Posted on October 7, 2015 · Posted in Windows Server 2012 R2

RDS Shadow: How to Connect to a User Session in Windows Server 2012 R2

Microsoft has brought Remote Desktop Shadowing to Windows Server 2012 R2 and Windows 8.1. We remind that Shadow mode (Shadow session) can be used by administrator to view and manage any active terminal user session. This mode has been supported almost since the first Microsoft terminal server versions and was suddenly removed from Windows Server 2012 (due to the transfer of the stack rdp from kernel to user mode).

Additionally, RD Shadow and RDP client have got some new interesting features. The full list of RDP client (mstsc.exe) options that define the possibility of connection to a terminal user session:

Mstsc.exe [/shadow:sessionID [/v:Servername] [/control] [/noConsentPrompt]]

mstsc.exe options

/shadow:ID – allow to connect to a terminal session with the specified ID

/v:servername is the name of a terminal server (if not set, a current server will be used)

/control allows to interact with the user session (if not set, a user session view mode is used)

/noConsentPrompt allows not to prompt the user for confirmation to connect to a session

Restrictions of the RDS Shadow Sessions in Windows 2012 R2

  1. Only server administrator can connect to other sessions. These rights can not be delegated to regular  users
  2. RDS Shadow won’t work in the networks based on workgroups

Remote Desktop Shadow: How to Work in GUI

You can connect to a user session using mstsc.exe or directly from Server Manager console. To do it, open QuickSessionCollection in Server Manager.

RDS 2012 R2 - QuickSessionCollection

Click a user session and select Shadow in the dropdown menu.

Shadowing user session


A window of Shadow connection parameters appears. You can either View or Control a session. You can also check Prompt for user consent option.

Shadow remotesession Windows 2012 R2

If this option is checked, the following request appears in the session:

woshub\administrator is requesting to view your session remotely. Do you accept the request?

Remote Monitoring Request

If a user accepts this request, the administrator will see the desktop and be able to interact with it. 

Shadow user session

Tip. To disconnect from a user session and exit the Shadow mode, press ALT+* for the workstation or Ctrl+* for the terminal server (if other combinations are not set).

If a user denies the connection, the following window appears:

Shadow Error: The operator or administrator has refused the request

The operator or administrator has refused the request
When trying to connect to a user session without the confirmation request, an error appears that this behavior is set by a group policy.

Shadow Error: The Group Policy setting is configured to require the user’s consent. Verify the configuration of the policy settings.

The Group Policy setting is configured to require the user’s consent

The settings of the remote terminal user session management are determined by the policy Set rules for remote control of Remote Desktop Services user sessions, which is located in Policies -> Administrative Templates -> Windows components -> Remote Desktop Services -> Remote Session Host -> Connections in user and computer sections of the GPO.

This policy can be used to configure the following RD Shadow connection variants:

  • No remote contol allowed
  • Full Control with users’s permissionя
  • Full Control without users’s permission
  • View Session with users’s permission
  • View Session without users’s permission

policy Set rules for remote control of Remote Desktop Services user sessions

RDS Shadow from Powershell

You can also use Remote Desktop Services Shadow features from Powershell.

First of all, we’ll demonstrate how to get a list of sessions on the terminal server. (User sessions will be grouped depending on their status.)

Get-RDUserSession | ft Username, UnifiedSessionId, SessionState, HostServer, ApplicationType -GroupBy Sessionstate


There are three active terminal sessions on this server. Let’s connect to the user session with the session ID 3:

Mstsc /shadow:3 /control

mstsc control


Related Articles