tinyapps.org / blog

Remote Desktop: Enable concurrent interactive and remote sessions #

(without hack workarounds) via RDP shadowing.

Warning: Do not proceed without fully understanding the steps involved and how to secure your network.

1. On Windows 10 Professional ("server")

1. System Properties (sysdm.cpl) → Remote

2. Enable "Allow remote connections to this computer" → OK

3. Group Policy Editor (gpedit.msc) → Local Computer Policy → Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Connections

4. Double click "Set rules for remote control of Remote Desktop Services user sessions" → select "Enabled" → set "Options:" to "Full Control without user's permission" → OK

5. Windows Defender Firewall with Advanced Security (wf.msc) → check "File and Printer Sharing (SMB-In)" and "Remote Desktop - Shadow (TCP-In)" are enabled for LAN connections (see Restrict Windows Remote Desktop connections to LAN only)

2. On Windows 11 Home ("client")

1. If the local and remote credentials differ, store the remote username and password in Windows Credential Manager:

   cmdkey /add:<hostname|IP> /user:<remote_user> /pass:<remote_pass>

2a. Manual method

1. Retrieve the remote user's session ID (will generally be "1" or "2" on single-user systems):

   qwinsta /server:<hostname|IP>

2. Connect:

   mstsc.exe /shadow:<sessionID> /v:<hostname|IP> /noconsentprompt /control

2b. Automatic method

1. Modify and save this batch file, then run it to automatically retrieve the user session ID and establish a connection:

   @echo off
   setlocal enabledelayedexpansion
   
   :: Set your remote username and hostname or IP address
   set remote_user=<USERNAME>
   set remote_host=<HOSTNAME|IP>
   
   :: Get the session ID for the specified username where the session state is Active
   for /f "tokens=2,3,4" %%a in ('qwinsta /server:%remote_host% ^| findstr /R "^ %remote_user%"') do (
       if "%%c"=="Active" (
           set session_id=%%b
       )
   )
   
   :: If an active session ID was found for the specified user, connect automatically
   if defined session_id (
       start "" mstsc /v:%remote_host% /shadow:%session_id% /control /noConsentPrompt
   ) else (
       echo No active session found for user "%remote_user%".
   )
   
   exit

3. Notes

• Errors:

  • Long delay on initial login followed by "Shadow Error: This computer name is invalid" – Resolved by enabling the "File and Printer Sharing (SMB-In)" and "Remote Desktop - Shadow (TCP-In)" rules in the server's firewall settings.

  • "Shadow Error: Access is denied" – Fixed by saving remote credentials in the Credential Manager using cmdkey. Alternatively, you can use the /prompt flag with mstsc.exe to manually enter credentials. However, this option isn't available for qwinsta.exe /server: or query.exe <username|session> /server:, so they will return Error [5]: Access is denied unless local and remote credentials match.

  • "Shadow Error: The session identification does not specify a valid session." – For manual login, this is resolved by retrieving the correct session ID on the server with query user. The batch script automatically finds the correct session ID, so no manual intervention is needed.

• In Microsoft's Remote Desktop lexicon, the terms "local session", "interactive session", and "console session" all refer to the session in which the user is physically present at the computer.

• View stored credentials via cmdkey /list and delete them with cmdkey /delete:<hostname|IP>. Both actions can also be performed through the Credential Manager GUI (control keymgr.dll).

4. Further reading

• Viewing a Remote User’s Desktop Session with Shadow Mode in Windows

• Remote Desktop with Shadow mode in Windows

• リモートデスクトップ「シャドウ」ってなんだ？使い方を解説

• Windows Server 2008 R2 Remote Desktop Services Resource Kit; "Shadowing a User Session" in the "Providing Help with Remote Control" section of Chapter 11, "Managing Remote Desktop Sessions"

• Shadow Remote Desktop Session (RDS) Without Permission Prompt

• Spying on users using Remote Desktop Shadowing - Living off the Land

  • H/T: About RDP shadow(-ing) – a less known feature included in desktop and server Windows operating systems

• How to perform RDP shadowing from Win10 Pro to another Win10 Pro

• How to Shadow (Remote Control) a User’s RDP session on Windows Server RDS

• Windows-RemoteShadow

• AVD \ WVD Shadowing

/windows | Sep 04, 2024

Subscribe or visit the archives.