# Quick Assist: helping someone without opening a port

> How the session is authorised, what the helper can and cannot do, and why an unsolicited request is always a scam.

**Tested on**

- Build: 26300.9457
- Edition: Pro (26H2)
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Quick Assist is an **outbound, consent-based** remote session:

- the person being helped **starts** it and **shares a code**;
- no port is opened, no inbound firewall rule needed;
- the helper is a guest in that one session — no persistent access.

It solves the "help my parents' laptop" case that RDP solves badly.

## How a session runs

1. **Helper**: Quick Assist → *Assist another person* → sign in (Microsoft account) → get a 6-digit code.
2. **User**: Quick Assist → *Assist someone* → enter the code → *Allow*.
3. The user sees the screen and can **stop sharing** at any time.

Two permission levels:

| Level | Helper can |
|---|---|
| **View** | watch the screen |
| **Full control** | move the mouse and type |

Full control still requires the user to be present and to have approved it — and they can revoke it mid-session.

```powershell
# is Quick Assist installed?
Get-AppxPackage MicrosoftCorporationII.QuickAssist | Select-Object Name,Version,Status
```

> **Danger: An unsolicited Quick Assist request is always a scam**
>
> Microsoft, your bank, and your ISP will never send you a code and ask you to let them in. The "support" pattern — caller, code, screen share, then "open your bank app" — is the single most common remote-access scam. If you did not initiate it, close it.

## What the helper can and cannot do

| Can | Cannot |
|---|---|
| See the screen (view mode) | read your password fields silently |
| Control input (full control) | keep access after the session ends |
| Chat, annotate | install something without you watching |
| Restart the machine | reconnect without a new code |

It cannot bypass UAC: elevation prompts are on the **secure desktop**, which the guest cannot interact with. That is a feature.

## When Quick Assist is the wrong tool

| Situation | Better |
|---|---|
| Unattended access to your own machine | RDP over VPN |
| Multiple machines, repeated sessions | a managed remote support tool |
| Old Windows/macOS/Linux peer | platform-specific alternatives |
| Bandwidth-constrained link | RDP or a lighter tool (Quick Assist is screen-share heavy) |

## Practical hygiene for the person helping

- **Confirm identity out of band** — call the person, do not trust the caller ID.
- **Never ask for a code from a stranger**, only share your own.
- Do not type passwords for them; have them type and let you watch.
- End the session explicitly when finished.

## Related

- [Remote Desktop host setup](https://windows.homes/en/windows/remote/rdp-host/)
- [LAN shares and SMB versions](https://windows.homes/en/windows/remote/smb-shares/)
- [SmartScreen and unknown publisher](https://windows.homes/en/windows/hardening/smartscreen/)

## Lab boundary

E1. Quick Assist behaviour is documented by Microsoft. The lab has no second user to pair with, so no session was established.

## Sources

- [Microsoft Learn — Quick Assist](https://learn.microsoft.com/en-us/windows/client-management/quick-assist)
- [Microsoft Learn — Remote Desktop Services](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/)
- [Microsoft Learn — Remote Desktop clients](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients)

---

Source: https://windows.homes/en/windows/remote/quick-assist/