Connect with us

Hi, what are you looking for?

Citrix XenApp

How to setup Citrix Director Shadowing with Microsoft Remote Assistance using Group Policy

1

Citrix Director is considered the first console you should open when you want to see an overview of what’s going on in your Citrix environment. You can do quite a bit of drilling down now with the latest 7.6.100 update which you can get here:

http://support.citrix.com/article/CTX200330.

Don’t forget to run the following after the install is complete:

C:\inetpub\wwwroot\Director\tools/DirectorConfig.exe /upgrade

with an elevated command prompt (necessary for Server 2012 R2 but not for Server 2008 R2 from my testing). If you get all green text and it says ” Director configuration completed!” you are good to go.

One of the best features of Director is the ability to “Shadow” a user and remote control their XenDesktop VM using Microsoft Remote Assistance. This has been a feature for Director for quite some time and is nothing new to 7.x but it still requires a little bit of setup to work in most environments. In the first screenshot above, I have an unmanaged virtual desktop running with a user currently connected. Make sure you are using Director with IE 11 for best compatibility. I click the blue Shadow button shown in the the picture since it’s not greyed out.

Next I get this message in the Remote Assistance Viewer console that pops up saying it is waiting for the user to connect:

2

and on the user’s virtual desktop, they will see this message to accept the offer for remote help:

3

Once they hit Yes it will let them know the “helper” can see the session:

4
In the meantime I can “Request control” to help the user or begin a chat session with them:

5

and the user will have to grant me control to help them:

6

Very easy right! But here’s what can sometimes happen, the Shadow button is greyed out or if you click on it you might get an error like:

Failed to initiate Remote Assistance: You have insufficient permissions (error code 102). Refer to documentation for Remote Assistance configuration. View server event logs for further information.

This means Shadowing is not configured properly for the user that is logged into Director. Usually because the Director user is not a local Administrator on the virtual desktop. I used to have this happen to me all the time in XenDesktop 5.6 environments and the fix is pretty easy using group policy. It’s the same old procedure for XenDesktop 7.6. Go to your XenDesktop group policy that applies to your VMs and drill down into:

Computer Configuration > Policies (this may be skipped depending on the group policy console you are using) > Administrative Templates > System > Remote Assistance > Offer Remote Assistance

You’ll want to enable:

Configure Offer Remote Assistance

and in the drop down select:

Allow helpers to remotely control the computer

so it will look like this:

8

A “helper” is a someone that is going to try and Shadow a user and offer remote assistance through Director. You will need to define who the “helpers” will be. So now go ahead and click the Show button:

9

and begin to add the same security groups that have access to Director (you delegate access to Director via Citrix Studio in Configuration > Administrators). It should like this with one domain\usergroup per line:

10

Save the group policy and go to one of your virtual desktops and do a gpupdate. Then go to Computer Management and double click on the “Offer Remote Assistance Helpers”:

12

You should see your groups you added in the group policy here:

11

Now if the Director user attempts to Shadow the virtual desktop user it will work just fine.

3 Comments

3 Comments

  1. Max

    June 2, 2017 at 2:42 PM

    Hello my friend, is there any configuration to allow remote assistance to connect in a computer without user intervention, as it was in XA 6.5, i.e.?
    thank you

  2. Erik

    October 25, 2019 at 1:36 AM

    Is it possible to change the Remote Assistance program from the Microsoft Remote Assist program, to say TightVNC?

  3. Jason Samuel

    November 6, 2019 at 10:57 AM

    @Erik, no you’ll have to use it separately.

Leave a Reply

Your email address will not be published. Required fields are marked *

You May Also Like

Apache

Today I would like to go over proper URL redirection when using SSL but first I would like to preface this by describing what...

Citrix Workspace

You can use FIDO2 hardware security keys plugged into your physical desktop over the Citrix HDX remoting protocol for use with virtualized Windows Desktop...

Exchange 2003

A useful Exchange 2003 guide I wrote for a friend’s blog originally but I am posting it here on mine now for your viewing...

Apache

In a worst case scenario and all your web servers have failed, what do you do? You could have a standby group of servers...

JasonSamuel.com began in 2008 as a way for me to give back to the IT community. This website features the latest news and how-to's on enterprise mobility, security, virtualization, cloud architecture, and other technologies I work with. This website has evolved over time to become a go-to reference hub for these technologies. It receives hundreds of thousands of unique visitors from all over the world each month. More details on the About Me page.
Copyright © 2008-2023 JasonSamuel.com