View or control another user's RDP session (shadowing)

Shadowing lets an administrator see another user's Remote Desktop session live, and optionally take control of the mouse and keyboard. It is the quickest way to help a team member who is stuck, without asking them to describe every click. This guide shows how to find the right session, start a shadow with mstsc, and control when users must give consent.

Before you start

• A Windows VPS running Windows Server 2019, 2022 or 2025.
• An account in the local Administrators group. Connect to the server on 203.0.113.10:3389.
• The other user signed in with their own account. On a server without the Session Host role, that uses both of the two admin sessions: yours and theirs.
• Tell the user first. Even when the policy allows silent viewing, watching someone's screen without telling them damages trust and may break workplace rules.

How shadowing works here

The simplest and safest method is to shadow from inside the server. You connect normally on port 3389, then run mstsc /shadow in your own session to open a window onto the other user's session. Nothing extra needs to be opened in the firewall, because the shadow connection never leaves the server.

Shadowing from your own PC directly is also possible, but it needs extra ports such as SMB and RPC open to the internet. Avoid that on a public server.

Find the session ID

Every session has a number. In your RDP session, open Command Prompt or PowerShell and run:

quser

The output looks like this:

 USERNAME     SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
>admin        rdp-tcp#3           2  Active          .  11/9/2026 9:02 AM
 deploy       rdp-tcp#5           3  Active          4  11/9/2026 9:20 AM

The > marks your own session. In this example, the user deploy is in session 3. The session must be Active. You cannot shadow a disconnected session; ask the user to reconnect first.

Start a shadow session

To view only:

mstsc /shadow:3

To view and control the mouse and keyboard:

mstsc /shadow:3 /control

By default the user sees a prompt asking whether to allow the request. When they click Yes, a window opens on your screen showing their desktop. Close that window to stop shadowing.

If the consent policy allows it, you can skip the prompt:

mstsc /shadow:3 /control /noConsentPrompt

Set the consent policy

Windows decides whether consent is needed and whether control is allowed through one policy.

1. Press Win + R, type gpedit.msc and press Enter.
2. Go to Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Connections.
3. Open Set rules for remote control of Remote Desktop Services user sessions.
4. Select Enabled, then choose one option:

• No remote control allowed
• Full Control with user's permission
• Full Control without user's permission
• View Session with user's permission
• View Session without user's permission

1. Click OK and run:

   gpupdate /force

Full Control with user's permission is a sensible choice for most teams. It allows help when needed, and the user always knows when someone is watching.

To check what is set, read the policy value:

Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name Shadow -ErrorAction SilentlyContinue

The values map to the options above in order: 0 no remote control, 1 full control with permission, 2 full control without permission, 3 view with permission, 4 view without permission. No value means the policy is not configured and Windows uses its default, which asks the user for permission.

Use shadowing to support your team

• Agree a routine. Message the user, ask them to stay connected, then start the shadow.
• Watch first, control second. Start with view-only and switch to /control only if they want you to drive.
• Keep sessions short. Close the window as soon as the problem is solved.
• Use separate accounts. Shadowing only works between different sessions, so a shared login cannot be shadowed by its own users.

Check it works

1. Ask a colleague to connect to 203.0.113.10:3389 with their own account and leave a Notepad window open.
2. In your session, run quser and note their ID.
3. Run mstsc /shadow:<ID> /control.
4. They accept the prompt, and you see their Notepad window and can type in it.

Troubleshooting

• "Shadow Error: The specified session is not connected": the user is disconnected. Ask them to connect again, then check quser for the new state.
• "The operator or administrator has refused the request": the user clicked No, or the prompt timed out. Ask them to watch for it and try again.
• Access denied: your account is not a local administrator, or the policy is set to No remote control allowed.
• The user cannot connect at all: both sessions are in use. See Allow or block multiple RDP sessions for one user for how session limits work.

Next steps

• Give each team member their own login: Create a Windows user with RDP access.
• Clean up sessions people leave behind: Sign out a stuck or disconnected RDP session.
• Habits that keep a shared server tidy: Remote desktop best practices for teams.