How to enable session shadowing for non local admin users

Without adding the account to the local admin group, is there a way to enable that account to shadow other session in windows terminal server?

PS: I have already enable the remote session in the account property in AD and also added the account in the permission tab under the listener property.

Thanks.
Beta99Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JdixonCCNACommented:
Try the following link...

http://support.microsoft.com/kb/278845
0
JdixonCCNACommented:
If you want to shadow the session without requiring the session owners permission, i.e. no prompt to accept the shadow on the users session, uncheck the require users permission checkbox in the RDP/TCP settings under Start-Programs-AdministrativeTools-Terminal Services Configuration.
0
Henrik JohanssonSystems engineerCommented:
Start the Terminal Services Configuration MMC
Double-click RDP/Tcp, and in the dialog select Security tab to modify the RDP-permisions. Use the Advanced button to grant the Remote Control permission for the user/group.
0
Beta99Author Commented:
JdixonCCNA, I don't have any issue shadowing any sessions, it's the ability to do it w/o admin rights that's my problem.

henjoh09, I've tried it and gave the user full rights but still get an "access denied" error when attempting to shadow a session.



0
Henrik JohanssonSystems engineerCommented:
Modifying the permissions shall work, but changes in RDP-Tcp Properties doesn't affect current sessions makes the users to have to be logged of when doing the modification.
Just tested by myself to refresh my memory, and it doesn't work if the shadowed user is an administrator, propably caused by WIL (Windows Integrity Levels) restricting a process with lower authority token from accessing a process with higher authority token.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.