Fix it while they watch, or while they are away.
Attended sessions with the user present, unattended access to managed fleets, and file transfer to push tools and fixes. Technicians get role-based permissions; the connection log shows who touched which machine.