EventCode = 5103"},
ViewSpaces{"\\\\.\\root\\cimv2"},
dynamic,provider("MS_VIEW_INSTANCE_PROVIDER")]
class RemoteAssistanceAccepted
{
[PropertySources("LogFile"), Key] string LogFile;
[PropertySources("RecordNumber"), Key] UINT32 Recordnumber;
[PropertySources("Message")] String Message;
[PropertySources("TimeGenerated")] DateTime TimeGenerated;
};
//-------------------------- Reporting Class---------------------------
#pragma namespace("\\\\.\\root\\CIMV2\\SMS")
[SMS_Report(TRUE), SMS_Group_Name("Remote Assistance Accepted"),
SMS_Class_ID("MICROSOFT|RemoteAssistanceAccepted|1.0") ]
class RemoteAssistanceAccepted: SMS_Class_Template
{
[SMS_Report(TRUE), Key] String LogFile;
[SMS_Report(TRUE), Key] UINT32 RecordNumber;
[SMS_Report(True)] String Message;
[SMS_Report(True)] DateTime TimeGenerated;
};
//<<<<<<<<<<<<<<<<End-Remote Assistance Requests Accepted-End>>>>>>>>>>
As an example, what's reported is
LogFile: Application
Time Generated: 7/11/2007 8:15:00 PM
Message: RA: Expert user (remote user: usr321) has started controlling novice (local user: usr654)