That is under the Administration - Security - Roles options. Specifically, you'll want to remove the "HostSessionWithoutConsent" flag from the tech/group you want the user to receive a prompt from. If you do that, I suggest you also look at the app.config file, and enable the AutoConsentIfUserProcessNotRunning flag, so that your techs aren't stuck waiting on permission to connect to a computer no one is at.