How to Enable RDP Shadow Mode in Windows

What Is Remote Desktop Shadowing?

Shadow session mode lets an administrator:

• View the user’s desktop in real time.
• Control the desktop (with permission) to assist.
• Manage multiple RDP shadow sessions from one console.

Supported in Windows Server 2016, 2019, 2022, and 2025.
Not supported in Windows Server 2012 due to RDP architecture changes.

Prerequisites Before Enabling Shadow RDP

Before you set up RDP shadow mode:

1. Enable multiple RDP sessions on your Windows Server. See: [Enable Multiple RDP Sessions Guide]
2. Ensure you have Administrator privileges.
3. Confirm the target session is active (you can’t shadow a disconnected or idle session).

Steps to Enable RDP Shadowing

Step 1: Enable RDP Shadow via Group Policy

1. Press Windows + R, type gpedit.msc, and press Enter.
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections > Set rules for remote control of Remote Desktop Services user sessions
   
3. Choose one of the following:

• Full control without the user’s permission
• Full control with the user’s permission

4. Click Apply.

Step 2: Enable RDP Shadow in Firewall

If your firewall blocks shadow connections:

1. Open Windows Defender Firewall with Advanced Security.
2. Click Inbound Rules.
3. Ensure the rule for Remote Desktop Services (Shadow) is enabled.
   

Step 3: Identify RDP Session to Shadow

Open PowerShell or Command Prompt and run:

qwinsta

This lists:

• Usernames
• Session IDs
• Connection status
  

Step 4: Start Shadowing an RDP Session

• View Only

mstsc /shadow:<SessionID>

• View & Control

mstsc /shadow:<SessionID> /control

Replace with the ID from qwinsta.

Notes for Using Shadow Remote Desktop

• Only the user with administrator permission can connect to other users’ shadow sessions.
• The shadow session must be active. If it’s disconnected or inactive, it cannot be connected.
• Please remember to enable multiple sessions.