Глянул доку http://technet.microsoft.com/en-us/library/bb457004.aspx :
Administering Remote Assistance in Corporate Environments
There are several issues to consider when managing and administering Remote Assistance in the corporate environment or large organization. You can specify an open environment where employees can receive Remote Assistance from outside the corporate firewall. Or you can restrict Remote Assistance via Group Policy and specify various levels of permissions such as only allowing Remote Assistance from within the corporate firewall.
Configuring Port 3389 to Enable Remote Assistance
Remote Assistance runs over the top of Terminal Services technology, which means it needs to use the same port already used by Terminal Services: port 3389. For more information about using and configuring ports, see this Microsoft Knowledge Base article.
Note: If the person who is being helped is behind a firewall, NAT, or ICS, Remote Assistance will still function as long as the person being helped initiates the session via Windows Messenger. However, as stated above, Remote Assistance will not work in cases when the outbound traffic from port 3389 is blocked.
Using Remote Assistance in a Home Network
If you are using Personal Firewall or NAT in a home environment, you can use Remote Assistance without any special configurations. However, if you have a corporate-like firewall in a home environment, the same restrictions apply: you would need to open Port 3389 in order to use Remote Assistance.
Иными словами если хост за файрволом, то он может предлагать помощь. Т.к. он пойдет "помогать" кому-то по tcp3389. В этом случае надо чтобы хотя бы у одного был разрешен вход tcp3389, у другого выход tcp3389. Файлы тоже вроде позволяет передавать. Я пару раз только это дело юзал и очень давно. Пробовать надо, чтобы понять возможности.