Are you talking about TeamViewer and shit like that?

Have you tried gaining authorized access, then disabling the AV and installing a RAT? Or transferring a Trojan/keylogger-infected file?

I've never attempted to attack a computer via Teamviewer or anything like that, so I don't really know what limitations you're facing. But I would imagine that even if you're restricted from accessing the AV and/or firewall controls, there must still be some roundabout way of accessing/editing the exception list so you can transfer the necessary application.

But out of all those possibilities, I'd bet that the easiest way would be transferring an infected file. Maybe build your own Trojan or keylogger, and bind it into a seemingly innocuous file that you're sending along with numerous others. I would imagine a custom Trojan would be harder for AV to identify.

Again, I'm no expert on legit remote admin programs, but maybe you can try some of the things I've suggested. If I were in your shoes, they would be the first things I would try.

You could theoretically write a primitive kelogger in a IDE while the vicitim is out of the room. However, I think this too obvious.