Windows Server 2016 how to give shadow rights to a user who is not a administrator

active-directoryrdpwindows-server-2016

We're using Active Directory and currently, only our Administrators who log in to Domain Controller can shadow RDP sessions. From there they're shadowing RDP sessions on another Windows Server 2016.

It is working as expected, but all these users that are shadowing RDP sessions on another server, as a part of the support team, shouldn't have administrator rights nor should they have an access to our Domain Controller, as they're not IT personnel.

Is there a way to give access to RDP shadowing from a server that is not our DC, to a specific user group (for example "Support") to shadow RDP sessions?

It doesn't have to be a GUI solution (though it is preferred), we can use the command line as well, but for now, I can't seem to be able to give these rights to the specific user group on another server that is part of our domain, but is not our DC.

If that is not possible, is the simpler solution possible: giving rights to the specific group on our DC to shadow RDP sessions?

Best Answer

To be able to shadow sessions on an RDS server, the user or group needs to be granted the Remote Control permission on the RDP protocol on the server where the sessions to be shadowed are.

Related Solutions

Powershell – How to give a user NTFS rights to a folder, via Powershell

At my previous job, I recall being able to use the old 'mkdir' command to create folders in my powershell scripts, but to start I would suggest quoting your path and testing with an echo/write-host at first. Try this, just to test:

write-host "\\${file_server}\home$\${user_name}"

I don't have access to a Windows machine to test, but I'm guessing the '$' may also be an issue.

try this with a back-tick to try and escape the $:

write-host "\\${file_server}\home`$\${user_name}"

and don't continue, until you know that the string is to your liking. I don't think you need the -prompt in your read-host, though it's probably not an issue. write-hosting is always a nice sanity-check.

I hope to get access to a Windows machine soon so I can provide better help.

Also, if interested, you could provide the username as a parameter at the top of the program, so you can either repeatedly call the script from another that reads names from a file of $file_server, $user_name pairs. Just plop a param( [string] $file_server, [string] $user_name )

Good luck! :)

Windows Server 2008 R2 – Fix Remote Desktop Session Remote Control Error 5: Access Denied

I found the solution: The user must run the powershell with elevated rights. I used this solution for my script that starts a remote controlled session:

http://www.christiano.ch/wordpress/2009/07/26/get-content-access-to-the-path-cprogram-files-is-denied/

Best Answer

Related Solutions

Powershell – How to give a user NTFS rights to a folder, via Powershell

Windows Server 2008 R2 – Fix Remote Desktop Session Remote Control Error 5: Access Denied

Related Topic