up vote 3 down vote favorite
1
share [g+] share [fb]

What is the best way to monitor a terminal server session that is being shadowed? I believe I have an admin shadowing one of our users and talking in notepad. Does anyone have any suggestions on the easiest way to find this?

link|improve this question
88% accept rate
What do you mean by monitor? Do you want to know who is shadowing who, what they are saying, or what? – Zoredache Aug 31 '10 at 16:43
Do you want to know when a shadow session occurs on 2003 terminal services or when a shadow session occurs on remote administration mode? – Jim B Aug 31 '10 at 18:00
I was wondering if 2 people can shadow 1 session. I'm thinking my best bet may be to install a keylogger. – Jacob Aug 31 '10 at 18:08
feedback

2 Answers

up vote 1 down vote accepted

An attempt to shadow a terminal session will result in a prompt requesting a shadow session to be allowed. If the user has not been prompted to allow the shadow then most likely it's not happening.

That is not to say, however, that activities similar to what you are describing can't be done via other methods.

EDIT:
As Tom pointed out, the aforementioned prompt can be disabled in the Terminal Services Configuration. Hopefully this isn't the case for you.

You could also ask another admin (if you have one) to look at the sessions on the terminal server, or look yourself if you have the permissions, and see if the admin in question is logged in. Terminal services manager will show the state of a session that is shadowing another as "RemoteControl".

You could look for an rdpclip.exe process running on the server under the context of the admin's user ID. That'll indicate that the admin has a terminal session, but not necessarily whether or not they're shadowing anyone.

link|improve this answer
2  
Remote control can be configured to not require the users permission, at the GPO or RDP level. – joeqwerty Aug 31 '10 at 16:18
Thanks @joe I edited that point in. – squillman Aug 31 '10 at 16:27
feedback
up vote 0 down vote

The "prompt" referred to above can be disabled in Terminal Service Manager. FYI.

link|improve this answer
That's a good point, I had forgotten about that. (You should leave a comment on my answer, though, instead of posting a new answer.) – squillman Aug 31 '10 at 16:19
Ah, still learning the site, thanks. Good luck! Tom – SpacemanSpiff Sep 2 '10 at 5:57
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.