We're using Active Directory and currently, only our Administrators who log in to Domain Controller can shadow RDP sessions. From there they're shadowing RDP sessions on another Windows Server 2016.

It is working as expected, but all these users that are shadowing RDP sessions on another server, as a part of the support team, shouldn't have administrator rights nor should they have an access to our Domain Controller, as they're not IT personnel.

Is there a way to give access to RDP shadowing from a server that is not our DC, to a specific user group (for example "Support") to shadow RDP sessions?

It doesn't have to be a GUI solution (though it is preferred), we can use the command line as well, but for now, I can't seem to be able to give these rights to the specific user group on another server that is part of our domain, but is not our DC.

If that is not possible, is the simpler solution possible: giving rights to the specific group on our DC to shadow RDP sessions?

bumped to the homepage by Community yesterday

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

To be able to shadow sessions on an RDS server, the user or group needs to be granted the Remote Control permission on the RDP protocol on the server where the sessions to be shadowed are.

enter image description here

  • Remote Desktop Session Host Configuration no longer exists from Server 2012 onwards – Alen Šimunic Nov 4 '17 at 1:53

Per this technet you need to be an admin to shadow RDP sessions

https://blogs.technet.microsoft.com/askperf/2013/10/22/windows-8-1-windows-server-2012-r2-rds-shadowing-is-back/

"Only an administrator may shadow sessions. The ability to shadow sessions cannot be delegated to users that are not part of the administrators group."

  • In the comments of this technet they have a possible solution for giving shadowing to RDP sessions for non admin users. purerds.org/remote-desktop-scripts/… – SpiderIce Oct 17 '17 at 19:37
  • Couldn't get the script working. My group is "Customer Support", so when I run the script and try "PRIMARYDC\Customer Support" with or without " sign, it doesn't output anything at all. Has anyone used this script yet to share experiences? – Alen Šimunic Nov 4 '17 at 2:05

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.